- third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch * Add mc helpers for both tcsh and bash resources (boo#1203617) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch * Add mc helpers for both tcsh and bash resources (boo#1203617) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch * Add mc helpers for both tcsh and bash resources (boo#1203617) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - silence the output in the case of broken symlinks (bsc#1218232) - add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch home and end button not working from ssh client (bsc#1221407) - use autosetup in prep stage of specfile - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch drop the stderr redirection for csh (bsc#1221361) - add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch drop sysctl.d/50-default-s390.conf (bsc#1211721) - add aaa_base-preinstall.patch make sure the script does not exit with 1 if a file with content is found (bsc#1222547) - modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to also fix the typo to set JAVA_BINDIR in the csh variant of the alljava profile script (bsc#1221361) - Add patch git-50-845b509c9a005340a0455cb8a7fe084d1b8f1946.patch * Add mc helpers for both tcsh and bash resources (boo#1203617) - Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch * add sysctl.d/51-network.conf to tighten network security a bit see also (boo#1146866) (jira#SLE-9132) - Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch * Add s390x compressed kernel support (bsc#1151023) - Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch * Fix LC_NAME and LC_ADDRESS in sh.ssh - Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch * fix string test to arithmetic test in /etc/profile.d/wsl.sh - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch * add sysctl.d/51-network.conf to tighten network security a bit see also (boo#1146866) (jira#SLE-9132) - Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch * Add s390x compressed kernel support (bsc#1151023) - Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch * Fix LC_NAME and LC_ADDRESS in sh.ssh - Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch * fix string test to arithmetic test in /etc/profile.d/wsl.sh - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch * add sysctl.d/51-network.conf to tighten network security a bit see also (boo#1146866) (jira#SLE-9132) - Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch * Add s390x compressed kernel support (bsc#1151023) - Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch * Fix LC_NAME and LC_ADDRESS in sh.ssh - Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch * fix string test to arithmetic test in /etc/profile.d/wsl.sh - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch * add sysctl.d/51-network.conf to tighten network security a bit see also (boo#1146866) (jira#SLE-9132) - Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch * Add s390x compressed kernel support (bsc#1151023) - Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch * Fix LC_NAME and LC_ADDRESS in sh.ssh - Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch * fix string test to arithmetic test in /etc/profile.d/wsl.sh - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch * check if variables can be set before modifying them to avoid warnings on login with a restricted shell (bsc#1138869) - Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch * service: check if there is a second argument before using it (bsc#1051143) - Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch Use official key binding functions in inputrc that is replace up-history with previous-history, down-history with next-history and backward-delete-word with backward-kill-word (bsc#1084934). Add some missed key escape sequences for urxvt-unicode terminal as well (boo#1007715). - Clear broken ghost entry in patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch which breaks (lib)readline (bsc#1157278) - Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970) - Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch change rp_filter to 2 to follow the current default (bsc#1160735) - Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch get_kernel_version: fix for current kernel on s390x (from azouhr) (bsc#1151023) (bsc#1139939) - Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch added "-h"/"--help" to "old" command (from Bernhard Lang) - Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch change feedback url from http://www.suse.de/feedback to https://github.com/openSUSE/aaa_base/issues - Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch * Not all XTerm based emulators do have an terminfo entry (boo#1087982) - Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch * Better support of Midnight Commander (bsc#1170527) - Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch * add screen.xterm-256color to DIR_COLORS - Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch * check for Packages.db and use this instead of Packages (boo#1171762) - Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch * Rename path() to _path() to avoid using a general name. - Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973) - Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch * sort TERM entries in etc/DIR_COLORS - Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch * DIR_COLORS: merge TERM entries with list from (bug#1006973) - Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548) - Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch * etc/profile add some missing ;; in case esac statements - Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch * profile and csh.login: on s390x set TERM to dumb on serial console for sclp_line0 and ttyS0 console (bug#1153946) - Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch * backup-rpmdb: exit if zypp.pid is there and running (bug#1161239) - Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch * also add color alias for ip command, jira#sle-9880, bsc#1153943 - Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch * alias.bash check if ip command knows color=auto (jsc#SLE-7679) - Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch * Avoid semicolon within (t)csh login script on S/390. (bsc#1179431) - Include all fixes and changes for systemwide inputrc to remove the 8 bit escape sequence which interfere with UTF-8 multi byte characters as well as support the vi mode of readline library. This is done with the patches * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch before the changed patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch rename it to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch and also add the patches * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch - Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch * sysctl.d/50-default.conf: allow everybody to create IPPROTO_ICMP sockets (bsc#1174504) - Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch * sysctl.d/50-default.conf: fix ping_group_range syntax error - Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch: * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248) - use autopatch - update first two patches from git originals to have the same apply depth as the rest: - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch - fix get_kernel_version.c to work also for recent kernels on the s390/X platform (bsc#1191563) - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch - support xz compressed kernel (bsc#1162581) - git-38-4c0060639f6fa854830a708a823976772afe7764.patch - Fixing possible resource leak - git-39-df622b89bc92fd882a6715c5743095528a643546.patch - excluding new kernel string in version search - Port change from Thu Sep 30 08:51:55 UTC 2022 forword to current version which includes a rename of patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch to git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch as otherwise autopatch macro does not work anymore - fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to allow ICMP ping - added patches + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch - Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch * The wrapper rootsh is not a restricted shell (bsc#1199492) - Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch * respect /etc/update-alternatives/java when setting JAVA_HOME (bsc#1215434,bsc#1107342) - replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch * fix the issues from bsc#1107342 and bsc#1215434 and just use the settings from update-alternatives to set JAVA_HOME - fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch to actually apply - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * v1.11.0 release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20240529 * Internal networks cannot make external DNS requests * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate nix to 0.29.0 * [skip-ci] RPM: use default __cargo macro across all envs * chore(deps): update dependency containers/automation_images to v20240513 * fix(deps): update rust crate anyhow to 1.0.83 * [skip-ci] Packit: separate `packages` key for rhel jobs * fix(deps): update rust crate libc to 0.2.154 * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync * [skip-ci] Packit: Remove EL8 jobs * fix(deps): update rust crate syslog to ^6.1.1 * fix reverse ipv6 lookup test flake * fix(deps): update hickory-dns monorepo to 0.24.1 * chore(deps): update rust crate chrono to 0.4.38 * Don't tear down all server threads on SIGHUP (bsc#1224167) * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate tokio to 1.37.0 * Update to nix-0.28.0 * update chrono package * chore(deps): update dependency containers/automation_images to v20240320 * fix(deps): update rust crate anyhow to 1.0.81 * tests: check queried domain name in reverse lookup tests * fix: set name for answers in reverse lookups * chore: fix typo in runner script * chore: fix log message when doing reverse lookup * fix(deps): update rust crate log to 0.4.21 * fix(deps): update rust crate anyhow to 1.0.80 * chore(deps): update rust crate chrono to 0.4.34 * fix(deps): update rust crate async-broadcast to 0.7.0 * fix(deps): update rust crate tokio to 1.36.0 * [CI:DOCS] Packit: disable bodhi tasks * chore(deps): update rust crate chrono to 0.4.33 * Bump to 1.11.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * v1.11.0 release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20240529 * Internal networks cannot make external DNS requests * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate nix to 0.29.0 * [skip-ci] RPM: use default __cargo macro across all envs * chore(deps): update dependency containers/automation_images to v20240513 * fix(deps): update rust crate anyhow to 1.0.83 * [skip-ci] Packit: separate `packages` key for rhel jobs * fix(deps): update rust crate libc to 0.2.154 * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync * [skip-ci] Packit: Remove EL8 jobs * fix(deps): update rust crate syslog to ^6.1.1 * fix reverse ipv6 lookup test flake * fix(deps): update hickory-dns monorepo to 0.24.1 * chore(deps): update rust crate chrono to 0.4.38 * Don't tear down all server threads on SIGHUP (bsc#1224167) * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate tokio to 1.37.0 * Update to nix-0.28.0 * update chrono package * chore(deps): update dependency containers/automation_images to v20240320 * fix(deps): update rust crate anyhow to 1.0.81 * tests: check queried domain name in reverse lookup tests * fix: set name for answers in reverse lookups * chore: fix typo in runner script * chore: fix log message when doing reverse lookup * fix(deps): update rust crate log to 0.4.21 * fix(deps): update rust crate anyhow to 1.0.80 * chore(deps): update rust crate chrono to 0.4.34 * fix(deps): update rust crate async-broadcast to 0.7.0 * fix(deps): update rust crate tokio to 1.36.0 * [CI:DOCS] Packit: disable bodhi tasks * chore(deps): update rust crate chrono to 0.4.33 * Bump to 1.11.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * v1.11.0 release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20240529 * Internal networks cannot make external DNS requests * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate nix to 0.29.0 * [skip-ci] RPM: use default __cargo macro across all envs * chore(deps): update dependency containers/automation_images to v20240513 * fix(deps): update rust crate anyhow to 1.0.83 * [skip-ci] Packit: separate `packages` key for rhel jobs * fix(deps): update rust crate libc to 0.2.154 * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync * [skip-ci] Packit: Remove EL8 jobs * fix(deps): update rust crate syslog to ^6.1.1 * fix reverse ipv6 lookup test flake * fix(deps): update hickory-dns monorepo to 0.24.1 * chore(deps): update rust crate chrono to 0.4.38 * Don't tear down all server threads on SIGHUP (bsc#1224167) * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate tokio to 1.37.0 * Update to nix-0.28.0 * update chrono package * chore(deps): update dependency containers/automation_images to v20240320 * fix(deps): update rust crate anyhow to 1.0.81 * tests: check queried domain name in reverse lookup tests * fix: set name for answers in reverse lookups * chore: fix typo in runner script * chore: fix log message when doing reverse lookup * fix(deps): update rust crate log to 0.4.21 * fix(deps): update rust crate anyhow to 1.0.80 * chore(deps): update rust crate chrono to 0.4.34 * fix(deps): update rust crate async-broadcast to 0.7.0 * fix(deps): update rust crate tokio to 1.36.0 * [CI:DOCS] Packit: disable bodhi tasks * chore(deps): update rust crate chrono to 0.4.33 * Bump to 1.11.0-dev - First version of aardvark-dns - Fix libexecdir issue on Leap and SLE - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * fix(deps): update rust crate tokio to 1.27.0 * use lower TTL for contianer entries * fix(deps): update rust crate syslog to ^6.0.1 * fix(deps): update rust crate futures-util to 0.3.28 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump futures-util from 0.3.26 to 0.3.27 * [CI:BUILD] Packit: trigger builds on commit to main branch * build(deps): bump anyhow from 1.0.68 to 1.0.70 * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump chrono from 0.4.23 to 0.4.24 * build(deps): bump libc from 0.2.139 to 0.2.140 * build(deps): bump async-broadcast from 0.5.0 to 0.5.1 * build(deps): bump signal-hook from 0.3.14 to 0.3.15 * build(deps): bump futures-util from 0.3.25 to 0.3.26 * build(deps): bump tokio from 1.25.0 to 1.26.0 * [CI:DOCS] Clarify packit related comments * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * Switch to explicit platform list for `cargo vendor-filterer` * bump to v1.6.0-dev * Add renovate.json5 * Cirrus: Groom rust cache before updating - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29.0 * fix(deps): update rust crate clap to 4.3.8 * fix(deps): update rust crate clap to 4.3.5 * run cargo update * [CI:BUILD] Packit: add Fedora downstream tasks * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * fix(deps): update rust crate clap to 4.3.2 * fix(deps): update rust crate clap to 4.3.1 * cirrus: remove verify_vendor task * chore(deps): update dependency containers/automation_images to v20230601 * fix(deps): update rust crate trust-dns-server to 0.22.1 * chore(deps): update rust crate chrono to 0.4.26 * fix(deps): update rust crate tokio to 1.28.2 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate tokio to 1.28.1 * chore(deps): update dependency containers/automation_images to v20230426 * fix(deps): update rust crate clap to 4.2.7 * fix(deps): update rust crate anyhow to 1.0.71 * fix typo in makefile * fix(deps): update rust crate tokio to 1.28.0 * fix(deps): update rust crate clap to 4.2.5 * fix(deps): update rust crate syslog to ^6.1.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.3 * fix(deps): update rust crate clap to v4 * chore(deps): update dependency containers/automation_images to v20230405 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Packit: switch to @containers/packit-build team for copr failure notification comments * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * cargo: bump chrono to 0.4.30 * test: IPv6 format is changed in v1.72.0 * bump nix to 0.27.1 * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0 * fix(deps): update rust crate trust-dns-server to 0.23.0 * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate anyhow to 1.0.75 * fix(deps): update rust crate tokio to 1.32.0 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate tokio to 1.31.0 * fix(deps): update rust crate anyhow to 1.0.74 * fix(deps): update rust crate anyhow to 1.0.73 * fix(deps): update rust crate log to 0.4.20 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update rust crate tokio to 1.30.0 * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate anyhow to 1.0.72 * fix(deps): update rust crate signal-hook to 0.3.17 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate signal-hook to 0.3.16 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate tokio to 1.29.1 * fix(deps): update rust crate clap to 4.3.10 * [CI:BUILD] RPM: cleanup spec and fix eln builds * bump to v1.8.0-devel - Update to version 1.9.0: * Release v1.9.0 * v1.9.0 Update release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update rust crate tokio to 1.34.0 * fix(deps): update rust crate async-broadcast to 0.6.0 * update trust-dns to hickory * fix(deps): update rust crate futures-util to 0.3.29 * fix(deps): update rust crate trust-dns-server to 0.23.2 * fix(deps): update rust crate trust-dns-proto to 0.23.2 * tmt: initial enablement * aardvark main: change error reporting * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate trust-dns-proto to 0.23.1 * fix(deps): update rust crate trust-dns-client to 0.23.1 * clippy: some format fixes * fix(deps): update rust crate tokio to 1.33.0 * Bump to v1.9.0-dev - Update to version 1.10.0: * Release 1.10.0 * Release notes for 1.10.0 * chore(deps): update rust crate chrono to 0.4.32 * chore(deps): update dependency containers/automation_images to v20240102 * fix(deps): update rust crate futures-util to 0.3.30 * fix(deps): update rust crate anyhow to 1.0.79 * fix(deps): update rust crate tokio to 1.35.1 * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35.0 * fix duplicated IP CI flake * server: remove unused kill switch * fix(deps): update rust crate clap to ~4.4.10 * Bump working version to v1.10.0-dev - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * v1.11.0 release notes * run cargo update * chore(deps): update dependency containers/automation_images to v20240529 * Internal networks cannot make external DNS requests * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate nix to 0.29.0 * [skip-ci] RPM: use default __cargo macro across all envs * chore(deps): update dependency containers/automation_images to v20240513 * fix(deps): update rust crate anyhow to 1.0.83 * [skip-ci] Packit: separate `packages` key for rhel jobs * fix(deps): update rust crate libc to 0.2.154 * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync * [skip-ci] Packit: Remove EL8 jobs * fix(deps): update rust crate syslog to ^6.1.1 * fix reverse ipv6 lookup test flake * fix(deps): update hickory-dns monorepo to 0.24.1 * chore(deps): update rust crate chrono to 0.4.38 * Don't tear down all server threads on SIGHUP (bsc#1224167) * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate tokio to 1.37.0 * Update to nix-0.28.0 * update chrono package * chore(deps): update dependency containers/automation_images to v20240320 * fix(deps): update rust crate anyhow to 1.0.81 * tests: check queried domain name in reverse lookup tests * fix: set name for answers in reverse lookups * chore: fix typo in runner script * chore: fix log message when doing reverse lookup * fix(deps): update rust crate log to 0.4.21 * fix(deps): update rust crate anyhow to 1.0.80 * chore(deps): update rust crate chrono to 0.4.34 * fix(deps): update rust crate async-broadcast to 0.7.0 * fix(deps): update rust crate tokio to 1.36.0 * [CI:DOCS] Packit: disable bodhi tasks * chore(deps): update rust crate chrono to 0.4.33 * Bump to 1.11.0-dev - Drop source package, was only used by grpc which was switched over to use the shared library - Update to version 20200923.2 What's New: * absl::StatusOr<T> has been released. See our blog post for more information. * Abseil Flags reflection interfaces have been released. * Abseil Flags memory usage has been significantly optimized. * Abseil now supports a "hardened" build mode. This build mode enables runtime checks that guard against programming errors that may lead to security vulnerabilities. Notable Fixes: * Sanitizer dynamic annotations like AnnotateRWLockCreate that are also defined by the compiler sanitizer implementation are no longer also defined by Abseil. * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions. * Sanitizer usage is now automatically detected and no longer requires macros like ADDRESS_SANITIZER to be defined on the command line. Breaking Changes: * Abseil no longer contains a dynamic_annotations library. Users using a supported build system (Bazel or CMake) are unaffected by this, but users manually specifying link libraries may get an error about a missing linker input. - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - Update to version 20200923.2 What's New: * absl::StatusOr<T> has been released. See our blog post for more information. * Abseil Flags reflection interfaces have been released. * Abseil Flags memory usage has been significantly optimized. * Abseil now supports a "hardened" build mode. This build mode enables runtime checks that guard against programming errors that may lead to security vulnerabilities. Notable Fixes: * Sanitizer dynamic annotations like AnnotateRWLockCreate that are also defined by the compiler sanitizer implementation are no longer also defined by Abseil. * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions. * Sanitizer usage is now automatically detected and no longer requires macros like ADDRESS_SANITIZER to be defined on the command line. Breaking Changes: * Abseil no longer contains a dynamic_annotations library. Users using a supported build system (Bazel or CMake) are unaffected by this, but users manually specifying link libraries may get an error about a missing linker input. - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - update to 20240116.1: * Add absl::NoDestructor<T> to simplify defining static types that do not need to be destructed upon program exit. * Add configurable verbose logging (also known as VLOG). * Added absl::Overload(), which returns a functor that provides overloads based on the functors passed to it. Note that this functionality requires C++17 or newer. * Breaking Change: AbslHashValue() no longer accepts C-style arrays as a parameter, caller need to wrap C-string literals in absl::string_view. * Breaking Change: absl::weak_equality and absl::strong_equality have been removed. The corresponding std types were removed before C++20 was finalized - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - update to 20240116.1: * Add absl::NoDestructor<T> to simplify defining static types that do not need to be destructed upon program exit. * Add configurable verbose logging (also known as VLOG). * Added absl::Overload(), which returns a functor that provides overloads based on the functors passed to it. Note that this functionality requires C++17 or newer. * Breaking Change: AbslHashValue() no longer accepts C-style arrays as a parameter, caller need to wrap C-string literals in absl::string_view. * Breaking Change: absl::weak_equality and absl::strong_equality have been removed. The corresponding std types were removed before C++20 was finalized - SLE-only: import upstream patch to fix build with gcc7 in C++17 mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261) + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303 - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - Initial build (fate#326619, bsc#1109849) - The userPrincipalName attribute was not added to the created machine (bsc#1157491) - The host FQDN was not properly detected (bsc#1157491) - Added patches: * 0001-Remove-upper-case-only-check-when-looking-for-the-Ne.patch * 0002-Use-strdup-if-offsets-are-used.patch * 0003-correct-spelling-of-adcli_tool_computer_delete-descr.patch * 0004-doc-explain-that-all-credential-cache-types-are-supp.patch * 0005-library-add-adcli_conn_is_writeable.patch * 0006-Handle-kvno-increment-for-RODCs.patch * 0007-library-add-_adcli_bin_sid_to_str.patch * 0008-library-add-_adcli_call_external_program.patch * 0009-library-add-_adcli_ldap_parse_sid.patch * 0010-library-add-lookup_domain_sid.patch * 0011-library-add-adcli_conn_get_domain_sid.patch * 0012-Fix-memory-leak-in-test_check_nt_time_string_lifetim.patch * 0013-Add-trusted-for-delegation-option.patch * 0014-Only-update-attributes-given-on-the-command-line.patch * 0015-update-allow-to-add-service-names.patch * 0016-Calculate-enctypes-in-a-separate-function.patch * 0017-join-add-all-attributes-while-creating-computer-obje.patch * 0018-util-add-_adcli_strv_remove_unsorted.patch * 0019-Add-add-service-principal-and-remove-service-princip.patch * 0020-Do-not-add-service-principals-twice.patch * 0021-Do-not-depend-on-default_realm-in-krb5.conf.patch * 0022-adutil-add-_adcli_strv_add_unique.patch * 0023-adenroll-use-_adcli_strv_add_unique-for-service-prin.patch * 0024-Increment-kvno-after-password-change-with-user-creds.patch * 0025-library-use-getaddrinfo-with-AI_CANONNAME-to-find-a-.patch - Use GSS-SPNEGO if available (bsc#1162518) * 0026-Use-GSS-SPNEGO-if-available.patch - Add option to use ldaps (bsc#1162518) * 0027-add-option-use-ldaps.patch - Update samba secrets database after changing the machine password (jsc#sle-11503) * 0028-tools-add-option-add-samba-data.patch * 0029-tools-store-Samba-data-if-requested.patch * 0030-make-Samba-data-tool-configurable.patch * 0031-fix-typo-in-flag-value.patch * 0032-samba-data-tool-needs-to-take-an-argument.patch * 0033-doc-add-missing-samba_data_tool_path.xml-.in-to-EXTR.patch - Support testjoin command (jsc#sle-11503) * 0034-Implement-adcli-testjoin.patch - Respect allowed Kerberos encryption types; (bsc#1184462); Add 0035-handle-encryption-types.patch - Add --dont-expire-password option; (jsc#sle-21225); * 0036-Add-dont-expire-password-option.patch * 0037-Fix-for-dont-expire-password-option-and-join.patch - Remove errx() calls on error conditions to execute the cleanup function and delete the krb5 snippets created in /tmp; (bsc#1202647); * Add 0038-Remove-errx-from-tools.patch - Set umask before calling mkdtemp; (bsc#1202647); * Add 0039-Set-umask-before-calling-mkdtemp.patch - Write SID before secret to Samba's db; (bsc#1214076); Add 0040-adenroll-write-SID-before-secret-to-Samba-s-db.patch - Populate Samba's secrets database using offline domain join; (bsc#1214076); Add 0041-populate-samba-secrets-using-offline-domain-join.patch - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Update to version 1.2.4 (FATE#319273) Changelog 1.2.4: * Fix: make sure we can exit the get_new_metadata loop * Docs fix: Change bt_ctf_writer_create_stream return description * Fix: offset_s and CTF clocks with frequency != 1GHz Changelog 1.2.3: * Fix: incorrect compiler warning * Fix: Don't assume that PROT_WRITE grants read permissions * Fix: align objstack on 8 bytes * Fix Python: Add a comment warning about an API limitation * Use BABELTRACE_HOST_NAME_MAX in test_ctf_writer.c * Add limits compatibility header * Fix: don't perform unaligned integer read/writes * Fix: Align buffers from objstack_alloc on sizeof(void *) * Fix: bt_ctf_field_type_structure_add_field argument validation Changelog 1.2.2: * Fix: Support out of tree builds in babeltrace * Fix: mmap trace read the stream_id from the first packet * Fix: check the lttng-relayd protocol version * Fix: don't update the trace collection if no new streams were received * Fix (Python bindings): Return a string if a sequence's element are chars * Fix: don't use a return code in _bt_ctf_stream_append_discarded_events * Fix: Report the sequence's length field's value as length * Fix: Variable name typo in SequenceField and Event classes * Fix python: remove weird char at the end of line * Fix: add missing files to gitignore * Fix: ctf-text: add missing double-quotes around enum tag * Fix: Add missing lttng_live_should_quit checks * Fix: Report errors occuring in lttng_live_read - enable build for aarch64 (fate#318370) - Cleanup urls in spec file (FATE#319273) - add ppc64/ppc64le in ExclusiveArch - Update to version 1.5.3 for SLE15 (bsc#1055683) - Disable static library build. - Enable Python 3 bindings build. - Remove explicit glib2-devel requirement for the devel package: is autodetected already. - Spec cleanup. - Update to version 1.5.4: * Use signed accessors for clock offsets. * Fix a signedness error in python complements. * Handle packet_seek errors. * Prevent calling adding the same trace recursively. * Make sure we have all the metadata streams before adding new traces. * Add missing debugging information in the live plugin. * Set stream id in HUP case. * Use list rather than ptr array for trace streams. * Fix a leak of streams. * Handle 0 session case in ask new streams. * Break loop on getting metadata error. * Return error on ask_new_stream when should quit. * Don't access missing ctf trace when getting metadata. * Fix lttng-live discarded event count after inactivity. * Fix timegm compat on Solaris. * Fix Python bindings when building with PIE hardening. * lttng-live: Print discarded event and packet lost warnings on stderr. - Use %license instead of %doc [bsc#1082318] - Update to version 1.5.5: * Propagate error from packet_seek in case of truncated packet. * Fix: report truncated files while reading. - Use tarball signing. - Update to version 1.5.6: * Fix: remove left-over debug logging statement. * Use trace->trace_id in check to remove trace from bt_ctx. * Fix: missing initializer braces warning. * Fix: zero out URL parsing array before use and ensure proper error reporting. - add s390x in ExclusiveArch - Update to version 1.5.8 (changes since 1.5.6): * Cleanup: bitfields: streamline use of underscores. * Fix: bitfield: shift undefined/implementation defined behaviours. * Fix: array and sequence field's 'elems' members can be left NULL. * Fix: invalid alignment of enumeration fields. * Fix: lttng-live format: do not error out on empty streams hang up. * Fix: lttng-live: ctf_live_packet_seek stream hang up handling. * Fix: lib/iterator.c: unbalanced ctx put (leak). * Fix: lttng-live: lttng_live_open_trace_read memory leak. * Fix: trace-collection: trace clock use after free. * Fix: lttng-live: use-after-free in get_next_index(). * Do not use diagnostic pragma when GCC version is lower than 4.6.0. * Missing define when not building with gcc. - Drop support for old openSUSE versions. - Add riscv64 to ExclusiveArch - Update to version 1.0.0-rc2 - Update to version 1.0.0-rc4 - Upgrade to version 1.0.3 (FATE#314846) Changelog 1.0.3: * Fix: Double free when calling bt_context_remove_trace() * Add missing runall.sh to dist packaging * Fix: alignment of compound types containing array field Changelog 1.0.2: * Fix: add tests/lib missing files to Makefile.am Changelog 1.0.1: * Provides a basic pkg-config file for libbabeltrace * Fix erroneous warning/error messages * Fix comment in context.h * Cleanup: Remove whitespace at EOL from mit-license.txt * Add missing permission notice in each source file * Adding a test which do a sequence of seek BEGIN, LAST, BEGIN, LAST * Run seek tests on a second trace file * Add #define _GNU_SOURCE to remove warning about asprintf * Include a test for SEEK_BEGIN and SEEK_LAST * Fix: Report success even if we find at least one valid stream in find_max_timestamp_ctf_stream_class * Fix SEEK_BEGIN for streams that do not contain any event Changelog 1.0.0: * tests: add test traces to distribution tarball * Document bash requirement for make check in README * Add tests to make check * Fix: add missing header size validation * callbacks.c: handle extract_ctf_stream_event return value * Cleanup: fix cppcheck warning * Cleanup: fix cppcheck warnings * fix double-free on error path Changelog 1.0.0-rc6: * Add valgrind suppression file for libpopt * Fix: unplug memory leak that causes popt-0.13 to segfault * Fix: test all close/fclose ret val, fix double close * Cleanup: add missing newline * Fix: fd leak on trace close * Fix memory leaks induced by lack of libpopt documentation * babeltrace: fix poptGetOptArg memleak * plugins: implement plugin unregister * Doc: valgrind with babeltrace (glib workaround) * callsites: fix memory leak * Fix: free all the metadata-related memory * Fix : Free the iterator callback arrays * Fix : cleanup teardown of context * Fix : protect static float and double declarations * callsite: support instruction pointer field * Document that list.h is LGPLv2.1, but entirely trivial * Fix: callsite support: list multiple callsites * Add callsite support * Fix: Allow 64-bit packet offset * Fix: emf uri: surround by " " * Handle model.emf.uri event info * Fix: Documentation cleanup * Fix: misplaced C++ ifdef * Fix babeltrace-log get big line when the input file last line don't have enter * API Fix: bt_ctf_iter_read_event_flags * Fix: get encoding for char arrays and sequences * Fix: access to declaration from declaration_field * Fix: get_declaration_* should not cast to field * Fix babeltrace-log uninitialized memory (v2) * Revert "Fix babeltrace-log uninitialized memory" * Fix babeltrace-log uninitialized memory * Fix: access field properties by declaration * Fix: check return value of get_char_array * Fix: C++ support to API header files Changelog 1.0.0-rc5: * Change default printout to add host, process names and vpid * Add support for trace:hostname field * Fix: allow specifying more than one input trace path * Fix: make warnings (partial errors) visible * Fix: --clock-force-correlate to handle trace collections gathered from v * Documentation: update API doc with enum functions * Fix: API: remove unsupported BT_SEEK_END from API * API documentation * Cleanup: shut up gcc uninitialized var warning * Fix: support large files on 32-bit systems * Fix: remove unused fts.h include * Fix: add missing enum support to API * Fix: handle clock offset with frequency different from 1GHz * Cleanup: update ifdef wrapper name * Fix: clarify bt_ctf_get_field_list * Fix trace-collection.h: No such file or directory that build code with l * Fix: check return value of bt_context_create * Fix: ensure mmap_base_offset is zeroed on initialization * Fix: Reswitch to FTW for add_traces_recursive * Fix: don't free unallocated index * Fix: don't close the metadata FD if a FP is passed * Add BT_SEEK_LAST type to bt_iter_pos * Fix: iterator.c BT_SEEK_RESTORE: check return value * Fix: complete error handling of babeltrace API * cleanup: protected -> hidden: cleanup symbol table * Fix: add mmap_base_offset to ctf_stream_pos * Fix: assign the current clock for mmap traces * Fix: libbabeltrace add missing static declaration * Fix: safety checks for opening mmap traces * Remove trace-collection.h from include_headers * Fix: protect visibility of ctf-parser functions * Fix: correct name of bt_ctf_field_get_error in comments and typo in man * Fix: wrong type in bt_ctf_get_uint64/int64 * API cleanup name get_timestamp and get_cycles * fix comment struct bt_saved_pos * Fix: Add missing clock-types.h * Get rid of clock-raw and use real clock * Cleanup (messages): Make the wording of the signedness warning clearer * Fix: error path if heap_init fails * Fix: Remove obsolete bt_iter_seek function * Make the signedness warning useful with the field name * Fix: Restore heap for SEEK_BEGIN * Fix: check if handle is valid * Fix: iterator set_pos * Fix: get rid of consumed flag * Fix: add missing heap_copy * Fix: babeltrace assert() triggered by directories within trace * Several fixes for bt_iter_pos related functions * Fix iterator: various fixes * Fix: remove duplicate yydebug var * Fix babeltrace iterator lib: seek at time 0 - license update: MIT and GPL-2.0 The correct operator is ^and^, not ^or^. Also, use SPDX format where possible - Update to version 1.1.1 - Update to version 1.2 - Update to version 1.2.1 Changelog: * Fix: Accept an input port in the live URL when no session is provided - Update to version 1.2.4 (FATE#319273) Changelog 1.2.4: * Fix: make sure we can exit the get_new_metadata loop * Docs fix: Change bt_ctf_writer_create_stream return description * Fix: offset_s and CTF clocks with frequency != 1GHz Changelog 1.2.3: * Fix: incorrect compiler warning * Fix: Don't assume that PROT_WRITE grants read permissions * Fix: align objstack on 8 bytes * Fix Python: Add a comment warning about an API limitation * Use BABELTRACE_HOST_NAME_MAX in test_ctf_writer.c * Add limits compatibility header * Fix: don't perform unaligned integer read/writes * Fix: Align buffers from objstack_alloc on sizeof(void *) * Fix: bt_ctf_field_type_structure_add_field argument validation Changelog 1.2.2: * Fix: Support out of tree builds in babeltrace * Fix: mmap trace read the stream_id from the first packet * Fix: check the lttng-relayd protocol version * Fix: don't update the trace collection if no new streams were received * Fix (Python bindings): Return a string if a sequence's element are chars * Fix: don't use a return code in _bt_ctf_stream_append_discarded_events * Fix: Report the sequence's length field's value as length * Fix: Variable name typo in SequenceField and Event classes * Fix python: remove weird char at the end of line * Fix: add missing files to gitignore * Fix: ctf-text: add missing double-quotes around enum tag * Fix: Add missing lttng_live_should_quit checks * Fix: Report errors occuring in lttng_live_read - enable build for aarch64 (fate#318370) - Cleanup urls in spec file (FATE#319273) - add ppc64/ppc64le in ExclusiveArch - Update to version 1.5.3 for SLE15 (bsc#1055683) - Disable static library build. - Enable Python 3 bindings build. - Remove explicit glib2-devel requirement for the devel package: is autodetected already. - Spec cleanup. - Update to version 1.5.4: * Use signed accessors for clock offsets. * Fix a signedness error in python complements. * Handle packet_seek errors. * Prevent calling adding the same trace recursively. * Make sure we have all the metadata streams before adding new traces. * Add missing debugging information in the live plugin. * Set stream id in HUP case. * Use list rather than ptr array for trace streams. * Fix a leak of streams. * Handle 0 session case in ask new streams. * Break loop on getting metadata error. * Return error on ask_new_stream when should quit. * Don't access missing ctf trace when getting metadata. * Fix lttng-live discarded event count after inactivity. * Fix timegm compat on Solaris. * Fix Python bindings when building with PIE hardening. * lttng-live: Print discarded event and packet lost warnings on stderr. - Use %license instead of %doc [bsc#1082318] - Update to version 1.5.5: * Propagate error from packet_seek in case of truncated packet. * Fix: report truncated files while reading. - Use tarball signing. - Update to version 1.5.6: * Fix: remove left-over debug logging statement. * Use trace->trace_id in check to remove trace from bt_ctx. * Fix: missing initializer braces warning. * Fix: zero out URL parsing array before use and ensure proper error reporting. - add s390x in ExclusiveArch - Update to version 1.5.8 (changes since 1.5.6): * Cleanup: bitfields: streamline use of underscores. * Fix: bitfield: shift undefined/implementation defined behaviours. * Fix: array and sequence field's 'elems' members can be left NULL. * Fix: invalid alignment of enumeration fields. * Fix: lttng-live format: do not error out on empty streams hang up. * Fix: lttng-live: ctf_live_packet_seek stream hang up handling. * Fix: lib/iterator.c: unbalanced ctx put (leak). * Fix: lttng-live: lttng_live_open_trace_read memory leak. * Fix: trace-collection: trace clock use after free. * Fix: lttng-live: use-after-free in get_next_index(). * Do not use diagnostic pragma when GCC version is lower than 4.6.0. * Missing define when not building with gcc. - Drop support for old openSUSE versions. - Add riscv64 to ExclusiveArch - Update to version 1.2.4 (FATE#319273) Changelog 1.2.4: * Fix: make sure we can exit the get_new_metadata loop * Docs fix: Change bt_ctf_writer_create_stream return description * Fix: offset_s and CTF clocks with frequency != 1GHz Changelog 1.2.3: * Fix: incorrect compiler warning * Fix: Don't assume that PROT_WRITE grants read permissions * Fix: align objstack on 8 bytes * Fix Python: Add a comment warning about an API limitation * Use BABELTRACE_HOST_NAME_MAX in test_ctf_writer.c * Add limits compatibility header * Fix: don't perform unaligned integer read/writes * Fix: Align buffers from objstack_alloc on sizeof(void *) * Fix: bt_ctf_field_type_structure_add_field argument validation Changelog 1.2.2: * Fix: Support out of tree builds in babeltrace * Fix: mmap trace read the stream_id from the first packet * Fix: check the lttng-relayd protocol version * Fix: don't update the trace collection if no new streams were received * Fix (Python bindings): Return a string if a sequence's element are chars * Fix: don't use a return code in _bt_ctf_stream_append_discarded_events * Fix: Report the sequence's length field's value as length * Fix: Variable name typo in SequenceField and Event classes * Fix python: remove weird char at the end of line * Fix: add missing files to gitignore * Fix: ctf-text: add missing double-quotes around enum tag * Fix: Add missing lttng_live_should_quit checks * Fix: Report errors occuring in lttng_live_read - enable build for aarch64 (fate#318370) - Cleanup urls in spec file (FATE#319273) - add ppc64/ppc64le in ExclusiveArch - Update to version 1.5.3 for SLE15 (bsc#1055683) - Disable static library build. - Enable Python 3 bindings build. - Remove explicit glib2-devel requirement for the devel package: is autodetected already. - Spec cleanup. - Update to version 1.5.4: * Use signed accessors for clock offsets. * Fix a signedness error in python complements. * Handle packet_seek errors. * Prevent calling adding the same trace recursively. * Make sure we have all the metadata streams before adding new traces. * Add missing debugging information in the live plugin. * Set stream id in HUP case. * Use list rather than ptr array for trace streams. * Fix a leak of streams. * Handle 0 session case in ask new streams. * Break loop on getting metadata error. * Return error on ask_new_stream when should quit. * Don't access missing ctf trace when getting metadata. * Fix lttng-live discarded event count after inactivity. * Fix timegm compat on Solaris. * Fix Python bindings when building with PIE hardening. * lttng-live: Print discarded event and packet lost warnings on stderr. - Use %license instead of %doc [bsc#1082318] - Update to version 1.5.5: * Propagate error from packet_seek in case of truncated packet. * Fix: report truncated files while reading. - Use tarball signing. - Update to version 1.5.6: * Fix: remove left-over debug logging statement. * Use trace->trace_id in check to remove trace from bt_ctx. * Fix: missing initializer braces warning. * Fix: zero out URL parsing array before use and ensure proper error reporting. - add s390x in ExclusiveArch - Update to version 1.5.8 (changes since 1.5.6): * Cleanup: bitfields: streamline use of underscores. * Fix: bitfield: shift undefined/implementation defined behaviours. * Fix: array and sequence field's 'elems' members can be left NULL. * Fix: invalid alignment of enumeration fields. * Fix: lttng-live format: do not error out on empty streams hang up. * Fix: lttng-live: ctf_live_packet_seek stream hang up handling. * Fix: lib/iterator.c: unbalanced ctx put (leak). * Fix: lttng-live: lttng_live_open_trace_read memory leak. * Fix: trace-collection: trace clock use after free. * Fix: lttng-live: use-after-free in get_next_index(). * Do not use diagnostic pragma when GCC version is lower than 4.6.0. * Missing define when not building with gcc. - Drop support for old openSUSE versions. - Add riscv64 to ExclusiveArch - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Fix missing %posttrans section - Add mainline commit: 51b8cdb0b60df3baa With this patch, the info can be showed correctly if there are two or more PCI root ports in the same Bus ID/Device ID (bnc#890562) Add: fix_several_PCI_root_ports_in_one_bus.patch - Update to version 0.6.1 - Do not disable rule via perl script in .spec file, better use a patch (biosdevname_udevrule_rename_all_network_devices.patch) - Modify configure.ac via sed to make use of %{_udevruledir} from .spec file - Remove already integrated patches in latest source code: Delete biosdevname_v0.5.0_to_git_c140ce659a204d67e4cc.patch Delete biosdevname_udevrule_rename_all_network_devices.patch Delete fix_several_PCI_root_ports_in_one_bus.patch Modify udev-rule-path.patch Modify whitelist-dell - biosdevname-pic.patch: make cpuid() not expose %ebx out of assembler, so we can build it with -fPIE. - Use url for source - Cleanup spec file with spec-cleaner - Fix fault in ignore-broken-BIOSes patch (boo#920054). - Update to 0.6.2 * no upstream changelog provided - Add missed build require on pkgconfig udev - Fix missing dependency on coreutils for initrd macros (boo#958562) - Call missing initrd macro at postun (boo#958562) - Update to 0.7.1 * no upstream changelog provided - Update to latest 0.7.2 version (fate#319998) - Detect dom0 via xenfs instead of cpuid to compensate for ABI change in xen-4.7 on AMD systems. (bnc#974257) biosdevname-dom0.patch - Update to HEAD 66eab208d3c2abe947ba0a793094ee856e8fb3ee * Fix use-after-free of fd - Update to latest HEAD to 02811d5165c2eeecf8797fe9b5088d6e78bd25db * Changed source to github * Ignore naming of non-Ethernet network interfaces * Prevent reading of VPD-DCM strings for SRIOV-vfs - removed patch v0.7.2_to_HEAD_66eab208.patch - Update to version 0.7.3 * Shipping and future Dell EMC systems support consistent network device naming feature. [fate#332490] - Use %license instead of %doc [bsc#1082318] - Prevent infinite recursion in dmidecode.c::smbios_setslot by checking that subordinate bus has a number greater than the current bus. [bsc#1093625, dmidecode-prevent-infinite-recursion.patch] - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through the -mini flavors. - Read DMI info rom sysfs (bsc#1174491). * biosdevname-Add-buffer-read-helper-using-read-explicitly.patch * biosdevname-Read-DMI-entries-from-sys-firmware-dmi-tables-DMI.patch - Update to version 0.7.3.7.g495ab76 (bsc#1217455): * Add SMBIOS 3.x support * Read DMI entries from /sys/firmware/dmi/tables/DMI * Add buffer read helper using read explicitly * man: fix all_ethN indentation * Netronome biosdevname support (#8) * Prevent infinite recursion in dmidecode.c::smbios_setslot by (#7) * Add support for ExaNIC network cards (#5) - Removed patches now upstream: - dmidecode-prevent-infinite-recursion.patch - biosdevname-Add-buffer-read-helper-using-read-explicitly.patch - biosdevname-Read-DMI-entries-from-sys-firmware-dmi-tables-DMI.patch - Update to version 0.6.1 - Do not disable rule via perl script in .spec file, better use a patch (biosdevname_udevrule_rename_all_network_devices.patch) - Modify configure.ac via sed to make use of %{_udevruledir} from .spec file - Remove already integrated patches in latest source code: Delete biosdevname_v0.5.0_to_git_c140ce659a204d67e4cc.patch Delete biosdevname_udevrule_rename_all_network_devices.patch Delete fix_several_PCI_root_ports_in_one_bus.patch Modify udev-rule-path.patch Modify whitelist-dell - biosdevname-pic.patch: make cpuid() not expose %ebx out of assembler, so we can build it with -fPIE. - Use url for source - Cleanup spec file with spec-cleaner - Fix fault in ignore-broken-BIOSes patch (boo#920054). - Update to 0.6.2 * no upstream changelog provided - Add missed build require on pkgconfig udev - Fix missing dependency on coreutils for initrd macros (boo#958562) - Call missing initrd macro at postun (boo#958562) - Update to 0.7.1 * no upstream changelog provided - Update to latest 0.7.2 version (fate#319998) - Detect dom0 via xenfs instead of cpuid to compensate for ABI change in xen-4.7 on AMD systems. (bnc#974257) biosdevname-dom0.patch - Update to HEAD 66eab208d3c2abe947ba0a793094ee856e8fb3ee * Fix use-after-free of fd - Update to latest HEAD to 02811d5165c2eeecf8797fe9b5088d6e78bd25db * Changed source to github * Ignore naming of non-Ethernet network interfaces * Prevent reading of VPD-DCM strings for SRIOV-vfs - removed patch v0.7.2_to_HEAD_66eab208.patch - Update to version 0.7.3 * Shipping and future Dell EMC systems support consistent network device naming feature. [fate#332490] - Use %license instead of %doc [bsc#1082318] - Prevent infinite recursion in dmidecode.c::smbios_setslot by checking that subordinate bus has a number greater than the current bus. [bsc#1093625, dmidecode-prevent-infinite-recursion.patch] - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through the -mini flavors. - Read DMI info rom sysfs (bsc#1174491). * biosdevname-Add-buffer-read-helper-using-read-explicitly.patch * biosdevname-Read-DMI-entries-from-sys-firmware-dmi-tables-DMI.patch - Update to version 0.7.3.7.g495ab76 (bsc#1217455): * Add SMBIOS 3.x support * Read DMI entries from /sys/firmware/dmi/tables/DMI * Add buffer read helper using read explicitly * man: fix all_ethN indentation * Netronome biosdevname support (#8) * Prevent infinite recursion in dmidecode.c::smbios_setslot by (#7) * Add support for ExaNIC network cards (#5) - Removed patches now upstream: - dmidecode-prevent-infinite-recursion.patch - biosdevname-Add-buffer-read-helper-using-read-explicitly.patch - biosdevname-Read-DMI-entries-from-sys-firmware-dmi-tables-DMI.patch - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - Porting Yifan Jiang <yfjiang@suse.com>'s solution of bsc#1220329 to SLE15-SP5 (bsc#1209153) - Add necessary Supplements (gnome-bluetooth, blueman, bluedevil5) to bluez-obexd, so that file transfer features of the applications can be used by default (bsc#1209153, bsc#1220329). - Update the description of bluez-obexd. - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Add upstream patches with the ares_getaddrinfo function: * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch * 0007-getaddrinfo-enhancements-257.patch * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch - Add a patch which disables test failing on OBS (but passing in local environment): * 0010-Disable-failing-test.patch - Update to upstream snapshot 20191108 * getaddrinfo - avoid infinite loop in case of NXDOMAIN * ares_getenv - return NULL in all cases * implement ares_getaddrinfo - onion-crash.patch: removed, upstreamed. - removed upstream patches that are part of the snapshot: 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch 0007-getaddrinfo-enhancements-257.patch 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch 0010-Disable-failing-test.patch - disable-live-tests.patch - updated - Fix version number of the snapshot to not be downgrade: bsc#1156601 - Switch to cmake-based build. Some packages need the cmake build files. - Add netcfg as the build requirement and runtime requirement. ares_getaddrinfo function uses the getservbyport_r function which requires the /etc/services file to function properly. That config file is provided by the netcfg package. Unit tests rely on it too, hence it has to be a build dependency as well. - Upgrade to latest snapshot from 2020-01-17 - disable-live-tests.patch: refreshed - regression.patch: fix a regression in DNS results that contain both A and AAAA answers. - Version update to 1.16.1 Security: * Prevent possible use-after-free and double-free in ares_getaddrinfo() if ares_destroy() is called prior to ares_getaddrinfo() completing. Reported by Jann Horn at Google Project Zero. Changes: * Allow TXT records on CHAOS qclass. Used for retriving things like version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3] Bug fixes: * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1] * Silence false cast-align compiler warnings due to valid casts of struct sockaddr to struct sockaddr_in and struct sockaddr_in6. * MacOS should use libresolv for retrieving DNS servers, like iOS * CMake build system should populate the INCLUDE_DIRECTORIES property of installed targets [2] * Correct macros in use for the ares_getaddrinfo.3 man page - Changes in version 1.16.0 Changes: * Introduction of ares_getaddrinfo() API which provides similar output (including proper sorting as per RFC 6724) to the system native API, but utilizes different data structures in order to provide additional information such as TTLs and all aliases. Please reference the respective man pages for usage details. * Parse SOA records from ns_t_any response * CMake: Provide c-ares version in package export file * CMake: Add CPACK functionality for DEB and RPM * CMake: Generate PDB files during build * CMake: Support manpage installation Bug fixes: * Fix bad expectation in IPv6 localhost test. * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to prevent complaints about CPPFLAGS in CFLAGS. * Fix .onion handling * Command line usage was out of date for adig and ahost. * Typos in manpages * If ares_getenv is defined, it must return a value on all platforms * If /etc/resolv.conf has invalid lookup values, use the defaults. * Tests: Separate live tests from SetServers* tests as only live tests should require internet access. * ares_gethostbyname() should return ENODATA if no valid A or AAAA record is found, but a CNAME was found. * CMake: Rework library function checking to prevent unintended linking with system libraries that aren't needed. * Due to use of inet_addr() it was not possible to return 255.255.255.255 from ares_gethostbyname(). * CMake: Fix building of tests on Windows - Drop regression.patch which have been fixed upstream - Refresh disable-live-tests.patch - Remove static lib since its required when doing tests and we dont want it included in package - Run spec-cleaner - Implement multibuild specfile to split out tests into its own flavor; this way we can build and run tests, which require static lib, as well as avoid packaging the latter without issues with the installed cmake file.. - simplify conditions bit to make it tad more readable - Version update to 1.17.0 Security: * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing * Avoid theoretical buffer overflow in RC4 loop comparison * Empty hquery->name could lead to invalid memory access * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in (bsc#1178882, CVE-2020-8277) Changes: * Update help information for adig, acountry, and ahost * Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers * Detect remote DNS server does not support EDNS using rules from RFC 6891 * Source tree has been reorganized to use a more modern layout * Allow parsing of CAA Resource Record Bug fixes: * readaddrinfo bad sizeof() * Test cases should honor HAVE_WRITEV flag, not depend on WIN32 * FQDN with trailing period should be queried first * ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints. * ares_gethostbyname() with AF_UNSPEC and an ip address would fail * Properly document ares_set_local_ip4() uses host byte order For details, see https://c-ares.haxx.se/changelog.html - add missing upstream sources, to be removed for next release - remove unnecessary BuildRequires - fix building on SLE12 systems - ares_dns.h, missing_header.patch: re-add missing header in last release - add BR for pkg-config to get the provides in the devel package - update to 1.17.1: Travis: add iOS target built with CMake (#378) Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake. - fix build External projects were using non-public header ares_dns.h, make public again (#376) It appears some outside projects were relying on macros in ares_dns.h, even though it doesn't appear that header was ever meant to be public. That said, we don't want to break external integrators so we should distribute this header again. - note that so versioning has moved to configure.ac - note about 1.17.1 - fix sed gone wrong autotools cleanup (#372) * buildconf: remove custom logic with autoreconf - remove missing_header.patch (upstream) - update to 1.17.2: Security: * When building c-ares with CMake, the RANDOM_FILE would not be set and therefore downgrade to the less secure random number generator * If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause a crash * Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response * Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing follow-up (bsc#1188881, CVE-2021-3672) * Perform validation on hostnames to prevent possible XSS due to applications not performing valiation themselves Changes: * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases Bug fixes: * Building tests should not force building of static libraries except on Windows * Relative headers must use double quotes to prevent pulling in a system library for details see, https://c-ares.haxx.se/changelog.html#1_17_2 - 5c995d5.patch: augment input validation on hostnames to allow _ as part of DNS response (bsc#1190225) - new upstream website - drop multibuild - tests do not require static library anymore - spec file cleanup - drop sources that were re-added to upstream distibution (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake) - update to 1.18.1. Changes since 1.17.2: * Allow '/' as a valid character for a returned name for CNAME in-addr.arpa delegation * no longer forwards requests for localhost resolution per RFC6761 * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the search process will continue to the next domain in the search. * Provide ares_nameser.h as a public interface as needed by NodeJS * Add support for URI(Uniform Resource Identifier) records via ares_parse_uri_reply() - disable unit tests for SLE12 since GCC compiler too old to build unit tests - 5c995d5.patch: upstreamed - disable-live-tests.patch: refreshed - Update to version 1.19.0 Security: * Low. Stack overflow in ares_set_sortlist() which is used during c-ares initialization and typically provided by an administrator and not an end user. (bsc#1208067, CVE-2022-4904) Changes: * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for specifying a custom hosts file location. Bug fixes: * Fix memory leak in reading /etc/hosts when using localhost fallback. * Fix chain building c-ares when libresolv is already included by another project. * File lookup should not immediately abort as there may be other tries due to search criteria. * Asterisks should be allowed in host validation as CNAMEs may reference wildcard domains. * AutoTools build system referenced bad STDC_HEADERS macro. * Even if one address class returns a failure for ares_getaddrinfo() we should still return the results we have. * Fix ares_getaddrinfo() numerical address resolution with AF_UNSPEC * Fix tools and help information. * Various documentation fixes and cleanups. * Add include guards to ares_data.h * c-ares could try to exceed maximum number of iovec entries supported by system. * The RFC6761 6.3 states localhost subdomains must be offline too - Update to version 1.19.1 Security: * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service (bsc#1211604) * CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS query IDs (bsc#1211605) * CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() (bsc#1211606) * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation (bsc#1211607) Bug fixes: * Fix uninitialized memory warning in test * ares_getaddrinfo() should allow a port of 0 * Fix memory leak in ares_send() on error * Fix comment style in ares_data.h * Fix typo in ares_init_options.3 * Sync ax_pthread.m4 with upstream * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support - CVE-2024-25629.patch: fix out of bounds read in ares__read_line() (bsc#1220279, CVE-2024-25629) - fix bashism in postun script - Update to version 2+git20150324.e3ee392: + p11-kit 0.23.1 supports pem-directory-hash now - use service file to generate tarball - require p11-kit-tools >= 0.23.1 - Update to version 2+git20151110.c15593c: + set proper umask (boo#948724) - Run update-ca-certificate by systemd unit when the content of one of the paths changes. Needed for read-only root and/or transactional updates. - Update to version 2+git20170807.10b2785: * Check TRANSACTIONAL_UPDATE is set (boo#1045942) * Add systemd units - Don't require systemd, since we could be used in environments like container images, where we don't have systemd. If systemd is installed the systemd units will be used, else they are not needed. - Re-add systemd requires, else package will be installed to early and services never enabled [bsc#1071776]. - Revert last change since we fixed systemd-preset-branding and this requires is no longer needed. - Use %license instead of %doc [bsc#1082318] - Changed "openssl" requirement to "openssl(cli)" * (bsc#1101470) - backport bash rewrite from Factory to make sure to trigger in transactional mode (boo#1179884) - openssl is no longer required but coreutils and findutils are (boo#1183680). Keep openssl(cli) at runtime for now nevertheless as this package might be the only one pulling it in. - Update to version 2+git20240416.98ae794 (bsc#1221184): * Use flock to serialize calls (boo#1188500) * Make certbundle.run container friendly * Create /var/lib/ca-certificates if needed - don't keep certificates with marker (bnc#875647) - fix directory permissions for real this time (bnc#871639) - clarify the start order of the generators, as certbundle.run semi-depends on etc_ssl.run via a timestamp. (bnc#883386) - removed the version in the Obsoletes. The package in SLE11 got version updated (bnc#887099). - add p11 kit header to set label of migrated certificates to the file name of the previous one (bnc#890205) - use rpm -qf to determine if a ssl cert is owned by some other package and therefore doesn't need to be migrated (related to bnc#890205). - fix bashism in postun script - Update to version 2+git20150324.e3ee392: + p11-kit 0.23.1 supports pem-directory-hash now - use service file to generate tarball - require p11-kit-tools >= 0.23.1 - Update to version 2+git20151110.c15593c: + set proper umask (boo#948724) - Run update-ca-certificate by systemd unit when the content of one of the paths changes. Needed for read-only root and/or transactional updates. - Update to version 2+git20170807.10b2785: * Check TRANSACTIONAL_UPDATE is set (boo#1045942) * Add systemd units - Don't require systemd, since we could be used in environments like container images, where we don't have systemd. If systemd is installed the systemd units will be used, else they are not needed. - Re-add systemd requires, else package will be installed to early and services never enabled [bsc#1071776]. - Revert last change since we fixed systemd-preset-branding and this requires is no longer needed. - Use %license instead of %doc [bsc#1082318] - Changed "openssl" requirement to "openssl(cli)" * (bsc#1101470) - backport bash rewrite from Factory to make sure to trigger in transactional mode (boo#1179884) - openssl is no longer required but coreutils and findutils are (boo#1183680). Keep openssl(cli) at runtime for now nevertheless as this package might be the only one pulling it in. - Update to version 2+git20240416.98ae794 (bsc#1221184): * Use flock to serialize calls (boo#1188500) * Make certbundle.run container friendly * Create /var/lib/ca-certificates if needed - Use %license instead of %doc [bsc#1082318] - Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415) - Removed CAs: * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H5:2.7.0.142.23.254.36.32.129.crt - updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780) - removed server auth - Certplus Root CA G1 - Certplus Root CA G2 - OpenTrust Root CA G1 - OpenTrust Root CA G2 - OpenTrust Root CA G3 - remove CA - ComSign CA - added new CA - GlobalSign - updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446) - Removed CAs: - AC Raiz Certicamara S.A. - Certplus Root CA G1 - Certplus Root CA G2 - OpenTrust Root CA G1 - OpenTrust Root CA G2 - OpenTrust Root CA G3 - Visa eCommerce Root - Added Root CAs: - Certigna Root CA (email and server auth) - GTS Root R1 (server auth) - GTS Root R2 (server auth) - GTS Root R3 (server auth) - GTS Root R4 (server auth) - OISTE WISeKey Global Root GC CA (email and server auth) - UCA Extended Validation Root (server auth) - UCA Global G2 Root (email and server auth) - update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169) - Removed CAs: - Certinomis - Root CA - includes added root CAs from the 2.32 version: - emSign ECC Root CA - C3 (email and server auth) - emSign ECC Root CA - G3 (email and server auth) - emSign Root CA - C1 (email and server auth) - emSign Root CA - G1 (email and server auth) - Hongkong Post Root CA 3 (server auth) - export correct p11kit trust attributes so Firefox detects built in certificates (boo#1154871). Courtesy of Fedora. - make sure p11-kit with patches is installed on SLE (boo#1154871) - update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160) - removed: - Certplus Class 2 Primary CA - Deutsche Telekom Root CA 2 - CN=Swisscom Root CA 2 - UTN-USERFirst-Client Authentication and Email - added: - Entrust Root Certification Authority - G4 - also run update-ca-certificates in %posttrans - update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673) Removed CAs: - AddTrust External CA Root - AddTrust Class 1 CA Root - LuxTrust Global Root 2 - Staat der Nederlanden Root CA - G2 - Symantec Class 1 Public Primary Certification Authority - G4 - Symantec Class 2 Public Primary Certification Authority - G4 - VeriSign Class 3 Public Primary Certification Authority - G3 Added CAs: - certSIGN Root CA G2 - e-Szigno Root CA 2017 - Microsoft ECC Root Certificate Authority 2017 - Microsoft RSA Root Certificate Authority 2017 - Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864) - Removed CAs: - EE Certification Centre Root CA - Taiwan GRCA - Added CAs: - Trustwave Global Certification Authority - Trustwave Global ECC P256 Certification Authority - Trustwave Global ECC P384 Certification Authority - Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994) - Added new root CAs: - NAVER Global Root Certification Authority - Removed old root CA: - GeoTrust Global CA - GeoTrust Primary Certification Authority - GeoTrust Primary Certification Authority - G3 - GeoTrust Universal CA - GeoTrust Universal CA 2 - thawte Primary Root CA - thawte Primary Root CA - G2 - thawte Primary Root CA - G3 - VeriSign Class 3 Public Primary Certification Authority - G4 - VeriSign Class 3 Public Primary Certification Authority - G5 - remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021. (bsc#1190858) - updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006) - Added CAs: + HARICA Client ECC Root CA 2021 + HARICA Client RSA Root CA 2021 + HARICA TLS ECC Root CA 2021 + HARICA TLS RSA Root CA 2021 + TunTrust Root CA - Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079) Added: - Autoridad de Certificacion Firmaprofesional CIF A62634068 - D-TRUST BR Root CA 1 2020 - D-TRUST EV Root CA 1 2020 - GlobalSign ECC Root CA R4 - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - HiPKI Root CA - G1 - ISRG Root X2 - Telia Root CA v2 - vTrus ECC Root CA - vTrus Root CA Removed: - Cybertrust Global Root - DST Root CA X3 - DigiNotar PKIoverheid CA Organisatie - G2 - GlobalSign ECC Root CA R4 - GlobalSign Root CA R2 - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868) Added: - Certainly Root E1 - Certainly Root R1 - DigiCert SMIME ECC P384 Root G5 - DigiCert SMIME RSA4096 Root G5 - DigiCert TLS ECC P384 Root G5 - DigiCert TLS RSA4096 Root G5 - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 Removed: - Hellenic Academic and Research Institutions RootCA 2011 - Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622) Removed CAs: - Global Chambersign Root - EC-ACC - Network Solutions Certificate Authority - Staat der Nederlanden EV Root CA - SwissSign Platinum CA - G2 Added CAs: - DIGITALSIGN GLOBAL ROOT ECDSA CA - DIGITALSIGN GLOBAL ROOT RSA CA - Security Communication ECC RootCA1 - Security Communication RootCA3 Changed trust: - TrustCor certificates only trusted up to Nov 30 (bsc#1206212) - Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022" and it is not clear how many certs were issued for SSL middleware by TrustCor: - TrustCor RootCert CA-1 - TrustCor RootCert CA-2 - TrustCor ECA-1 Patch: remove-trustcor.patch - Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248) Added: - Atos TrustedRoot Root CA ECC G2 2020 - Atos TrustedRoot Root CA ECC TLS 2021 - Atos TrustedRoot Root CA RSA G2 2020 - Atos TrustedRoot Root CA RSA TLS 2021 - BJCA Global Root CA1 - BJCA Global Root CA2 - LAWtrust Root CA2 (4096) - Sectigo Public Email Protection Root E46 - Sectigo Public Email Protection Root R46 - Sectigo Public Server Authentication Root E46 - Sectigo Public Server Authentication Root R46 - SSL.com Client ECC Root CA 2022 - SSL.com Client RSA Root CA 2022 - SSL.com TLS ECC Root CA 2022 - SSL.com TLS RSA Root CA 2022 Removed CAs: - Chambers of Commerce Root - E-Tugra Certification Authority - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 - Hongkong Post Root CA 1 - Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356) Added: - CommScope Public Trust ECC Root-01 - CommScope Public Trust ECC Root-02 - CommScope Public Trust RSA Root-01 - CommScope Public Trust RSA Root-02 - D-Trust SBR Root CA 1 2022 - D-Trust SBR Root CA 2 2022 - Telekom Security SMIME ECC Root 2021 - Telekom Security SMIME RSA Root 2023 - Telekom Security TLS ECC Root 2020 - Telekom Security TLS RSA Root 2023 - TrustAsia Global Root CA G3 - TrustAsia Global Root CA G4 Removed: - Autoridad de Certificacion Firmaprofesional CIF A62634068 - Chambers of Commerce Root - 2008 - Global Chambersign Root - 2008 - Security Communication Root CA - Symantec Class 1 Public Primary Certification Authority - G6 - Symantec Class 2 Public Primary Certification Authority - G6 - TrustCor ECA-1 - TrustCor RootCert CA-1 - TrustCor RootCert CA-2 - VeriSign Class 1 Public Primary Certification Authority - G3 - VeriSign Class 2 Public Primary Certification Authority - G3 - remove-trustcor.patch: removed, now upstream - do a versioned obsoletes of "openssl-certs". - Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525) - Added: FIRMAPROFESIONAL CA ROOT-A WEB - Distrust: GLOBALTRUST 2020 - Use %license instead of %doc [bsc#1082318] - Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415) - Removed CAs: * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H5:2.7.0.142.23.254.36.32.129.crt - updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780) - removed server auth - Certplus Root CA G1 - Certplus Root CA G2 - OpenTrust Root CA G1 - OpenTrust Root CA G2 - OpenTrust Root CA G3 - remove CA - ComSign CA - added new CA - GlobalSign - updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446) - Removed CAs: - AC Raiz Certicamara S.A. - Certplus Root CA G1 - Certplus Root CA G2 - OpenTrust Root CA G1 - OpenTrust Root CA G2 - OpenTrust Root CA G3 - Visa eCommerce Root - Added Root CAs: - Certigna Root CA (email and server auth) - GTS Root R1 (server auth) - GTS Root R2 (server auth) - GTS Root R3 (server auth) - GTS Root R4 (server auth) - OISTE WISeKey Global Root GC CA (email and server auth) - UCA Extended Validation Root (server auth) - UCA Global G2 Root (email and server auth) - update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169) - Removed CAs: - Certinomis - Root CA - includes added root CAs from the 2.32 version: - emSign ECC Root CA - C3 (email and server auth) - emSign ECC Root CA - G3 (email and server auth) - emSign Root CA - C1 (email and server auth) - emSign Root CA - G1 (email and server auth) - Hongkong Post Root CA 3 (server auth) - export correct p11kit trust attributes so Firefox detects built in certificates (boo#1154871). Courtesy of Fedora. - make sure p11-kit with patches is installed on SLE (boo#1154871) - update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160) - removed: - Certplus Class 2 Primary CA - Deutsche Telekom Root CA 2 - CN=Swisscom Root CA 2 - UTN-USERFirst-Client Authentication and Email - added: - Entrust Root Certification Authority - G4 - also run update-ca-certificates in %posttrans - update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673) Removed CAs: - AddTrust External CA Root - AddTrust Class 1 CA Root - LuxTrust Global Root 2 - Staat der Nederlanden Root CA - G2 - Symantec Class 1 Public Primary Certification Authority - G4 - Symantec Class 2 Public Primary Certification Authority - G4 - VeriSign Class 3 Public Primary Certification Authority - G3 Added CAs: - certSIGN Root CA G2 - e-Szigno Root CA 2017 - Microsoft ECC Root Certificate Authority 2017 - Microsoft RSA Root Certificate Authority 2017 - Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864) - Removed CAs: - EE Certification Centre Root CA - Taiwan GRCA - Added CAs: - Trustwave Global Certification Authority - Trustwave Global ECC P256 Certification Authority - Trustwave Global ECC P384 Certification Authority - Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994) - Added new root CAs: - NAVER Global Root Certification Authority - Removed old root CA: - GeoTrust Global CA - GeoTrust Primary Certification Authority - GeoTrust Primary Certification Authority - G3 - GeoTrust Universal CA - GeoTrust Universal CA 2 - thawte Primary Root CA - thawte Primary Root CA - G2 - thawte Primary Root CA - G3 - VeriSign Class 3 Public Primary Certification Authority - G4 - VeriSign Class 3 Public Primary Certification Authority - G5 - remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021. (bsc#1190858) - updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006) - Added CAs: + HARICA Client ECC Root CA 2021 + HARICA Client RSA Root CA 2021 + HARICA TLS ECC Root CA 2021 + HARICA TLS RSA Root CA 2021 + TunTrust Root CA - Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079) Added: - Autoridad de Certificacion Firmaprofesional CIF A62634068 - D-TRUST BR Root CA 1 2020 - D-TRUST EV Root CA 1 2020 - GlobalSign ECC Root CA R4 - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - HiPKI Root CA - G1 - ISRG Root X2 - Telia Root CA v2 - vTrus ECC Root CA - vTrus Root CA Removed: - Cybertrust Global Root - DST Root CA X3 - DigiNotar PKIoverheid CA Organisatie - G2 - GlobalSign ECC Root CA R4 - GlobalSign Root CA R2 - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868) Added: - Certainly Root E1 - Certainly Root R1 - DigiCert SMIME ECC P384 Root G5 - DigiCert SMIME RSA4096 Root G5 - DigiCert TLS ECC P384 Root G5 - DigiCert TLS RSA4096 Root G5 - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 Removed: - Hellenic Academic and Research Institutions RootCA 2011 - Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622) Removed CAs: - Global Chambersign Root - EC-ACC - Network Solutions Certificate Authority - Staat der Nederlanden EV Root CA - SwissSign Platinum CA - G2 Added CAs: - DIGITALSIGN GLOBAL ROOT ECDSA CA - DIGITALSIGN GLOBAL ROOT RSA CA - Security Communication ECC RootCA1 - Security Communication RootCA3 Changed trust: - TrustCor certificates only trusted up to Nov 30 (bsc#1206212) - Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022" and it is not clear how many certs were issued for SSL middleware by TrustCor: - TrustCor RootCert CA-1 - TrustCor RootCert CA-2 - TrustCor ECA-1 Patch: remove-trustcor.patch - Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248) Added: - Atos TrustedRoot Root CA ECC G2 2020 - Atos TrustedRoot Root CA ECC TLS 2021 - Atos TrustedRoot Root CA RSA G2 2020 - Atos TrustedRoot Root CA RSA TLS 2021 - BJCA Global Root CA1 - BJCA Global Root CA2 - LAWtrust Root CA2 (4096) - Sectigo Public Email Protection Root E46 - Sectigo Public Email Protection Root R46 - Sectigo Public Server Authentication Root E46 - Sectigo Public Server Authentication Root R46 - SSL.com Client ECC Root CA 2022 - SSL.com Client RSA Root CA 2022 - SSL.com TLS ECC Root CA 2022 - SSL.com TLS RSA Root CA 2022 Removed CAs: - Chambers of Commerce Root - E-Tugra Certification Authority - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 - Hongkong Post Root CA 1 - Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356) Added: - CommScope Public Trust ECC Root-01 - CommScope Public Trust ECC Root-02 - CommScope Public Trust RSA Root-01 - CommScope Public Trust RSA Root-02 - D-Trust SBR Root CA 1 2022 - D-Trust SBR Root CA 2 2022 - Telekom Security SMIME ECC Root 2021 - Telekom Security SMIME RSA Root 2023 - Telekom Security TLS ECC Root 2020 - Telekom Security TLS RSA Root 2023 - TrustAsia Global Root CA G3 - TrustAsia Global Root CA G4 Removed: - Autoridad de Certificacion Firmaprofesional CIF A62634068 - Chambers of Commerce Root - 2008 - Global Chambersign Root - 2008 - Security Communication Root CA - Symantec Class 1 Public Primary Certification Authority - G6 - Symantec Class 2 Public Primary Certification Authority - G6 - TrustCor ECA-1 - TrustCor RootCert CA-1 - TrustCor RootCert CA-2 - VeriSign Class 1 Public Primary Certification Authority - G3 - VeriSign Class 2 Public Primary Certification Authority - G3 - remove-trustcor.patch: removed, now upstream - do a versioned obsoletes of "openssl-certs". - Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525) - Added: FIRMAPROFESIONAL CA ROOT-A WEB - Distrust: GLOBALTRUST 2020 - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Initial import of catatonit v0.1.0. - Update to catatonit v0.1.1, which includes a fix for the libtool requirement. This lets us build on much older distributions. - Update to catatonit v0.1.2 and update links to point to openSUSE repo. - Update package descriptions. - Fix build to correctly build a static binary (which will allow it to work in all containers). This was caused by forgetting to include 'glibc-devel-static'. I've added a check to ensure it doesn't happen by accident again. - Add catatonit-rpmlintrc to include filters for "static binary" warnings, since this is intentional. - Update to catatonit v0.1.3, which includes a fix for docker compatiblity so that dockerd doesn't give spurrious warnings. - Update to catatonit v0.1.4, which includes support for "-g". - Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang endlessly when pid1 died in very specific ways. bsc#1176155 - Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to socket activation or features somewhat adjacent to socket activation (such as passing file descriptors). - Update catatonit-rpmlintrc in order to cover that static binaries are now an error not a warning. - Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only once. Fix build with autocnf 2.71 / automake 1.16.5. - Update to catatont v0.1.7 - This release adds the ability for catatonit to be used as the only process in a pause container, by passing the -P flag (in this mode no subprocess is spawned and thus no signal forwarding is done). - Update to catatonit v0.2.0. * Change license to GPL-2.0-or-later. - Remove upstreamed patches: - 99bb9048f.patch - Initial import of catatonit v0.1.0. - Update to catatonit v0.1.1, which includes a fix for the libtool requirement. This lets us build on much older distributions. - Update to catatonit v0.1.2 and update links to point to openSUSE repo. - Update package descriptions. - Fix build to correctly build a static binary (which will allow it to work in all containers). This was caused by forgetting to include 'glibc-devel-static'. I've added a check to ensure it doesn't happen by accident again. - Add catatonit-rpmlintrc to include filters for "static binary" warnings, since this is intentional. - Update to catatonit v0.1.3, which includes a fix for docker compatiblity so that dockerd doesn't give spurrious warnings. - Update to catatonit v0.1.4, which includes support for "-g". - Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang endlessly when pid1 died in very specific ways. bsc#1176155 - Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to socket activation or features somewhat adjacent to socket activation (such as passing file descriptors). - Update catatonit-rpmlintrc in order to cover that static binaries are now an error not a warning. - Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only once. Fix build with autocnf 2.71 / automake 1.16.5. - Update to catatont v0.1.7 - This release adds the ability for catatonit to be used as the only process in a pause container, by passing the -P flag (in this mode no subprocess is spawned and thus no signal forwarding is done). - Update to catatonit v0.2.0. * Change license to GPL-2.0-or-later. - Remove upstreamed patches: - 99bb9048f.patch - Initial import of catatonit v0.1.0. - Update to catatonit v0.1.1, which includes a fix for the libtool requirement. This lets us build on much older distributions. - Update to catatonit v0.1.2 and update links to point to openSUSE repo. - Update package descriptions. - Fix build to correctly build a static binary (which will allow it to work in all containers). This was caused by forgetting to include 'glibc-devel-static'. I've added a check to ensure it doesn't happen by accident again. - Add catatonit-rpmlintrc to include filters for "static binary" warnings, since this is intentional. - Update to catatonit v0.1.3, which includes a fix for docker compatiblity so that dockerd doesn't give spurrious warnings. - Update to catatonit v0.1.4, which includes support for "-g". - Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang endlessly when pid1 died in very specific ways. bsc#1176155 - Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to socket activation or features somewhat adjacent to socket activation (such as passing file descriptors). - Update catatonit-rpmlintrc in order to cover that static binaries are now an error not a warning. - Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only once. Fix build with autocnf 2.71 / automake 1.16.5. - Update to catatont v0.1.7 - This release adds the ability for catatonit to be used as the only process in a pause container, by passing the -P flag (in this mode no subprocess is spawned and thus no signal forwarding is done). - Update to catatonit v0.2.0. * Change license to GPL-2.0-or-later. - Remove upstreamed patches: - 99bb9048f.patch - Initial import of catatonit v0.1.0. - Update to catatonit v0.1.1, which includes a fix for the libtool requirement. This lets us build on much older distributions. - Update to catatonit v0.1.2 and update links to point to openSUSE repo. - Update package descriptions. - Fix build to correctly build a static binary (which will allow it to work in all containers). This was caused by forgetting to include 'glibc-devel-static'. I've added a check to ensure it doesn't happen by accident again. - Add catatonit-rpmlintrc to include filters for "static binary" warnings, since this is intentional. - Update to catatonit v0.1.3, which includes a fix for docker compatiblity so that dockerd doesn't give spurrious warnings. - Update to catatonit v0.1.4, which includes support for "-g". - Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang endlessly when pid1 died in very specific ways. bsc#1176155 - Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to socket activation or features somewhat adjacent to socket activation (such as passing file descriptors). - Update catatonit-rpmlintrc in order to cover that static binaries are now an error not a warning. - Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only once. Fix build with autocnf 2.71 / automake 1.16.5. - Update to catatont v0.1.7 - This release adds the ability for catatonit to be used as the only process in a pause container, by passing the -P flag (in this mode no subprocess is spawned and thus no signal forwarding is done). - Update to catatonit v0.2.0. * Change license to GPL-2.0-or-later. - Remove upstreamed patches: - 99bb9048f.patch - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424). - Add chrony-pool-empty to still allow installing chrony without preconfigured servers. - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Update to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). - By default we don't write log files but log to journald, so only recommend logrotate. - Update to 4.0 - Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and "reload sources" command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get "maxsources" sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add "add pool" command - Add "reset sources" command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don’t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don’t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option "version 3") - Drop support for line editing with GNU Readline - add BuildRequires for gnutls-devel (which also pulls nettle to enable the new features) - drop patches which are included in the update: chrony-test-update-processing-of-packet-log.patch chrony-test-fix-util-unit-test-for-NTP-era-split.patch - refreshed chrony-config.patch - track series file for easier quilt setup - added option to turn off testsuite with osc build --without=testsuite testsuite still runs by default - drop buildrequires on NSS. We need gnutls for NTS anyway and we can do all the other required crypto via nettle+gnutls. no need for another crypto library. - Enable syscallfilter unconditionally [boo#1181826]. - Update to 4.1 * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Update clknetsim to snapshot f89702d. - Refresh chrony.keyring from https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Change to using systemd-sysusers - Remove otherproviders, not needed anymore - Add now working CONFIG parameter to sysusers generator - boo#1187906: Consolidate all references to the helper script. - bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode, but needed for calculating refids from IPv6 addresses as part of the NTP protocol (rfc5905). As this is a non-cryptographic use of MD5 we can use our own implementation without violating FIPS rules: chrony-refid-internal-md5.patch . - Added hardening to systemd service(s). Added patch(es): * harden_chrony-wait.service.patch * harden_chronyd.service.patch - boo#1190926: PrivateDevices is too strict, we might need to access the rtc and ptp devices. - Add back support to build chrony on SLE12. - Drop dependency on asciidoctor. It is only needed for building the HTML documentation which we don't package anyway. - SLE bugs that have been fixed in openSUSE up to this point without explicit references: bsc#1183783, bsc#1184400, bsc#1171806, bsc#1161119, bsc#1159840. - Obsoleted SLE patches: * chrony-fix-open.patch * chrony-gettimeofday.patch * chrony-ntp-era-split.patch * chrony-pidfile.patch * chrony-select-timeout.patch * chrony-urandom.patch * chrony.sysconfig * clknetsim-glibc-2.31.patch - Add chrony-htonl.patch to work around undocumented behaviour of htonl() in older glibc versions (SLE-12) on 64 bit big endian architectures (s390x). - bsc#1194229: Fix pool package dependencies, so that SLE actually prefers chrony-pool-suse over chrony-pool-empty. - Fix config file handling in the spec file and remove "ntsdumpdir" from default config, because augeas-lenses cannot parse it during installation of SLE Micro on SLE-15-SP3 (bsc#1194220). - Use shorter NTS-KE retry interval when network is down (bsc#1213551, chrony-burst_total_samples_to_go.patch, chrony-retry_interval_ke_start.patch). - Use make quickcheck instead of make check to avoid >1h build times and failures due to timeouts. This was the default before 3.2 but it changed to make tests more reliable. Here a seed is already set to get deterministic execution. - Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424). - Add chrony-pool-empty to still allow installing chrony without preconfigured servers. - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Update to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). - By default we don't write log files but log to journald, so only recommend logrotate. - Update to 4.0 - Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and "reload sources" command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get "maxsources" sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add "add pool" command - Add "reset sources" command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don’t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don’t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option "version 3") - Drop support for line editing with GNU Readline - add BuildRequires for gnutls-devel (which also pulls nettle to enable the new features) - drop patches which are included in the update: chrony-test-update-processing-of-packet-log.patch chrony-test-fix-util-unit-test-for-NTP-era-split.patch - refreshed chrony-config.patch - track series file for easier quilt setup - added option to turn off testsuite with osc build --without=testsuite testsuite still runs by default - drop buildrequires on NSS. We need gnutls for NTS anyway and we can do all the other required crypto via nettle+gnutls. no need for another crypto library. - Enable syscallfilter unconditionally [boo#1181826]. - Update to 4.1 * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Update clknetsim to snapshot f89702d. - Refresh chrony.keyring from https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Change to using systemd-sysusers - Remove otherproviders, not needed anymore - Add now working CONFIG parameter to sysusers generator - boo#1187906: Consolidate all references to the helper script. - bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode, but needed for calculating refids from IPv6 addresses as part of the NTP protocol (rfc5905). As this is a non-cryptographic use of MD5 we can use our own implementation without violating FIPS rules: chrony-refid-internal-md5.patch . - Added hardening to systemd service(s). Added patch(es): * harden_chrony-wait.service.patch * harden_chronyd.service.patch - boo#1190926: PrivateDevices is too strict, we might need to access the rtc and ptp devices. - Add back support to build chrony on SLE12. - Drop dependency on asciidoctor. It is only needed for building the HTML documentation which we don't package anyway. - SLE bugs that have been fixed in openSUSE up to this point without explicit references: bsc#1183783, bsc#1184400, bsc#1171806, bsc#1161119, bsc#1159840. - Obsoleted SLE patches: * chrony-fix-open.patch * chrony-gettimeofday.patch * chrony-ntp-era-split.patch * chrony-pidfile.patch * chrony-select-timeout.patch * chrony-urandom.patch * chrony.sysconfig * clknetsim-glibc-2.31.patch - Add chrony-htonl.patch to work around undocumented behaviour of htonl() in older glibc versions (SLE-12) on 64 bit big endian architectures (s390x). - bsc#1194229: Fix pool package dependencies, so that SLE actually prefers chrony-pool-suse over chrony-pool-empty. - Fix config file handling in the spec file and remove "ntsdumpdir" from default config, because augeas-lenses cannot parse it during installation of SLE Micro on SLE-15-SP3 (bsc#1194220). - Use shorter NTS-KE retry interval when network is down (bsc#1213551, chrony-burst_total_samples_to_go.patch, chrony-retry_interval_ke_start.patch). - Use make quickcheck instead of make check to avoid >1h build times and failures due to timeouts. This was the default before 3.2 but it changed to make tests more reliable. Here a seed is already set to get deterministic execution. - Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424). - Add chrony-pool-empty to still allow installing chrony without preconfigured servers. - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Update to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). - By default we don't write log files but log to journald, so only recommend logrotate. - Update to 4.0 - Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and "reload sources" command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get "maxsources" sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add "add pool" command - Add "reset sources" command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don’t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don’t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option "version 3") - Drop support for line editing with GNU Readline - add BuildRequires for gnutls-devel (which also pulls nettle to enable the new features) - drop patches which are included in the update: chrony-test-update-processing-of-packet-log.patch chrony-test-fix-util-unit-test-for-NTP-era-split.patch - refreshed chrony-config.patch - track series file for easier quilt setup - added option to turn off testsuite with osc build --without=testsuite testsuite still runs by default - drop buildrequires on NSS. We need gnutls for NTS anyway and we can do all the other required crypto via nettle+gnutls. no need for another crypto library. - Enable syscallfilter unconditionally [boo#1181826]. - Update to 4.1 * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Update clknetsim to snapshot f89702d. - Refresh chrony.keyring from https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Change to using systemd-sysusers - Remove otherproviders, not needed anymore - Add now working CONFIG parameter to sysusers generator - boo#1187906: Consolidate all references to the helper script. - bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode, but needed for calculating refids from IPv6 addresses as part of the NTP protocol (rfc5905). As this is a non-cryptographic use of MD5 we can use our own implementation without violating FIPS rules: chrony-refid-internal-md5.patch . - Added hardening to systemd service(s). Added patch(es): * harden_chrony-wait.service.patch * harden_chronyd.service.patch - boo#1190926: PrivateDevices is too strict, we might need to access the rtc and ptp devices. - Add back support to build chrony on SLE12. - Drop dependency on asciidoctor. It is only needed for building the HTML documentation which we don't package anyway. - SLE bugs that have been fixed in openSUSE up to this point without explicit references: bsc#1183783, bsc#1184400, bsc#1171806, bsc#1161119, bsc#1159840. - Obsoleted SLE patches: * chrony-fix-open.patch * chrony-gettimeofday.patch * chrony-ntp-era-split.patch * chrony-pidfile.patch * chrony-select-timeout.patch * chrony-urandom.patch * chrony.sysconfig * clknetsim-glibc-2.31.patch - Add chrony-htonl.patch to work around undocumented behaviour of htonl() in older glibc versions (SLE-12) on 64 bit big endian architectures (s390x). - bsc#1194229: Fix pool package dependencies, so that SLE actually prefers chrony-pool-suse over chrony-pool-empty. - Fix config file handling in the spec file and remove "ntsdumpdir" from default config, because augeas-lenses cannot parse it during installation of SLE Micro on SLE-15-SP3 (bsc#1194220). - Use shorter NTS-KE retry interval when network is down (bsc#1213551, chrony-burst_total_samples_to_go.patch, chrony-retry_interval_ke_start.patch). - Use make quickcheck instead of make check to avoid >1h build times and failures due to timeouts. This was the default before 3.2 but it changed to make tests more reliable. Here a seed is already set to get deterministic execution. - Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424). - Add chrony-pool-empty to still allow installing chrony without preconfigured servers. - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Update to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). - By default we don't write log files but log to journald, so only recommend logrotate. - Update to 4.0 - Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and "reload sources" command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get "maxsources" sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add "add pool" command - Add "reset sources" command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don’t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don’t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option "version 3") - Drop support for line editing with GNU Readline - add BuildRequires for gnutls-devel (which also pulls nettle to enable the new features) - drop patches which are included in the update: chrony-test-update-processing-of-packet-log.patch chrony-test-fix-util-unit-test-for-NTP-era-split.patch - refreshed chrony-config.patch - track series file for easier quilt setup - added option to turn off testsuite with osc build --without=testsuite testsuite still runs by default - drop buildrequires on NSS. We need gnutls for NTS anyway and we can do all the other required crypto via nettle+gnutls. no need for another crypto library. - Enable syscallfilter unconditionally [boo#1181826]. - Update to 4.1 * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Update clknetsim to snapshot f89702d. - Refresh chrony.keyring from https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Change to using systemd-sysusers - Remove otherproviders, not needed anymore - Add now working CONFIG parameter to sysusers generator - boo#1187906: Consolidate all references to the helper script. - bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode, but needed for calculating refids from IPv6 addresses as part of the NTP protocol (rfc5905). As this is a non-cryptographic use of MD5 we can use our own implementation without violating FIPS rules: chrony-refid-internal-md5.patch . - Added hardening to systemd service(s). Added patch(es): * harden_chrony-wait.service.patch * harden_chronyd.service.patch - boo#1190926: PrivateDevices is too strict, we might need to access the rtc and ptp devices. - Add back support to build chrony on SLE12. - Drop dependency on asciidoctor. It is only needed for building the HTML documentation which we don't package anyway. - SLE bugs that have been fixed in openSUSE up to this point without explicit references: bsc#1183783, bsc#1184400, bsc#1171806, bsc#1161119, bsc#1159840. - Obsoleted SLE patches: * chrony-fix-open.patch * chrony-gettimeofday.patch * chrony-ntp-era-split.patch * chrony-pidfile.patch * chrony-select-timeout.patch * chrony-urandom.patch * chrony.sysconfig * clknetsim-glibc-2.31.patch - Add chrony-htonl.patch to work around undocumented behaviour of htonl() in older glibc versions (SLE-12) on 64 bit big endian architectures (s390x). - bsc#1194229: Fix pool package dependencies, so that SLE actually prefers chrony-pool-suse over chrony-pool-empty. - Fix config file handling in the spec file and remove "ntsdumpdir" from default config, because augeas-lenses cannot parse it during installation of SLE Micro on SLE-15-SP3 (bsc#1194220). - Use shorter NTS-KE retry interval when network is down (bsc#1213551, chrony-burst_total_samples_to_go.patch, chrony-retry_interval_ke_start.patch). - Use make quickcheck instead of make check to avoid >1h build times and failures due to timeouts. This was the default before 3.2 but it changed to make tests more reliable. Here a seed is already set to get deterministic execution. - Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424). - Add chrony-pool-empty to still allow installing chrony without preconfigured servers. - Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113). - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - Update to 3.5.1: * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911) - Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277). - By default we don't write log files but log to journald, so only recommend logrotate. - Update to 4.0 - Enhancements - Add support for Network Time Security (NTS) authentication - Add support for AES-CMAC keys (AES128, AES256) with Nettle - Add authselectmode directive to control selection of unauthenticated sources - Add binddevice, bindacqdevice, bindcmddevice directives - Add confdir directive to better support fragmented configuration - Add sourcedir directive and "reload sources" command to support dynamic NTP sources specified in files - Add clockprecision directive - Add dscp directive to set Differentiated Services Code Point (DSCP) - Add -L option to limit log messages by severity - Add -p option to print whole configuration with included files - Add -U option to allow start under non-root user - Allow maxsamples to be set to 1 for faster update with -q/-Q option - Avoid replacing NTP sources with sources that have unreachable address - Improve pools to repeat name resolution to get "maxsources" sources - Improve source selection with trusted sources - Improve NTP loop test to prevent synchronisation to itself - Repeat iburst when NTP source is switched from offline state to online - Update clock synchronisation status and leap status more frequently - Update seccomp filter - Add "add pool" command - Add "reset sources" command to drop all measurements - Add authdata command to print details about NTP authentication - Add selectdata command to print details about source selection - Add -N option and sourcename command to print original names of sources - Add -a option to some commands to print also unresolved sources - Add -k, -p, -r options to clients command to select, limit, reset data - Bug fixes - Don’t set interface for NTP responses to allow asymmetric routing - Handle RTCs that don’t support interrupts - Respond to command requests with correct address on multihomed hosts - Removed features - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320) - Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option "version 3") - Drop support for line editing with GNU Readline - add BuildRequires for gnutls-devel (which also pulls nettle to enable the new features) - drop patches which are included in the update: chrony-test-update-processing-of-packet-log.patch chrony-test-fix-util-unit-test-for-NTP-era-split.patch - refreshed chrony-config.patch - track series file for easier quilt setup - added option to turn off testsuite with osc build --without=testsuite testsuite still runs by default - drop buildrequires on NSS. We need gnutls for NTS anyway and we can do all the other required crypto via nettle+gnutls. no need for another crypto library. - Enable syscallfilter unconditionally [boo#1181826]. - Update to 4.1 * Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate) * Add source-specific configuration of trusted certificates * Allow multiple files and directories with trusted certificates * Allow multiple pairs of server keys and certificates * Add copy option to server/pool directive * Increase PPS lock limit to 40% of pulse interval * Perform source selection immediately after loading dump files * Reload dump files for addresses negotiated by NTS-KE server * Update seccomp filter and add less restrictive level * Restart ongoing name resolution on online command * Fix dump files to not include uncorrected offset * Fix initstepslew to accept time from own NTP clients * Reset NTP address and port when no longer negotiated by NTS-KE server - Update clknetsim to snapshot f89702d. - Refresh chrony.keyring from https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc - Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689). - Change to using systemd-sysusers - Remove otherproviders, not needed anymore - Add now working CONFIG parameter to sysusers generator - boo#1187906: Consolidate all references to the helper script. - bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode, but needed for calculating refids from IPv6 addresses as part of the NTP protocol (rfc5905). As this is a non-cryptographic use of MD5 we can use our own implementation without violating FIPS rules: chrony-refid-internal-md5.patch . - Added hardening to systemd service(s). Added patch(es): * harden_chrony-wait.service.patch * harden_chronyd.service.patch - boo#1190926: PrivateDevices is too strict, we might need to access the rtc and ptp devices. - Add back support to build chrony on SLE12. - Drop dependency on asciidoctor. It is only needed for building the HTML documentation which we don't package anyway. - SLE bugs that have been fixed in openSUSE up to this point without explicit references: bsc#1183783, bsc#1184400, bsc#1171806, bsc#1161119, bsc#1159840. - Obsoleted SLE patches: * chrony-fix-open.patch * chrony-gettimeofday.patch * chrony-ntp-era-split.patch * chrony-pidfile.patch * chrony-select-timeout.patch * chrony-urandom.patch * chrony.sysconfig * clknetsim-glibc-2.31.patch - Add chrony-htonl.patch to work around undocumented behaviour of htonl() in older glibc versions (SLE-12) on 64 bit big endian architectures (s390x). - bsc#1194229: Fix pool package dependencies, so that SLE actually prefers chrony-pool-suse over chrony-pool-empty. - Fix config file handling in the spec file and remove "ntsdumpdir" from default config, because augeas-lenses cannot parse it during installation of SLE Micro on SLE-15-SP3 (bsc#1194220). - Use shorter NTS-KE retry interval when network is down (bsc#1213551, chrony-burst_total_samples_to_go.patch, chrony-retry_interval_ke_start.patch). - Use make quickcheck instead of make check to avoid >1h build times and failures due to timeouts. This was the default before 3.2 but it changed to make tests more reliable. Here a seed is already set to get deterministic execution. - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Add version settings to Provides/Obsoletes - Update to version 1.14 + Use '-s' instead of '--no-progress-meter' for curl (bsc#1221757) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Add version settings to Provides/Obsoletes - Update to version 1.14 + Use '-s' instead of '--no-progress-meter' for curl (bsc#1221757) - Update to version 0.5 + New API version for Azure metadata server + Wait for the metadata server in EC2 - Update to version 0.6: + Use tested and supported metadata API versions - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 0.5 + New API version for Azure metadata server + Wait for the metadata server in EC2 - Update to version 0.6: + Use tested and supported metadata API versions - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Add version settings to Provides/Obsoletes - Update to version 1.14 + Use '-s' instead of '--no-progress-meter' for curl (bsc#1221757) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Add version settings to Provides/Obsoletes - Update to version 1.14 + Use '-s' instead of '--no-progress-meter' for curl (bsc#1221757) - Update to version 0.5 + New API version for Azure metadata server + Wait for the metadata server in EC2 - Update to version 0.6: + Use tested and supported metadata API versions - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 0.5 + New API version for Azure metadata server + Wait for the metadata server in EC2 - Update to version 0.6: + Use tested and supported metadata API versions - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Add version settings to Provides/Obsoletes - Update to version 1.14 + Use '-s' instead of '--no-progress-meter' for curl (bsc#1221757) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 1.9: + Drop package dependency on sysconfig-netconfig + Improve log level handling + Support IPv6 IMDS endpoint in EC2 (bsc#1218069) - Update to version 1.10: + Drop cloud-netconfig-nm sub package and include NM dispatcher script in main packages (bsc#1219007) + Spec file cleanup - Update to version 1.11: + Revert address metadata lookup in GCE to local lookup (bsc#1219454) + Fix hang on warning log messages + Check whether getting IPv4 addresses from metadata failed and abort if true + Only delete policy rules if they exist + Skip adding/removing IPv4 ranges if metdata lookup failed + Improve error handling and logging in Azure + Set SCRIPTDIR when installing netconfig wrapper - Add Provides/Obsoletes for dropped cloud-netconfig-nm - Install dispatcher script into /etc/NetworkManager/dispatcher.d on older distributions - Add BuildReqires: NetworkManager to avoid owning dispatcher.d parent directory - Update to version 1.12 (bsc#1221202) + If token access succeeds using IPv4 do not use the IPv6 endpoint only use the IPv6 IMDS endpoint if IPv4 access fails. - Add version settings to Provides/Obsoletes - Update to version 1.14 + Use '-s' instead of '--no-progress-meter' for curl (bsc#1221757) - Update to version 0.5 + New API version for Azure metadata server + Wait for the metadata server in EC2 - Update to version 0.6: + Use tested and supported metadata API versions - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Update to version 0.5 + New API version for Azure metadata server + Wait for the metadata server in EC2 - Update to version 0.6: + Use tested and supported metadata API versions - Prepare for SLE11 submission (bsc#1063292) - Add missing Provides/Conflicts statements to spec file - Remove dependency on udev-persistent-ifnames (bsc#1075484) - Added dependency on curl - Use otherproviders() only on SLES 11 builds - Update to version 0.7: + no persistent interface names in Azure (bsc#1095485) - Update to version 0.9: + run cloud-netconfig periodically (bsc#1118783 bsc#1122013) + do not treat eth0 special wrt routing policies (bsc#1123008) + reduce timeout on metadata read (bsc#1112822) - Update to version 1.0: + pause and retry if API call throttling is detected in Azure (bsc#1135257 bsc#1135263) - Update to version 1.1 + fix use of GATEWAY variable (bsc#1157117, bsc#1157190) + remove secondary IPv4 address only when added by cloud-netconfig (bsc#1144282) + simplify routing setup for single NIC systems (partly fixes bsc#1135592) - Update to version 1.2: + support AWS IMDSv2 token - Update to version 1.3: + Fix IPv4 address handling on secondary NICs in Azure - Removed obsolete Group tag from spec file - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavors. - Update to version 1.4: + copy routes from default routing table (bsc#1162705, bsc#1162707) + make CLOUD_NETCONFIG_MANAGE default configurable - Update to version 1.5: + Add support for GCE (bsc#1159460, bsc#1178486) + Improve default gateway determination - Update to version 1.6: + Ignore proxy when accessing metadata (bsc#1187939) + Print warning in case metadata is not accessible + Documentation update - /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in Tumbleweed, update path (poo#116221) - Update to version 1.7: + Overhaul policy routing setup (issue #19) + Support alias IPv4 ranges (issue #14) + Add support for NetworkManager (bsc#1204549) + Remove dependency on netconfig + Install into libexec directory + Clear stale ifcfg files for accelerated NICs (bsc#1199853) + More debug messages + Documentation update - Update to version 1.8: + Fix Azure metadata check (bsc#1214715) + Fix cleanup on ifdown - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Avoid race confition with ca-certificates (bsc#1189362) + Make the service run after ca-sertificates is done + Attempt multiple times to update the trust chain - Update to version 9.3.0 (jsc#PCT-130) + Support AHB-v3 + Support registration of BYOS instances against the update infrastructure + Properly extract the region for local zones in AWS to ensure instances get connected to the proper update servers + Azure addon service and executable rename + Support non SLE repos + Fix handling of regionservers configured with DNS names - Follow up changes to (jsc#PCT-130, bsc#1182026) + Fix executable name for AHB service/timer + Update manpage for BYOS instance registration - Update to version 10.0.0 (bsc#1195414, bsc#1195564) + Refactor removes check_registration() function in utils implementation + Only start the registration service for PAYG images - addon-azure sub-package to version 1.0.1 - Update -addon-azure to 1.0.2 (bsc#1196305) + The is-registered() function expects a string of the update server FQDN. The regionsrv-enabler-azure passed an Object of type SMT. Fix the call in regionsrv-enabler-azure. - Update -plugin-azure to 2.0.0 (bsc#1196146) + Lower case the region hint to reduce issues with Azure region name case inconsistencies - Update to version 10.0.1 (bsc#1197113) + Provide status feedback on registration, success or failure + Log warning message if data provider is configured but no data can be retrieved - Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564) + The repo enablement timer cannot depend on guestregister.service - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to 10.3.5 + Update spec file to build in all code streams, SLE 12, SLE 15, ALP, and SLFO and have proper dependencies - Update to 10.3.6 (jsc#PCT-471, bsc#1230615) + Fix sudo setup ~ permissions cloudguestregistryauth ~ directory ownership /etc/sudoers.d + spec file ~ Remove traces of registry related entries on SLE 12 + Forward port ~ fix-for-sles12-disable-registry.patch ~ fix-for-sles12-no-trans_update.patch + Deregister non free extensions at registercloudguest --clean + Fix registry cleanup at registercloudguest --clean, don't remove files + Prevent duplicate search entries in registry setup - Update EC2 plugin to 1.0.5 + Switch to using the region endpoint from IMDS to determine the region instead of deriving the data from the availability zone - Update to 10.3.7 (bsc#1232770) + Fix the product triplet for LTSS, it is always SLES-LTSS, not $BASEPRODUCT-LTSS - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.2 + Fix name of logfile in error message + Fix variable scoping to properly detect registration error + Cleanup any artifacts on registration failure + Fix latent bug with /etc/hosts population + Do not throw error when attemting to unregister a system that is not registered + Skip extension registration if the extension is recommended by the baseproduct as it gets automatically installed - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.3 (bsc#1198389) - Descend into the extension tree even if top level module is recommended - Cache license state for AHB support to detect type switch - Properly clean suse.com credentials when switching from SCC to update infrastructure - New log message to indicate base product registration success - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Add patch to block IPv6 on SLE12 (bsc#1203382) - Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924) - Implement functionality to detect if an update server has a new cert. Import the new cert when it is detected. - Forward port fix-for-sles12-disable-ipv6.patch - From 10.0.6 (bsc#1205089) - Credentials are equal when username and password are the same ignore other entries in the credentials file - Handle multiple zypper names in process table, zypper and Zypp-main to properly detect the running process - Guard dmidecode dependency (bsc#1206082) - Update to version 10.0.8 (bsc#1206428) - Fix regression introduced by 10.0.7. When the hosts file was modified such that there is no empty line at the end of the file the content after removing the registration data does not match the content prior to registration. The update fixes the issue triggered by an index logic error. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 ) - Removes a warning about system_token entry present in the credentials file. - Adds logrotate configuration for log rotation. - Update to version 10.1.1 (bsc#1210020, bsc#1210021) + Clean up the system if baseproduct registraion fails to leave the system in prestine state + Log when the registercloudguest command is invoked with --clean - Update to version 10.1.2 (bsc#1211282) + Properly handle Ipv6 when checking update server responsiveness. If not available fall back and use IPv4 information + Use systemd_ordered to allow use in a container without pulling systemd into the container as a requirement - Update to version 10.1.3 (bsc#1214801) + Add a warning if we detect a Python package cert bundle for certifi This will help with debugging and point to potential issues when using SUSE images in AWS, Azure, and GCE - Update to version 10.1.4 (bsc#1217451) + Fetch cert for new update server during failover - Update to version 10.1.5 (bsc#1217583) + Fix fallback path when IPv6 network path is not usable + Enable an IPv6 fallback path in IMDS access if it cannot be accessed over IPv4 + Enable IMDS access over IPv6 - Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159) + Fix the algorithm to determine the region from the availability zone information retrieved from IMDS. - Update to version 10.1.6 + Support specifying an IPv6 address for a manually configured target update server. - Update to version 10.1.7 (bsc#1220164, bsc#1220165) + Fix the failover path to a new target update server. At present a new server is not found since credential validation fails. We targeted the server detected in down condition to verify the credentials instead of the replacement server. - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016) + In addition to logging, write message to stderr when registration fails + Detect transactional-update system with read only setup and use the transactional-update command to register + Handle operation in a different target root directory for credentials checking - Update to version 10.3.0 (bsc#1227308, bsc#1222985) + Add support for sidecar registry Podman and rootless Docker support to set up the necessary configuration for the container engines to run as defined + Add running command as root through sudoers file - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137) + The entry for the update infrastructure registry mirror was written incorrectly causing docker daemon startup to fail. - Update to 10.3.4 + Modify the message when network access over a specific IP version does not work. This is an informational message and should not look like an error + Inform the user that LTSS registration takes a little longer + Add fix-for-sles12-no-trans_update.patch + SLE 12 family has no products with transactional-update we do not need to look for this condition - From 10.3.3 (bsc#1229472) + Handle changes in process structure to properly identify the running zypper parent process and only check for 1 PID - From 10.3.2 + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream - From 10.3.1 (jsc#PCT-400) + Add support for LTSS registration + Add fix-for-sles12-disable-registry.patch ~ No container support in SLE 12 - Update to version 0.5.0: * Documentation: Add conventions doc * noop: allow specifying debug file in config JSON * Spec/Conventions: Update to include plugin config * spec: add network configuration list specification * api,libcni: add network config list-based plugin chaining * Update CONVENTIONS.md * skel: adds PluginMainWithError which returns a *types.Error * testutils: pass netConf in for version operations; pass raw result out for tests * types: make Result an interface and move existing Result to separate package * macvlan/ipvlan: use common RenameLink method * plugins/flannel: organize test JSON alphabetically * pkg/ipam: add testcases * spec/plugins: return interface details and multiple IP addresses to runtime * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH * pkg/utils/sysctl/sysctl_linux.go: fix build tag. * pkg/utils/sysctl/sysctl_linux.go: fix typo. * invoke: Enable plugin file names with extensions * CONVENTIONS.md: Update details on port-mappings * Update with feedback * More markups * spec: Remove `routes` from Network Configuration * docs: consolidate host-local documentation * pkg/ns: refactored so that builds succeed on non-linux platforms * Fix grammar * plugins/main/ptp: set the Sandbox property on the response * README: List multus as 3rd party plugin * Replace Michael Bridgen with Bryan Boreham * pkg/ns, pkg/types: refactored non linux build fix code to * pkg/ip: refactored so that builds succeed on non-linux platforms * vendor: Update vishvanana/netlink dependency * libcni: up-convert a Config to a ConfigList when no other configs are found. * docs: CNI versioning for 0.3.0 upgrade * docs: Edits to v0.3.0 upgrade guidance * docs: minor improvements to 0.3.0 upgrade guidance * docs: add small upgrade instructions * docs: minor improvements to spec-upgrades * docs: fill-out and correct version conversion table * docs: table formatting is hard * pkg/testutils: return errors after restoring stdout * pkg/types: misc current types testcase cleanups * Minor rewording about default config version * spec,libcni: add support for injecting runtimeConfig into plugin stdin data * Check n.IPAM before use it in LoadIPAMConfig function * do not error if last_reserved_ip is missing for host local ipam * add test for ensuring initial subnet creation does not contain an error * fix unrelated failing tests - Update to version 0.5.1: * readme.md: Add link to community sync * pkg/ip: do not leak types from vendored netlink package * pkg/ip: SetupVeth returns net.Interface * pkg/ip: improve docstring for SetupVeth * Added Romana to list of CNI providers... * plugins/meta/flannel: If net config is missing do not return err on DEL * plugins/*: Don't error if the device doesn't exist - Update to version 0.5.2: * Rename build script to avoid conflict with bazel * Enable s390x build * Update community sync detail * Added entry for CNI-Genie * travis: shift forward to Go 1.8 and 1.7 * spec/plugins: fix 'ip'->'ips' in the spec, bump to 0.3.1 * libcni: Improved error messages. * libcni: Fixed tests that were checking error strings. * Documentation: Added documentation for `cnitool`. - Update to version 0.6.0: * Conventions: add convention around chaining interfaces * pkg/types: safer typecasting for TextUnmarshaler when loading args * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected * Update note about next Community Sync, 2017-06-21 * types: fix marshalling of omitted "interfaces" key in IPConfig JSON * Update and document release process * scripts/release.sh: Add in s390x architecture * cnitool: add support for CNI_ARGS * README plugins list: add Linen CNI plugin - Remove the dependency with the cni-plugins - Recommend the cni-plugins - Make /var/lib/cni writable - Add snapper as a requirement, to provide mksubvolume - Use full/absolute path for mksubvolume - Change snapper Requires to a Requires(post) - Remove creating subvolumes. This should be in another package (kubernetes-kubelet) - Make use of %license macro - Refactor %license usage to a simpler form - Update to version 0.7.0: * Spec changes: + Use more RFC2119 style language in specification (must, should...) + add notes about ADD/DEL ordering + Make the container ID required and unique. + remove the version parameter from ADD and DEL commands. + Network interface name matters + be explicit about optional and required structure members + add CHECK method + Add a well-known error for "try again" + SPEC.md: clarify meaning of 'routes' * Library changes: + pkg/types: Makes IPAM concrete type + libcni: return error if Type is empty + skel: VERSION shouldn't block on stdin + non-pointer instances of types.Route now correctly marshal to JSON + libcni: add ValidateNetwork and ValidateNetworkList functions + pkg/skel: return error if JSON config has no network name + skel: add support for plugin version string + libcni: make exec handling an interface for better downstream testing + libcni: api now takes a Context to allow operations to be timed out or cancelled + types/version: add helper to parse PrevResult + skel: only print about message, not errors + skel,invoke,libcni: implementation of CHECK method + cnitool: Honor interface name supplied via CNI_IFNAME environment variable. + cnitool: validate correct number of args + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0 + add PrintTo method to Result interface + Return a better error when the plugin returns none - Install sleep binary into CNI plugin directory - Restore build.sh script which was removed upstream - Update to version 0.7.1 (bsc#1160460): * Library changes: + invoke : ensure custom envs of CNIArgs are prepended to process envs + add GetNetworkListCachedResult to CNI interface + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance * Documentation & Convention changes: + Update cnitool documentation for spec v0.4.0 + Add cni-route-override to CNI plugin list * Build and test changes: + Release: bump go to v1.12 - Set correct CNI version for 99-loopback.conf - Update to version 0.8.0: * Specification and Conventions changes + docs: add ips and mac to well-known capabilities + add interface name validation + Add GUID to well known Capabilities + Add DeviceID attribute to RuntimeConfig + Typo fixes for infiniband GUID + Fix linting issues in docs, add headers to json example, update errors into table * Documentation changes + Update cnitool docs + Remove extra ',' chars which makes conflist examples invalid. * libcni changes + Remove Result.String method + libcni: add config caching [v2] + clean up : fix staticcheck warnings + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir + skel: clean up errors in skel and add some well-known error codes + libcni: find plugin in exec + validate containerID and networkName + skel: remove needless functions and types + libcni: also cache IfName + libcni: fix cache file 'result' key name + Bump Go version to 1.13 + When CNI version isn't supplied in config, use default. + intercept netplugin std error + invoke: capture and return stderr if plugin exits unexpectedly + Retry exec commands on text file busy - Set GO111MODULE=auto to build with go1.16+ * Default changed to GO111MODULE=on in go1.16 * Set temporarily until using upstream release with go.mod * Drop BuildRequires: golang-packaging not currently using macros * Add BuildRequires: golang(API) >= 1.13 recommended dependency expression - use buildmode=pie (cnitool is installed into sbindir) - Update to version 0.8.1: * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206 - Tighten up plugin-finding logic (#811). - Update to version v1.0.1: * Rewritten spec + non-List configurations are removed + the version field in the interfaces array was redundant and is removed * libcni improvements - Employ RPM macros.go where feasible - Use vendor tarball - Remove ./build.sh - Update to version 1.1.2: * spec: fix format * libcni: handle empty version when parsing version * [exec-plugins]: support plugin lists This is a minor update to the CNI libraries and tooling. This does not bump the protocol / spec version, which remains at v1.0.0 - Update to version 0.5.0: * Documentation: Add conventions doc * noop: allow specifying debug file in config JSON * Spec/Conventions: Update to include plugin config * spec: add network configuration list specification * api,libcni: add network config list-based plugin chaining * Update CONVENTIONS.md * skel: adds PluginMainWithError which returns a *types.Error * testutils: pass netConf in for version operations; pass raw result out for tests * types: make Result an interface and move existing Result to separate package * macvlan/ipvlan: use common RenameLink method * plugins/flannel: organize test JSON alphabetically * pkg/ipam: add testcases * spec/plugins: return interface details and multiple IP addresses to runtime * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH * pkg/utils/sysctl/sysctl_linux.go: fix build tag. * pkg/utils/sysctl/sysctl_linux.go: fix typo. * invoke: Enable plugin file names with extensions * CONVENTIONS.md: Update details on port-mappings * Update with feedback * More markups * spec: Remove `routes` from Network Configuration * docs: consolidate host-local documentation * pkg/ns: refactored so that builds succeed on non-linux platforms * Fix grammar * plugins/main/ptp: set the Sandbox property on the response * README: List multus as 3rd party plugin * Replace Michael Bridgen with Bryan Boreham * pkg/ns, pkg/types: refactored non linux build fix code to * pkg/ip: refactored so that builds succeed on non-linux platforms * vendor: Update vishvanana/netlink dependency * libcni: up-convert a Config to a ConfigList when no other configs are found. * docs: CNI versioning for 0.3.0 upgrade * docs: Edits to v0.3.0 upgrade guidance * docs: minor improvements to 0.3.0 upgrade guidance * docs: add small upgrade instructions * docs: minor improvements to spec-upgrades * docs: fill-out and correct version conversion table * docs: table formatting is hard * pkg/testutils: return errors after restoring stdout * pkg/types: misc current types testcase cleanups * Minor rewording about default config version * spec,libcni: add support for injecting runtimeConfig into plugin stdin data * Check n.IPAM before use it in LoadIPAMConfig function * do not error if last_reserved_ip is missing for host local ipam * add test for ensuring initial subnet creation does not contain an error * fix unrelated failing tests - Update to version 0.5.1: * readme.md: Add link to community sync * pkg/ip: do not leak types from vendored netlink package * pkg/ip: SetupVeth returns net.Interface * pkg/ip: improve docstring for SetupVeth * Added Romana to list of CNI providers... * plugins/meta/flannel: If net config is missing do not return err on DEL * plugins/*: Don't error if the device doesn't exist - Update to version 0.5.2: * Rename build script to avoid conflict with bazel * Enable s390x build * Update community sync detail * Added entry for CNI-Genie * travis: shift forward to Go 1.8 and 1.7 * spec/plugins: fix 'ip'->'ips' in the spec, bump to 0.3.1 * libcni: Improved error messages. * libcni: Fixed tests that were checking error strings. * Documentation: Added documentation for `cnitool`. - Update to version 0.6.0: * Conventions: add convention around chaining interfaces * pkg/types: safer typecasting for TextUnmarshaler when loading args * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected * Update note about next Community Sync, 2017-06-21 * types: fix marshalling of omitted "interfaces" key in IPConfig JSON * Update and document release process * scripts/release.sh: Add in s390x architecture * cnitool: add support for CNI_ARGS * README plugins list: add Linen CNI plugin - Remove the dependency with the cni-plugins - Recommend the cni-plugins - Make /var/lib/cni writable - Add snapper as a requirement, to provide mksubvolume - Use full/absolute path for mksubvolume - Change snapper Requires to a Requires(post) - Remove creating subvolumes. This should be in another package (kubernetes-kubelet) - Make use of %license macro - Refactor %license usage to a simpler form - Update to version 0.7.0: * Spec changes: + Use more RFC2119 style language in specification (must, should...) + add notes about ADD/DEL ordering + Make the container ID required and unique. + remove the version parameter from ADD and DEL commands. + Network interface name matters + be explicit about optional and required structure members + add CHECK method + Add a well-known error for "try again" + SPEC.md: clarify meaning of 'routes' * Library changes: + pkg/types: Makes IPAM concrete type + libcni: return error if Type is empty + skel: VERSION shouldn't block on stdin + non-pointer instances of types.Route now correctly marshal to JSON + libcni: add ValidateNetwork and ValidateNetworkList functions + pkg/skel: return error if JSON config has no network name + skel: add support for plugin version string + libcni: make exec handling an interface for better downstream testing + libcni: api now takes a Context to allow operations to be timed out or cancelled + types/version: add helper to parse PrevResult + skel: only print about message, not errors + skel,invoke,libcni: implementation of CHECK method + cnitool: Honor interface name supplied via CNI_IFNAME environment variable. + cnitool: validate correct number of args + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0 + add PrintTo method to Result interface + Return a better error when the plugin returns none - Install sleep binary into CNI plugin directory - Restore build.sh script which was removed upstream - Update to version 0.7.1 (bsc#1160460): * Library changes: + invoke : ensure custom envs of CNIArgs are prepended to process envs + add GetNetworkListCachedResult to CNI interface + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance * Documentation & Convention changes: + Update cnitool documentation for spec v0.4.0 + Add cni-route-override to CNI plugin list * Build and test changes: + Release: bump go to v1.12 - Set correct CNI version for 99-loopback.conf - Update to version 0.8.0: * Specification and Conventions changes + docs: add ips and mac to well-known capabilities + add interface name validation + Add GUID to well known Capabilities + Add DeviceID attribute to RuntimeConfig + Typo fixes for infiniband GUID + Fix linting issues in docs, add headers to json example, update errors into table * Documentation changes + Update cnitool docs + Remove extra ',' chars which makes conflist examples invalid. * libcni changes + Remove Result.String method + libcni: add config caching [v2] + clean up : fix staticcheck warnings + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir + skel: clean up errors in skel and add some well-known error codes + libcni: find plugin in exec + validate containerID and networkName + skel: remove needless functions and types + libcni: also cache IfName + libcni: fix cache file 'result' key name + Bump Go version to 1.13 + When CNI version isn't supplied in config, use default. + intercept netplugin std error + invoke: capture and return stderr if plugin exits unexpectedly + Retry exec commands on text file busy - Set GO111MODULE=auto to build with go1.16+ * Default changed to GO111MODULE=on in go1.16 * Set temporarily until using upstream release with go.mod * Drop BuildRequires: golang-packaging not currently using macros * Add BuildRequires: golang(API) >= 1.13 recommended dependency expression - use buildmode=pie (cnitool is installed into sbindir) - Update to version 0.8.1: * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206 - Tighten up plugin-finding logic (#811). - Update to version v1.0.1: * Rewritten spec + non-List configurations are removed + the version field in the interfaces array was redundant and is removed * libcni improvements - Employ RPM macros.go where feasible - Use vendor tarball - Remove ./build.sh - Update to version 1.1.2: * spec: fix format * libcni: handle empty version when parsing version * [exec-plugins]: support plugin lists This is a minor update to the CNI libraries and tooling. This does not bump the protocol / spec version, which remains at v1.0.0 - Update to version 0.5.0: * Documentation: Add conventions doc * noop: allow specifying debug file in config JSON * Spec/Conventions: Update to include plugin config * spec: add network configuration list specification * api,libcni: add network config list-based plugin chaining * Update CONVENTIONS.md * skel: adds PluginMainWithError which returns a *types.Error * testutils: pass netConf in for version operations; pass raw result out for tests * types: make Result an interface and move existing Result to separate package * macvlan/ipvlan: use common RenameLink method * plugins/flannel: organize test JSON alphabetically * pkg/ipam: add testcases * spec/plugins: return interface details and multiple IP addresses to runtime * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH * pkg/utils/sysctl/sysctl_linux.go: fix build tag. * pkg/utils/sysctl/sysctl_linux.go: fix typo. * invoke: Enable plugin file names with extensions * CONVENTIONS.md: Update details on port-mappings * Update with feedback * More markups * spec: Remove `routes` from Network Configuration * docs: consolidate host-local documentation * pkg/ns: refactored so that builds succeed on non-linux platforms * Fix grammar * plugins/main/ptp: set the Sandbox property on the response * README: List multus as 3rd party plugin * Replace Michael Bridgen with Bryan Boreham * pkg/ns, pkg/types: refactored non linux build fix code to * pkg/ip: refactored so that builds succeed on non-linux platforms * vendor: Update vishvanana/netlink dependency * libcni: up-convert a Config to a ConfigList when no other configs are found. * docs: CNI versioning for 0.3.0 upgrade * docs: Edits to v0.3.0 upgrade guidance * docs: minor improvements to 0.3.0 upgrade guidance * docs: add small upgrade instructions * docs: minor improvements to spec-upgrades * docs: fill-out and correct version conversion table * docs: table formatting is hard * pkg/testutils: return errors after restoring stdout * pkg/types: misc current types testcase cleanups * Minor rewording about default config version * spec,libcni: add support for injecting runtimeConfig into plugin stdin data * Check n.IPAM before use it in LoadIPAMConfig function * do not error if last_reserved_ip is missing for host local ipam * add test for ensuring initial subnet creation does not contain an error * fix unrelated failing tests - Update to version 0.5.1: * readme.md: Add link to community sync * pkg/ip: do not leak types from vendored netlink package * pkg/ip: SetupVeth returns net.Interface * pkg/ip: improve docstring for SetupVeth * Added Romana to list of CNI providers... * plugins/meta/flannel: If net config is missing do not return err on DEL * plugins/*: Don't error if the device doesn't exist - Update to version 0.5.2: * Rename build script to avoid conflict with bazel * Enable s390x build * Update community sync detail * Added entry for CNI-Genie * travis: shift forward to Go 1.8 and 1.7 * spec/plugins: fix 'ip'->'ips' in the spec, bump to 0.3.1 * libcni: Improved error messages. * libcni: Fixed tests that were checking error strings. * Documentation: Added documentation for `cnitool`. - Update to version 0.6.0: * Conventions: add convention around chaining interfaces * pkg/types: safer typecasting for TextUnmarshaler when loading args * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected * Update note about next Community Sync, 2017-06-21 * types: fix marshalling of omitted "interfaces" key in IPConfig JSON * Update and document release process * scripts/release.sh: Add in s390x architecture * cnitool: add support for CNI_ARGS * README plugins list: add Linen CNI plugin - Remove the dependency with the cni-plugins - Recommend the cni-plugins - Make /var/lib/cni writable - Add snapper as a requirement, to provide mksubvolume - Use full/absolute path for mksubvolume - Change snapper Requires to a Requires(post) - Remove creating subvolumes. This should be in another package (kubernetes-kubelet) - Make use of %license macro - Refactor %license usage to a simpler form - Update to version 0.7.0: * Spec changes: + Use more RFC2119 style language in specification (must, should...) + add notes about ADD/DEL ordering + Make the container ID required and unique. + remove the version parameter from ADD and DEL commands. + Network interface name matters + be explicit about optional and required structure members + add CHECK method + Add a well-known error for "try again" + SPEC.md: clarify meaning of 'routes' * Library changes: + pkg/types: Makes IPAM concrete type + libcni: return error if Type is empty + skel: VERSION shouldn't block on stdin + non-pointer instances of types.Route now correctly marshal to JSON + libcni: add ValidateNetwork and ValidateNetworkList functions + pkg/skel: return error if JSON config has no network name + skel: add support for plugin version string + libcni: make exec handling an interface for better downstream testing + libcni: api now takes a Context to allow operations to be timed out or cancelled + types/version: add helper to parse PrevResult + skel: only print about message, not errors + skel,invoke,libcni: implementation of CHECK method + cnitool: Honor interface name supplied via CNI_IFNAME environment variable. + cnitool: validate correct number of args + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0 + add PrintTo method to Result interface + Return a better error when the plugin returns none - Install sleep binary into CNI plugin directory - Restore build.sh script which was removed upstream - Update to version 0.7.1 (bsc#1160460): * Library changes: + invoke : ensure custom envs of CNIArgs are prepended to process envs + add GetNetworkListCachedResult to CNI interface + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance * Documentation & Convention changes: + Update cnitool documentation for spec v0.4.0 + Add cni-route-override to CNI plugin list * Build and test changes: + Release: bump go to v1.12 - Set correct CNI version for 99-loopback.conf - Update to version 0.8.0: * Specification and Conventions changes + docs: add ips and mac to well-known capabilities + add interface name validation + Add GUID to well known Capabilities + Add DeviceID attribute to RuntimeConfig + Typo fixes for infiniband GUID + Fix linting issues in docs, add headers to json example, update errors into table * Documentation changes + Update cnitool docs + Remove extra ',' chars which makes conflist examples invalid. * libcni changes + Remove Result.String method + libcni: add config caching [v2] + clean up : fix staticcheck warnings + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir + skel: clean up errors in skel and add some well-known error codes + libcni: find plugin in exec + validate containerID and networkName + skel: remove needless functions and types + libcni: also cache IfName + libcni: fix cache file 'result' key name + Bump Go version to 1.13 + When CNI version isn't supplied in config, use default. + intercept netplugin std error + invoke: capture and return stderr if plugin exits unexpectedly + Retry exec commands on text file busy - Set GO111MODULE=auto to build with go1.16+ * Default changed to GO111MODULE=on in go1.16 * Set temporarily until using upstream release with go.mod * Drop BuildRequires: golang-packaging not currently using macros * Add BuildRequires: golang(API) >= 1.13 recommended dependency expression - use buildmode=pie (cnitool is installed into sbindir) - Update to version 0.8.1: * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206 - Tighten up plugin-finding logic (#811). - Update to version v1.0.1: * Rewritten spec + non-List configurations are removed + the version field in the interfaces array was redundant and is removed * libcni improvements - Employ RPM macros.go where feasible - Use vendor tarball - Remove ./build.sh - Update to version 1.1.2: * spec: fix format * libcni: handle empty version when parsing version * [exec-plugins]: support plugin lists This is a minor update to the CNI libraries and tooling. This does not bump the protocol / spec version, which remains at v1.0.0 - Update to version 0.5.0: * Documentation: Add conventions doc * noop: allow specifying debug file in config JSON * Spec/Conventions: Update to include plugin config * spec: add network configuration list specification * api,libcni: add network config list-based plugin chaining * Update CONVENTIONS.md * skel: adds PluginMainWithError which returns a *types.Error * testutils: pass netConf in for version operations; pass raw result out for tests * types: make Result an interface and move existing Result to separate package * macvlan/ipvlan: use common RenameLink method * plugins/flannel: organize test JSON alphabetically * pkg/ipam: add testcases * spec/plugins: return interface details and multiple IP addresses to runtime * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH * pkg/utils/sysctl/sysctl_linux.go: fix build tag. * pkg/utils/sysctl/sysctl_linux.go: fix typo. * invoke: Enable plugin file names with extensions * CONVENTIONS.md: Update details on port-mappings * Update with feedback * More markups * spec: Remove `routes` from Network Configuration * docs: consolidate host-local documentation * pkg/ns: refactored so that builds succeed on non-linux platforms * Fix grammar * plugins/main/ptp: set the Sandbox property on the response * README: List multus as 3rd party plugin * Replace Michael Bridgen with Bryan Boreham * pkg/ns, pkg/types: refactored non linux build fix code to * pkg/ip: refactored so that builds succeed on non-linux platforms * vendor: Update vishvanana/netlink dependency * libcni: up-convert a Config to a ConfigList when no other configs are found. * docs: CNI versioning for 0.3.0 upgrade * docs: Edits to v0.3.0 upgrade guidance * docs: minor improvements to 0.3.0 upgrade guidance * docs: add small upgrade instructions * docs: minor improvements to spec-upgrades * docs: fill-out and correct version conversion table * docs: table formatting is hard * pkg/testutils: return errors after restoring stdout * pkg/types: misc current types testcase cleanups * Minor rewording about default config version * spec,libcni: add support for injecting runtimeConfig into plugin stdin data * Check n.IPAM before use it in LoadIPAMConfig function * do not error if last_reserved_ip is missing for host local ipam * add test for ensuring initial subnet creation does not contain an error * fix unrelated failing tests - Update to version 0.5.1: * readme.md: Add link to community sync * pkg/ip: do not leak types from vendored netlink package * pkg/ip: SetupVeth returns net.Interface * pkg/ip: improve docstring for SetupVeth * Added Romana to list of CNI providers... * plugins/meta/flannel: If net config is missing do not return err on DEL * plugins/*: Don't error if the device doesn't exist - Update to version 0.5.2: * Rename build script to avoid conflict with bazel * Enable s390x build * Update community sync detail * Added entry for CNI-Genie * travis: shift forward to Go 1.8 and 1.7 * spec/plugins: fix 'ip'->'ips' in the spec, bump to 0.3.1 * libcni: Improved error messages. * libcni: Fixed tests that were checking error strings. * Documentation: Added documentation for `cnitool`. - Update to version 0.6.0: * Conventions: add convention around chaining interfaces * pkg/types: safer typecasting for TextUnmarshaler when loading args * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected * Update note about next Community Sync, 2017-06-21 * types: fix marshalling of omitted "interfaces" key in IPConfig JSON * Update and document release process * scripts/release.sh: Add in s390x architecture * cnitool: add support for CNI_ARGS * README plugins list: add Linen CNI plugin - Remove the dependency with the cni-plugins - Recommend the cni-plugins - Make /var/lib/cni writable - Add snapper as a requirement, to provide mksubvolume - Use full/absolute path for mksubvolume - Change snapper Requires to a Requires(post) - Remove creating subvolumes. This should be in another package (kubernetes-kubelet) - Make use of %license macro - Refactor %license usage to a simpler form - Update to version 0.7.0: * Spec changes: + Use more RFC2119 style language in specification (must, should...) + add notes about ADD/DEL ordering + Make the container ID required and unique. + remove the version parameter from ADD and DEL commands. + Network interface name matters + be explicit about optional and required structure members + add CHECK method + Add a well-known error for "try again" + SPEC.md: clarify meaning of 'routes' * Library changes: + pkg/types: Makes IPAM concrete type + libcni: return error if Type is empty + skel: VERSION shouldn't block on stdin + non-pointer instances of types.Route now correctly marshal to JSON + libcni: add ValidateNetwork and ValidateNetworkList functions + pkg/skel: return error if JSON config has no network name + skel: add support for plugin version string + libcni: make exec handling an interface for better downstream testing + libcni: api now takes a Context to allow operations to be timed out or cancelled + types/version: add helper to parse PrevResult + skel: only print about message, not errors + skel,invoke,libcni: implementation of CHECK method + cnitool: Honor interface name supplied via CNI_IFNAME environment variable. + cnitool: validate correct number of args + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0 + add PrintTo method to Result interface + Return a better error when the plugin returns none - Install sleep binary into CNI plugin directory - Restore build.sh script which was removed upstream - Update to version 0.7.1 (bsc#1160460): * Library changes: + invoke : ensure custom envs of CNIArgs are prepended to process envs + add GetNetworkListCachedResult to CNI interface + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance * Documentation & Convention changes: + Update cnitool documentation for spec v0.4.0 + Add cni-route-override to CNI plugin list * Build and test changes: + Release: bump go to v1.12 - Set correct CNI version for 99-loopback.conf - Update to version 0.8.0: * Specification and Conventions changes + docs: add ips and mac to well-known capabilities + add interface name validation + Add GUID to well known Capabilities + Add DeviceID attribute to RuntimeConfig + Typo fixes for infiniband GUID + Fix linting issues in docs, add headers to json example, update errors into table * Documentation changes + Update cnitool docs + Remove extra ',' chars which makes conflist examples invalid. * libcni changes + Remove Result.String method + libcni: add config caching [v2] + clean up : fix staticcheck warnings + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir + skel: clean up errors in skel and add some well-known error codes + libcni: find plugin in exec + validate containerID and networkName + skel: remove needless functions and types + libcni: also cache IfName + libcni: fix cache file 'result' key name + Bump Go version to 1.13 + When CNI version isn't supplied in config, use default. + intercept netplugin std error + invoke: capture and return stderr if plugin exits unexpectedly + Retry exec commands on text file busy - Set GO111MODULE=auto to build with go1.16+ * Default changed to GO111MODULE=on in go1.16 * Set temporarily until using upstream release with go.mod * Drop BuildRequires: golang-packaging not currently using macros * Add BuildRequires: golang(API) >= 1.13 recommended dependency expression - use buildmode=pie (cnitool is installed into sbindir) - Update to version 0.8.1: * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206 - Tighten up plugin-finding logic (#811). - Update to version v1.0.1: * Rewritten spec + non-List configurations are removed + the version field in the interfaces array was redundant and is removed * libcni improvements - Employ RPM macros.go where feasible - Use vendor tarball - Remove ./build.sh - Update to version 1.1.2: * spec: fix format * libcni: handle empty version when parsing version * [exec-plugins]: support plugin lists This is a minor update to the CNI libraries and tooling. This does not bump the protocol / spec version, which remains at v1.0.0 - Initial version from CNI plugins v0.6.0 - Install docs in the cni-plugins dir - Require cni - Make use of %license macro - Refactor %license usage to a simpler form - Updated to a supported version of Go (due to security reasons) - Updated plugins to v0.7.4: - Add host-device plugin, which simply moves a device from the host network namespace - Portmap now uses a more efficient rule structure - host-local can receive ranges as a RuntimeArgument - DHCP daemon can be containerized - DHCP now correctly parses routes - Various Windows build fixes - Waiting for DAD is skipped when possible - Bridge now uses a stable mac - Fix a regression where the interface's MAC address was no longer populated in the return type. - Updated plugins to v0.8.0: + New plugins: * bandwidth - limit incoming and outgoing bandwidth * firewall - add containers to firewall rules * sbr - convert container routes to source-based routes * static - assign a fixed IP address * win-bridge, win-overlay: Windows plugins + Plugin features / changelog: * CHECK Support * macvlan: - Allow to configure empty ipam for macvlan - Make master config optional * bridge: - Add vlan tag to the bridge cni plugin - Allow the user to assign VLAN tag - L2 bridge Implementation. * dhcp: - Include Subnet Mask option parameter in DHCPREQUEST - Add systemd unit file to activate socket with systemd - Add container ifName to the dhcp clientID, making the clientID value * flannel: - Pass through runtimeConfig to delegate * host-local: - host-local: add ifname to file tracking IP address used * host-device: - Support the IPAM in the host-device - Handle empty netns in DEL for loopback and host-device * tuning: - adds 'ip link' command related feature into tuning + Bug fixes & minor changes * Correctly DEL on ipam failure for all plugins * Fix bug on ip revert if cmdAdd fails on macvlan and host-device * host-device: Ensure device is down before rename * Fix -hostprefix option * some DHCP servers expect to request for explicit router options * bridge: release IP in case of error * change source of ipmasq rule from ipn to ip + Build fixes: * test: add coveralls support * plugins: correctly output build version, cosmetic cleanups * Move Windows tests to Travis - from version v0.7.5: + This release takes a minor change to the portmap plugin: * Portmap: append, rather than prepend, entry rules + This fixes a potential issue where firewall rules may be bypassed by port mapping - Include patch to fix the build on i586: + 0001_use_Go_facilities_to_get_a_socket.patch - Use new build_linux.sh script instead of removed build.sh - Updated plugins to v0.8.1: + Bugs: * bridge: fix ipMasq setup to use correct source address * fix compilation error on 386 * bandwidth: get bandwidth interface in host ns through container interface + Improvements: * Release: bump go to v1.12 * host-device: add pciBusID property - Drop patches merged upstream: + 0001_use_Go_facilities_to_get_a_socket.patch - Update plugins to v0.8.2 + New features: * Support "args" in static and tuning * Add Loopback DSR support, allow l2tunnel networks to be used with the l2bridge plugin * host-local: return error if same ADD request is seen twice * bandwidth: fix collisions * Support ips capability in static and mac capability in tuning * pkg/veth: Make host-side veth name configurable + Bug fixes: * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists * host-device: revert name setting to make retries idempotent (#357). * Vendor update go-iptables. Vendor update go-iptables to obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10 * Update go.mod & go.sub * Remove link Down/Up in MAC address change to prevent route flush (#364). * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall error message is "invalid argument" not "file exists" * bump containernetworking/cni to v0.7.1 - Update to version 0.8.3: * Enhancements: * static: prioritize the input sources for IPs (#400). * tuning: send gratuitous ARP in case of MAC address update (#403). * bandwidth: use uint64 for Bandwidth value (#389). * ptp: only override DNS conf if DNS settings provided (#388). * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383). * loopback support CNI CHECK and result cache (#374). * Better input validation: * vlan: add MTU validation to loadNetConf (#405). * macvlan: add MTU validation to loadNetConf (#404). * bridge: check vlan id when loading net conf (#394). * Bugfixes: * bugfix: defer after err check, or it may panic (#391). * portmap: Fix dual-stack support (#379). * firewall: don't return error in DEL if prevResult is not found (#390). * bump up libcni back to v0.7.1 (#377). * Tests: * integration: fix ip address collision in integration tests (#409). * testutils: newNS() works in a rootless user namespace (#401). * Bump Go version (#386). * Cleanup netns after test suite (#375). * Docs: * contributing doc: revise test script name to run (#396). * contributing doc: describe cnitool installation (#397). - Update to version 0.8.4 (bsc#1160460): * add support for mips64le * Add missing cniVersion in README example * bump go-iptables module to v0.4.5 * iptables: add idempotent functions * portmap doesn't fail if chain doesn't exist * fix portmap port forward flakiness * Add Bruce Ma and Piotr Skarmuk as owners - Update to version 0.8.6 (bsc#1172410 CVE-2020-10749) * New features * Support device id in host device plugin (#471). * win-bridge: add support for portMappings capability (#475). * Make host-device to work with virtio net device (#453). * Small improvements * ptp, bridge: disable accept_ra on the host-side interface (#484). * modify the error url of windowscontainer (#460). * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin rule only allow the * container itself to access the ports it is exposing thru the host IP. Other containers in the same subnet might also want to access this service via the host IP, so apply this rule to the whole subnet instead of just for the container. * Unlock OS thread after netns is restored (#455). * Bugfixes * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used which routed an entire cidr based on source, not only the bound address. * check bridge's port state (#468). fix #463 * Reset the route flag before moving the rule (#472). * replace juju/errors because of CNCF license scan (#458). ref to #457 * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin. The IPv6 address check loops over IPv4 addresses. - from version 0.8.5 * Bugfixes * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING (#434) fixes #370. * vlan: Fix vlan plugin returning error when device is already removed (#438). * Improvements * sysctl: Improve support of sysctl name separators (#437). - Update to version 0.8.7: * Fix race condition in GetCurrentNS * lo: CNI_IFNAME is no longer ignored * cni: bump to 0.8.0 * Bump Go version to 1.13 and 1.14 * Add contact info * Update firewall README.md CNI-ADMIN * firewall: fix some typos in docs * portmap DEL noop if no portMappings present * flannel: remove net conf file after DEL succeed - Update to version 0.9.0: * tuning: revert values on delete (#540) * go mod tidy * bump to go 1.15 * Add ability to trigger retests via comments * pkg/ns: fix test case to tolerate pids going away. * Add github build & test actions * bridge: fix testcase to check addresses we care about * Remove travis. * vendor: bump ginkgo, gover * portmap plugin should flush previous udp connections * Updating plugin README.md files (#549) * update netlink dependencies * Xdhcp: fix example configuration * VRF: extend supported version to 0.3.1 too. * VRF CNI: Add an optional table parameter. * Add more tests for the vrf cni plugin. * Update github.com/vishvananda/netlink to v1.1.0 * Introduce a new VRF CNI meta plugin. * Travis: run tests on arm64 * Replace nc with the local echo client. * Add an echo client to be used instead of nc. * Bump up the ubuntu version used in CI to bionic. * flannel: allow input ipam parameters as basis for delegate * ipvlan: make master config as optional * Remove extraneous test file in Windows plugin - Update to version 0.9.1: * ipam/dhcp: Add broadcast flag * add flannel to support dual stack ip * bandwidth: fix panic in tests * host-device: Add support for DPDK device * [main/vlan] Fix error handling for delegate IPAM plugin * dhcp: default dhcp clien timeout is 10s * vlan: fix error message text by removing ptp references * dhcp: daemon dhcp client timeout is configurable * dhcp: timeout value is set in DHCP daemon * remove unused function * deps: go mod tidy coreos/go-iptables * deps: bump coreos/go-iptables - Update to version 1.1.1: * ipam/dhcp: Fix client id in renew/release * call ipam.ExceDel after clean up device in netns fix #666 * portmap: fix checkPorts result when chain does not exist * portmap: fix bug that new udp connection deletes all existing conntrack entries * Enhanced dad set to 1 * Add boolean to enable/disable dad * Disable DAD for container side veth * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker * Fix host-device gofmt * host-device: Bring interfaces up after moving into container * pkg/ns: use file system magic numbers from golang.org/x/sys/unix * gofmt * go mod tidy * build: bump to go 1.17 * Remove arp notify setting per comment * plugins: replace arping package with arp_notify * fix #685 * Ran go fmt so tests would pass * Fixed DHCP problem that broke when fast retry was added. * dhcp ipam: adjust retry mechanism * add ipam tests for dpdk device * add ipam support for dpdk device * ipvlan: Send Gratuitous ARP after IPs are set * dhcp ipam: fix client id * dhcp ipam: rename inconsistent options among files * dhcp ipam: add more options capable for sending * dhcp ipam: add fast retry * dhcp ipam: support customizing dhcp options * dhcp ipam: truncate client id to 254 bytes * dhcp ipam: print error correctly without format string * dhcp ipam: using full config to regular the code * Allow setting sysctls on a particular interface * dhcp: remove implemented TODO * Don't redundantly filepath.Clean the output of filepath.Join * Use crypto/rand.Read, not crypto.Reader.Read * bridge: Add macspoofchk support * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped * vendor: bump to libcni v1.0.1 * static ipam: do not parse the CIDR twice * static ipam: improve error msgs when provisioning invalid CIDR * bump go to 1.16, other misc fixes * vendor: bump all direct dependencies * vendor: bump to libcni v1.0 * docs: Update the CI badge from Travis CI to GitHub Actions * bridge: Fix typo in error message for promiscuous mode * ip: place veth peer in host namspace directly * bridge: Add mac field to specify container iface mac * static ipam: decide wrong cidr error msg * static ipam: stop wrapping net.ParseCIDR errors * static ipam: show confusing error msg * utils, hwaddr: Remove unused package * ip, link_linux: Remove unused SetHWAddrByIP function * plugins: remove flannel * refactor(win-bridge): netconf * refactor(win-bridge): hcn api processing * refactor(win-bridge): hns api processing * chore(win-bridge): location related * chore(win-bridge): text related * Remove Bryan Boreham as maintainer * host-local: support ip/prefix in env args and CNI args * [sbr]: Use different tableID for every ipCfg Check tableID not in use for every ipCfg * Small typo improves in README.md * Allow multiple routes to be added for the same prefix. Enables ECMP * Update to lastest vendor/github.com/vishvananda/netlink * tuning: always update MAC in CNI result * vendor: bump to libcni v1.0-rc1 * tuning: Add support of altering the allmulticast flag * [sbr]: Use different tableID for every ipCfg Move default table routes which match the ipCfg config * Fix nil-pointer check * host-local: support custom IPs allocation through runtime configuration * pkg/ip: introduce a new type `IP` to support formated <ip>[/<prefix>] * go.mod: github.com/j-keck/arping v1.0.1 * go.mod: github.com/buger/jsonparser v1.1.1 * go.mod: github.com/alexflint/go-filemutex v1.1.0 * go.mod github.com/Microsoft/hcsshim v0.8.16 * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0 * go.mod: github.com/mattn/go-shellwords v1.0.11 * go.mod: github.com/sirupsen/logrus v1.8.1 * CI: Install linux-modules-extra for VRF module * Fix broken links to online docs in plugin READMEs * gha: update actions/setup-go@v2 * remove redundant startRange in RangeIter due to overlap check on multi ranges * fix(win-bridge): panic while calling HNS api * portmap: use slashes in sysctl template to support interface names which separated by dots * pkg/ipam: use slash as sysctl separator so interface name can have dot * [macvlan] Stop setting proxy-arp on macvlan interface * tuning: increase test coverage to 1.0.0 and older spec versions * portmap: increase test coverage to 1.0.0 and older spec versions * flannel: increase test coverage to 1.0.0 and older spec versions * firewall: increase test coverage to 1.0.0 and older spec versions * bandwidth: increase test coverage to 1.0.0 and older spec versions * host-local: increase test coverage to 1.0.0 and older spec versions * static: increase test coverage to 1.0.0 and older spec versions * dhcp: increase test coverage to 1.0.0 and older spec versions * dhcp: add -resendmax option to limit lease acquisition time for testcases * vlan: increase test coverage to 1.0.0 and older spec versions * ptp: increase test coverage to 1.0.0 and older spec versions * macvlan: increase test coverage to 1.0.0 and older spec versions * loopback: increase test coverage to 1.0.0 and older spec versions * ipvlan: increase test coverage to 1.0.0 and older spec versions * host-device: increase test coverage to 1.0.0 and older spec versions * bridge: increase test coverage to 1.0.0 and older spec versions * bridge: simplify version-based testcase code * testutils: add test utilities for spec version features * plugins: update to spec version 1.0.0 * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206) - Drop %go_nostrip - Initial version from CNI plugins v0.6.0 - Install docs in the cni-plugins dir - Require cni - Make use of %license macro - Refactor %license usage to a simpler form - Updated to a supported version of Go (due to security reasons) - Updated plugins to v0.7.4: - Add host-device plugin, which simply moves a device from the host network namespace - Portmap now uses a more efficient rule structure - host-local can receive ranges as a RuntimeArgument - DHCP daemon can be containerized - DHCP now correctly parses routes - Various Windows build fixes - Waiting for DAD is skipped when possible - Bridge now uses a stable mac - Fix a regression where the interface's MAC address was no longer populated in the return type. - Updated plugins to v0.8.0: + New plugins: * bandwidth - limit incoming and outgoing bandwidth * firewall - add containers to firewall rules * sbr - convert container routes to source-based routes * static - assign a fixed IP address * win-bridge, win-overlay: Windows plugins + Plugin features / changelog: * CHECK Support * macvlan: - Allow to configure empty ipam for macvlan - Make master config optional * bridge: - Add vlan tag to the bridge cni plugin - Allow the user to assign VLAN tag - L2 bridge Implementation. * dhcp: - Include Subnet Mask option parameter in DHCPREQUEST - Add systemd unit file to activate socket with systemd - Add container ifName to the dhcp clientID, making the clientID value * flannel: - Pass through runtimeConfig to delegate * host-local: - host-local: add ifname to file tracking IP address used * host-device: - Support the IPAM in the host-device - Handle empty netns in DEL for loopback and host-device * tuning: - adds 'ip link' command related feature into tuning + Bug fixes & minor changes * Correctly DEL on ipam failure for all plugins * Fix bug on ip revert if cmdAdd fails on macvlan and host-device * host-device: Ensure device is down before rename * Fix -hostprefix option * some DHCP servers expect to request for explicit router options * bridge: release IP in case of error * change source of ipmasq rule from ipn to ip + Build fixes: * test: add coveralls support * plugins: correctly output build version, cosmetic cleanups * Move Windows tests to Travis - from version v0.7.5: + This release takes a minor change to the portmap plugin: * Portmap: append, rather than prepend, entry rules + This fixes a potential issue where firewall rules may be bypassed by port mapping - Include patch to fix the build on i586: + 0001_use_Go_facilities_to_get_a_socket.patch - Use new build_linux.sh script instead of removed build.sh - Updated plugins to v0.8.1: + Bugs: * bridge: fix ipMasq setup to use correct source address * fix compilation error on 386 * bandwidth: get bandwidth interface in host ns through container interface + Improvements: * Release: bump go to v1.12 * host-device: add pciBusID property - Drop patches merged upstream: + 0001_use_Go_facilities_to_get_a_socket.patch - Update plugins to v0.8.2 + New features: * Support "args" in static and tuning * Add Loopback DSR support, allow l2tunnel networks to be used with the l2bridge plugin * host-local: return error if same ADD request is seen twice * bandwidth: fix collisions * Support ips capability in static and mac capability in tuning * pkg/veth: Make host-side veth name configurable + Bug fixes: * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists * host-device: revert name setting to make retries idempotent (#357). * Vendor update go-iptables. Vendor update go-iptables to obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10 * Update go.mod & go.sub * Remove link Down/Up in MAC address change to prevent route flush (#364). * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall error message is "invalid argument" not "file exists" * bump containernetworking/cni to v0.7.1 - Update to version 0.8.3: * Enhancements: * static: prioritize the input sources for IPs (#400). * tuning: send gratuitous ARP in case of MAC address update (#403). * bandwidth: use uint64 for Bandwidth value (#389). * ptp: only override DNS conf if DNS settings provided (#388). * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383). * loopback support CNI CHECK and result cache (#374). * Better input validation: * vlan: add MTU validation to loadNetConf (#405). * macvlan: add MTU validation to loadNetConf (#404). * bridge: check vlan id when loading net conf (#394). * Bugfixes: * bugfix: defer after err check, or it may panic (#391). * portmap: Fix dual-stack support (#379). * firewall: don't return error in DEL if prevResult is not found (#390). * bump up libcni back to v0.7.1 (#377). * Tests: * integration: fix ip address collision in integration tests (#409). * testutils: newNS() works in a rootless user namespace (#401). * Bump Go version (#386). * Cleanup netns after test suite (#375). * Docs: * contributing doc: revise test script name to run (#396). * contributing doc: describe cnitool installation (#397). - Update to version 0.8.4 (bsc#1160460): * add support for mips64le * Add missing cniVersion in README example * bump go-iptables module to v0.4.5 * iptables: add idempotent functions * portmap doesn't fail if chain doesn't exist * fix portmap port forward flakiness * Add Bruce Ma and Piotr Skarmuk as owners - Update to version 0.8.6 (bsc#1172410 CVE-2020-10749) * New features * Support device id in host device plugin (#471). * win-bridge: add support for portMappings capability (#475). * Make host-device to work with virtio net device (#453). * Small improvements * ptp, bridge: disable accept_ra on the host-side interface (#484). * modify the error url of windowscontainer (#460). * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin rule only allow the * container itself to access the ports it is exposing thru the host IP. Other containers in the same subnet might also want to access this service via the host IP, so apply this rule to the whole subnet instead of just for the container. * Unlock OS thread after netns is restored (#455). * Bugfixes * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used which routed an entire cidr based on source, not only the bound address. * check bridge's port state (#468). fix #463 * Reset the route flag before moving the rule (#472). * replace juju/errors because of CNCF license scan (#458). ref to #457 * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin. The IPv6 address check loops over IPv4 addresses. - from version 0.8.5 * Bugfixes * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING (#434) fixes #370. * vlan: Fix vlan plugin returning error when device is already removed (#438). * Improvements * sysctl: Improve support of sysctl name separators (#437). - Update to version 0.8.7: * Fix race condition in GetCurrentNS * lo: CNI_IFNAME is no longer ignored * cni: bump to 0.8.0 * Bump Go version to 1.13 and 1.14 * Add contact info * Update firewall README.md CNI-ADMIN * firewall: fix some typos in docs * portmap DEL noop if no portMappings present * flannel: remove net conf file after DEL succeed - Update to version 0.9.0: * tuning: revert values on delete (#540) * go mod tidy * bump to go 1.15 * Add ability to trigger retests via comments * pkg/ns: fix test case to tolerate pids going away. * Add github build & test actions * bridge: fix testcase to check addresses we care about * Remove travis. * vendor: bump ginkgo, gover * portmap plugin should flush previous udp connections * Updating plugin README.md files (#549) * update netlink dependencies * Xdhcp: fix example configuration * VRF: extend supported version to 0.3.1 too. * VRF CNI: Add an optional table parameter. * Add more tests for the vrf cni plugin. * Update github.com/vishvananda/netlink to v1.1.0 * Introduce a new VRF CNI meta plugin. * Travis: run tests on arm64 * Replace nc with the local echo client. * Add an echo client to be used instead of nc. * Bump up the ubuntu version used in CI to bionic. * flannel: allow input ipam parameters as basis for delegate * ipvlan: make master config as optional * Remove extraneous test file in Windows plugin - Update to version 0.9.1: * ipam/dhcp: Add broadcast flag * add flannel to support dual stack ip * bandwidth: fix panic in tests * host-device: Add support for DPDK device * [main/vlan] Fix error handling for delegate IPAM plugin * dhcp: default dhcp clien timeout is 10s * vlan: fix error message text by removing ptp references * dhcp: daemon dhcp client timeout is configurable * dhcp: timeout value is set in DHCP daemon * remove unused function * deps: go mod tidy coreos/go-iptables * deps: bump coreos/go-iptables - Update to version 1.1.1: * ipam/dhcp: Fix client id in renew/release * call ipam.ExceDel after clean up device in netns fix #666 * portmap: fix checkPorts result when chain does not exist * portmap: fix bug that new udp connection deletes all existing conntrack entries * Enhanced dad set to 1 * Add boolean to enable/disable dad * Disable DAD for container side veth * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker * Fix host-device gofmt * host-device: Bring interfaces up after moving into container * pkg/ns: use file system magic numbers from golang.org/x/sys/unix * gofmt * go mod tidy * build: bump to go 1.17 * Remove arp notify setting per comment * plugins: replace arping package with arp_notify * fix #685 * Ran go fmt so tests would pass * Fixed DHCP problem that broke when fast retry was added. * dhcp ipam: adjust retry mechanism * add ipam tests for dpdk device * add ipam support for dpdk device * ipvlan: Send Gratuitous ARP after IPs are set * dhcp ipam: fix client id * dhcp ipam: rename inconsistent options among files * dhcp ipam: add more options capable for sending * dhcp ipam: add fast retry * dhcp ipam: support customizing dhcp options * dhcp ipam: truncate client id to 254 bytes * dhcp ipam: print error correctly without format string * dhcp ipam: using full config to regular the code * Allow setting sysctls on a particular interface * dhcp: remove implemented TODO * Don't redundantly filepath.Clean the output of filepath.Join * Use crypto/rand.Read, not crypto.Reader.Read * bridge: Add macspoofchk support * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped * vendor: bump to libcni v1.0.1 * static ipam: do not parse the CIDR twice * static ipam: improve error msgs when provisioning invalid CIDR * bump go to 1.16, other misc fixes * vendor: bump all direct dependencies * vendor: bump to libcni v1.0 * docs: Update the CI badge from Travis CI to GitHub Actions * bridge: Fix typo in error message for promiscuous mode * ip: place veth peer in host namspace directly * bridge: Add mac field to specify container iface mac * static ipam: decide wrong cidr error msg * static ipam: stop wrapping net.ParseCIDR errors * static ipam: show confusing error msg * utils, hwaddr: Remove unused package * ip, link_linux: Remove unused SetHWAddrByIP function * plugins: remove flannel * refactor(win-bridge): netconf * refactor(win-bridge): hcn api processing * refactor(win-bridge): hns api processing * chore(win-bridge): location related * chore(win-bridge): text related * Remove Bryan Boreham as maintainer * host-local: support ip/prefix in env args and CNI args * [sbr]: Use different tableID for every ipCfg Check tableID not in use for every ipCfg * Small typo improves in README.md * Allow multiple routes to be added for the same prefix. Enables ECMP * Update to lastest vendor/github.com/vishvananda/netlink * tuning: always update MAC in CNI result * vendor: bump to libcni v1.0-rc1 * tuning: Add support of altering the allmulticast flag * [sbr]: Use different tableID for every ipCfg Move default table routes which match the ipCfg config * Fix nil-pointer check * host-local: support custom IPs allocation through runtime configuration * pkg/ip: introduce a new type `IP` to support formated <ip>[/<prefix>] * go.mod: github.com/j-keck/arping v1.0.1 * go.mod: github.com/buger/jsonparser v1.1.1 * go.mod: github.com/alexflint/go-filemutex v1.1.0 * go.mod github.com/Microsoft/hcsshim v0.8.16 * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0 * go.mod: github.com/mattn/go-shellwords v1.0.11 * go.mod: github.com/sirupsen/logrus v1.8.1 * CI: Install linux-modules-extra for VRF module * Fix broken links to online docs in plugin READMEs * gha: update actions/setup-go@v2 * remove redundant startRange in RangeIter due to overlap check on multi ranges * fix(win-bridge): panic while calling HNS api * portmap: use slashes in sysctl template to support interface names which separated by dots * pkg/ipam: use slash as sysctl separator so interface name can have dot * [macvlan] Stop setting proxy-arp on macvlan interface * tuning: increase test coverage to 1.0.0 and older spec versions * portmap: increase test coverage to 1.0.0 and older spec versions * flannel: increase test coverage to 1.0.0 and older spec versions * firewall: increase test coverage to 1.0.0 and older spec versions * bandwidth: increase test coverage to 1.0.0 and older spec versions * host-local: increase test coverage to 1.0.0 and older spec versions * static: increase test coverage to 1.0.0 and older spec versions * dhcp: increase test coverage to 1.0.0 and older spec versions * dhcp: add -resendmax option to limit lease acquisition time for testcases * vlan: increase test coverage to 1.0.0 and older spec versions * ptp: increase test coverage to 1.0.0 and older spec versions * macvlan: increase test coverage to 1.0.0 and older spec versions * loopback: increase test coverage to 1.0.0 and older spec versions * ipvlan: increase test coverage to 1.0.0 and older spec versions * host-device: increase test coverage to 1.0.0 and older spec versions * bridge: increase test coverage to 1.0.0 and older spec versions * bridge: simplify version-based testcase code * testutils: add test utilities for spec version features * plugins: update to spec version 1.0.0 * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206) - Drop %go_nostrip - Initial version from CNI plugins v0.6.0 - Install docs in the cni-plugins dir - Require cni - Make use of %license macro - Refactor %license usage to a simpler form - Updated to a supported version of Go (due to security reasons) - Updated plugins to v0.7.4: - Add host-device plugin, which simply moves a device from the host network namespace - Portmap now uses a more efficient rule structure - host-local can receive ranges as a RuntimeArgument - DHCP daemon can be containerized - DHCP now correctly parses routes - Various Windows build fixes - Waiting for DAD is skipped when possible - Bridge now uses a stable mac - Fix a regression where the interface's MAC address was no longer populated in the return type. - Updated plugins to v0.8.0: + New plugins: * bandwidth - limit incoming and outgoing bandwidth * firewall - add containers to firewall rules * sbr - convert container routes to source-based routes * static - assign a fixed IP address * win-bridge, win-overlay: Windows plugins + Plugin features / changelog: * CHECK Support * macvlan: - Allow to configure empty ipam for macvlan - Make master config optional * bridge: - Add vlan tag to the bridge cni plugin - Allow the user to assign VLAN tag - L2 bridge Implementation. * dhcp: - Include Subnet Mask option parameter in DHCPREQUEST - Add systemd unit file to activate socket with systemd - Add container ifName to the dhcp clientID, making the clientID value * flannel: - Pass through runtimeConfig to delegate * host-local: - host-local: add ifname to file tracking IP address used * host-device: - Support the IPAM in the host-device - Handle empty netns in DEL for loopback and host-device * tuning: - adds 'ip link' command related feature into tuning + Bug fixes & minor changes * Correctly DEL on ipam failure for all plugins * Fix bug on ip revert if cmdAdd fails on macvlan and host-device * host-device: Ensure device is down before rename * Fix -hostprefix option * some DHCP servers expect to request for explicit router options * bridge: release IP in case of error * change source of ipmasq rule from ipn to ip + Build fixes: * test: add coveralls support * plugins: correctly output build version, cosmetic cleanups * Move Windows tests to Travis - from version v0.7.5: + This release takes a minor change to the portmap plugin: * Portmap: append, rather than prepend, entry rules + This fixes a potential issue where firewall rules may be bypassed by port mapping - Include patch to fix the build on i586: + 0001_use_Go_facilities_to_get_a_socket.patch - Use new build_linux.sh script instead of removed build.sh - Updated plugins to v0.8.1: + Bugs: * bridge: fix ipMasq setup to use correct source address * fix compilation error on 386 * bandwidth: get bandwidth interface in host ns through container interface + Improvements: * Release: bump go to v1.12 * host-device: add pciBusID property - Drop patches merged upstream: + 0001_use_Go_facilities_to_get_a_socket.patch - Update plugins to v0.8.2 + New features: * Support "args" in static and tuning * Add Loopback DSR support, allow l2tunnel networks to be used with the l2bridge plugin * host-local: return error if same ADD request is seen twice * bandwidth: fix collisions * Support ips capability in static and mac capability in tuning * pkg/veth: Make host-side veth name configurable + Bug fixes: * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists * host-device: revert name setting to make retries idempotent (#357). * Vendor update go-iptables. Vendor update go-iptables to obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10 * Update go.mod & go.sub * Remove link Down/Up in MAC address change to prevent route flush (#364). * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall error message is "invalid argument" not "file exists" * bump containernetworking/cni to v0.7.1 - Update to version 0.8.3: * Enhancements: * static: prioritize the input sources for IPs (#400). * tuning: send gratuitous ARP in case of MAC address update (#403). * bandwidth: use uint64 for Bandwidth value (#389). * ptp: only override DNS conf if DNS settings provided (#388). * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383). * loopback support CNI CHECK and result cache (#374). * Better input validation: * vlan: add MTU validation to loadNetConf (#405). * macvlan: add MTU validation to loadNetConf (#404). * bridge: check vlan id when loading net conf (#394). * Bugfixes: * bugfix: defer after err check, or it may panic (#391). * portmap: Fix dual-stack support (#379). * firewall: don't return error in DEL if prevResult is not found (#390). * bump up libcni back to v0.7.1 (#377). * Tests: * integration: fix ip address collision in integration tests (#409). * testutils: newNS() works in a rootless user namespace (#401). * Bump Go version (#386). * Cleanup netns after test suite (#375). * Docs: * contributing doc: revise test script name to run (#396). * contributing doc: describe cnitool installation (#397). - Update to version 0.8.4 (bsc#1160460): * add support for mips64le * Add missing cniVersion in README example * bump go-iptables module to v0.4.5 * iptables: add idempotent functions * portmap doesn't fail if chain doesn't exist * fix portmap port forward flakiness * Add Bruce Ma and Piotr Skarmuk as owners - Update to version 0.8.6 (bsc#1172410 CVE-2020-10749) * New features * Support device id in host device plugin (#471). * win-bridge: add support for portMappings capability (#475). * Make host-device to work with virtio net device (#453). * Small improvements * ptp, bridge: disable accept_ra on the host-side interface (#484). * modify the error url of windowscontainer (#460). * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin rule only allow the * container itself to access the ports it is exposing thru the host IP. Other containers in the same subnet might also want to access this service via the host IP, so apply this rule to the whole subnet instead of just for the container. * Unlock OS thread after netns is restored (#455). * Bugfixes * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used which routed an entire cidr based on source, not only the bound address. * check bridge's port state (#468). fix #463 * Reset the route flag before moving the rule (#472). * replace juju/errors because of CNCF license scan (#458). ref to #457 * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin. The IPv6 address check loops over IPv4 addresses. - from version 0.8.5 * Bugfixes * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING (#434) fixes #370. * vlan: Fix vlan plugin returning error when device is already removed (#438). * Improvements * sysctl: Improve support of sysctl name separators (#437). - Update to version 0.8.7: * Fix race condition in GetCurrentNS * lo: CNI_IFNAME is no longer ignored * cni: bump to 0.8.0 * Bump Go version to 1.13 and 1.14 * Add contact info * Update firewall README.md CNI-ADMIN * firewall: fix some typos in docs * portmap DEL noop if no portMappings present * flannel: remove net conf file after DEL succeed - Update to version 0.9.0: * tuning: revert values on delete (#540) * go mod tidy * bump to go 1.15 * Add ability to trigger retests via comments * pkg/ns: fix test case to tolerate pids going away. * Add github build & test actions * bridge: fix testcase to check addresses we care about * Remove travis. * vendor: bump ginkgo, gover * portmap plugin should flush previous udp connections * Updating plugin README.md files (#549) * update netlink dependencies * Xdhcp: fix example configuration * VRF: extend supported version to 0.3.1 too. * VRF CNI: Add an optional table parameter. * Add more tests for the vrf cni plugin. * Update github.com/vishvananda/netlink to v1.1.0 * Introduce a new VRF CNI meta plugin. * Travis: run tests on arm64 * Replace nc with the local echo client. * Add an echo client to be used instead of nc. * Bump up the ubuntu version used in CI to bionic. * flannel: allow input ipam parameters as basis for delegate * ipvlan: make master config as optional * Remove extraneous test file in Windows plugin - Update to version 0.9.1: * ipam/dhcp: Add broadcast flag * add flannel to support dual stack ip * bandwidth: fix panic in tests * host-device: Add support for DPDK device * [main/vlan] Fix error handling for delegate IPAM plugin * dhcp: default dhcp clien timeout is 10s * vlan: fix error message text by removing ptp references * dhcp: daemon dhcp client timeout is configurable * dhcp: timeout value is set in DHCP daemon * remove unused function * deps: go mod tidy coreos/go-iptables * deps: bump coreos/go-iptables - Update to version 1.1.1: * ipam/dhcp: Fix client id in renew/release * call ipam.ExceDel after clean up device in netns fix #666 * portmap: fix checkPorts result when chain does not exist * portmap: fix bug that new udp connection deletes all existing conntrack entries * Enhanced dad set to 1 * Add boolean to enable/disable dad * Disable DAD for container side veth * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker * Fix host-device gofmt * host-device: Bring interfaces up after moving into container * pkg/ns: use file system magic numbers from golang.org/x/sys/unix * gofmt * go mod tidy * build: bump to go 1.17 * Remove arp notify setting per comment * plugins: replace arping package with arp_notify * fix #685 * Ran go fmt so tests would pass * Fixed DHCP problem that broke when fast retry was added. * dhcp ipam: adjust retry mechanism * add ipam tests for dpdk device * add ipam support for dpdk device * ipvlan: Send Gratuitous ARP after IPs are set * dhcp ipam: fix client id * dhcp ipam: rename inconsistent options among files * dhcp ipam: add more options capable for sending * dhcp ipam: add fast retry * dhcp ipam: support customizing dhcp options * dhcp ipam: truncate client id to 254 bytes * dhcp ipam: print error correctly without format string * dhcp ipam: using full config to regular the code * Allow setting sysctls on a particular interface * dhcp: remove implemented TODO * Don't redundantly filepath.Clean the output of filepath.Join * Use crypto/rand.Read, not crypto.Reader.Read * bridge: Add macspoofchk support * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped * vendor: bump to libcni v1.0.1 * static ipam: do not parse the CIDR twice * static ipam: improve error msgs when provisioning invalid CIDR * bump go to 1.16, other misc fixes * vendor: bump all direct dependencies * vendor: bump to libcni v1.0 * docs: Update the CI badge from Travis CI to GitHub Actions * bridge: Fix typo in error message for promiscuous mode * ip: place veth peer in host namspace directly * bridge: Add mac field to specify container iface mac * static ipam: decide wrong cidr error msg * static ipam: stop wrapping net.ParseCIDR errors * static ipam: show confusing error msg * utils, hwaddr: Remove unused package * ip, link_linux: Remove unused SetHWAddrByIP function * plugins: remove flannel * refactor(win-bridge): netconf * refactor(win-bridge): hcn api processing * refactor(win-bridge): hns api processing * chore(win-bridge): location related * chore(win-bridge): text related * Remove Bryan Boreham as maintainer * host-local: support ip/prefix in env args and CNI args * [sbr]: Use different tableID for every ipCfg Check tableID not in use for every ipCfg * Small typo improves in README.md * Allow multiple routes to be added for the same prefix. Enables ECMP * Update to lastest vendor/github.com/vishvananda/netlink * tuning: always update MAC in CNI result * vendor: bump to libcni v1.0-rc1 * tuning: Add support of altering the allmulticast flag * [sbr]: Use different tableID for every ipCfg Move default table routes which match the ipCfg config * Fix nil-pointer check * host-local: support custom IPs allocation through runtime configuration * pkg/ip: introduce a new type `IP` to support formated <ip>[/<prefix>] * go.mod: github.com/j-keck/arping v1.0.1 * go.mod: github.com/buger/jsonparser v1.1.1 * go.mod: github.com/alexflint/go-filemutex v1.1.0 * go.mod github.com/Microsoft/hcsshim v0.8.16 * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0 * go.mod: github.com/mattn/go-shellwords v1.0.11 * go.mod: github.com/sirupsen/logrus v1.8.1 * CI: Install linux-modules-extra for VRF module * Fix broken links to online docs in plugin READMEs * gha: update actions/setup-go@v2 * remove redundant startRange in RangeIter due to overlap check on multi ranges * fix(win-bridge): panic while calling HNS api * portmap: use slashes in sysctl template to support interface names which separated by dots * pkg/ipam: use slash as sysctl separator so interface name can have dot * [macvlan] Stop setting proxy-arp on macvlan interface * tuning: increase test coverage to 1.0.0 and older spec versions * portmap: increase test coverage to 1.0.0 and older spec versions * flannel: increase test coverage to 1.0.0 and older spec versions * firewall: increase test coverage to 1.0.0 and older spec versions * bandwidth: increase test coverage to 1.0.0 and older spec versions * host-local: increase test coverage to 1.0.0 and older spec versions * static: increase test coverage to 1.0.0 and older spec versions * dhcp: increase test coverage to 1.0.0 and older spec versions * dhcp: add -resendmax option to limit lease acquisition time for testcases * vlan: increase test coverage to 1.0.0 and older spec versions * ptp: increase test coverage to 1.0.0 and older spec versions * macvlan: increase test coverage to 1.0.0 and older spec versions * loopback: increase test coverage to 1.0.0 and older spec versions * ipvlan: increase test coverage to 1.0.0 and older spec versions * host-device: increase test coverage to 1.0.0 and older spec versions * bridge: increase test coverage to 1.0.0 and older spec versions * bridge: simplify version-based testcase code * testutils: add test utilities for spec version features * plugins: update to spec version 1.0.0 * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206) - Drop %go_nostrip - Initial version from CNI plugins v0.6.0 - Install docs in the cni-plugins dir - Require cni - Make use of %license macro - Refactor %license usage to a simpler form - Updated to a supported version of Go (due to security reasons) - Updated plugins to v0.7.4: - Add host-device plugin, which simply moves a device from the host network namespace - Portmap now uses a more efficient rule structure - host-local can receive ranges as a RuntimeArgument - DHCP daemon can be containerized - DHCP now correctly parses routes - Various Windows build fixes - Waiting for DAD is skipped when possible - Bridge now uses a stable mac - Fix a regression where the interface's MAC address was no longer populated in the return type. - Updated plugins to v0.8.0: + New plugins: * bandwidth - limit incoming and outgoing bandwidth * firewall - add containers to firewall rules * sbr - convert container routes to source-based routes * static - assign a fixed IP address * win-bridge, win-overlay: Windows plugins + Plugin features / changelog: * CHECK Support * macvlan: - Allow to configure empty ipam for macvlan - Make master config optional * bridge: - Add vlan tag to the bridge cni plugin - Allow the user to assign VLAN tag - L2 bridge Implementation. * dhcp: - Include Subnet Mask option parameter in DHCPREQUEST - Add systemd unit file to activate socket with systemd - Add container ifName to the dhcp clientID, making the clientID value * flannel: - Pass through runtimeConfig to delegate * host-local: - host-local: add ifname to file tracking IP address used * host-device: - Support the IPAM in the host-device - Handle empty netns in DEL for loopback and host-device * tuning: - adds 'ip link' command related feature into tuning + Bug fixes & minor changes * Correctly DEL on ipam failure for all plugins * Fix bug on ip revert if cmdAdd fails on macvlan and host-device * host-device: Ensure device is down before rename * Fix -hostprefix option * some DHCP servers expect to request for explicit router options * bridge: release IP in case of error * change source of ipmasq rule from ipn to ip + Build fixes: * test: add coveralls support * plugins: correctly output build version, cosmetic cleanups * Move Windows tests to Travis - from version v0.7.5: + This release takes a minor change to the portmap plugin: * Portmap: append, rather than prepend, entry rules + This fixes a potential issue where firewall rules may be bypassed by port mapping - Include patch to fix the build on i586: + 0001_use_Go_facilities_to_get_a_socket.patch - Use new build_linux.sh script instead of removed build.sh - Updated plugins to v0.8.1: + Bugs: * bridge: fix ipMasq setup to use correct source address * fix compilation error on 386 * bandwidth: get bandwidth interface in host ns through container interface + Improvements: * Release: bump go to v1.12 * host-device: add pciBusID property - Drop patches merged upstream: + 0001_use_Go_facilities_to_get_a_socket.patch - Update plugins to v0.8.2 + New features: * Support "args" in static and tuning * Add Loopback DSR support, allow l2tunnel networks to be used with the l2bridge plugin * host-local: return error if same ADD request is seen twice * bandwidth: fix collisions * Support ips capability in static and mac capability in tuning * pkg/veth: Make host-side veth name configurable + Bug fixes: * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists * host-device: revert name setting to make retries idempotent (#357). * Vendor update go-iptables. Vendor update go-iptables to obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10 * Update go.mod & go.sub * Remove link Down/Up in MAC address change to prevent route flush (#364). * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall error message is "invalid argument" not "file exists" * bump containernetworking/cni to v0.7.1 - Update to version 0.8.3: * Enhancements: * static: prioritize the input sources for IPs (#400). * tuning: send gratuitous ARP in case of MAC address update (#403). * bandwidth: use uint64 for Bandwidth value (#389). * ptp: only override DNS conf if DNS settings provided (#388). * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383). * loopback support CNI CHECK and result cache (#374). * Better input validation: * vlan: add MTU validation to loadNetConf (#405). * macvlan: add MTU validation to loadNetConf (#404). * bridge: check vlan id when loading net conf (#394). * Bugfixes: * bugfix: defer after err check, or it may panic (#391). * portmap: Fix dual-stack support (#379). * firewall: don't return error in DEL if prevResult is not found (#390). * bump up libcni back to v0.7.1 (#377). * Tests: * integration: fix ip address collision in integration tests (#409). * testutils: newNS() works in a rootless user namespace (#401). * Bump Go version (#386). * Cleanup netns after test suite (#375). * Docs: * contributing doc: revise test script name to run (#396). * contributing doc: describe cnitool installation (#397). - Update to version 0.8.4 (bsc#1160460): * add support for mips64le * Add missing cniVersion in README example * bump go-iptables module to v0.4.5 * iptables: add idempotent functions * portmap doesn't fail if chain doesn't exist * fix portmap port forward flakiness * Add Bruce Ma and Piotr Skarmuk as owners - Update to version 0.8.6 (bsc#1172410 CVE-2020-10749) * New features * Support device id in host device plugin (#471). * win-bridge: add support for portMappings capability (#475). * Make host-device to work with virtio net device (#453). * Small improvements * ptp, bridge: disable accept_ra on the host-side interface (#484). * modify the error url of windowscontainer (#460). * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin rule only allow the * container itself to access the ports it is exposing thru the host IP. Other containers in the same subnet might also want to access this service via the host IP, so apply this rule to the whole subnet instead of just for the container. * Unlock OS thread after netns is restored (#455). * Bugfixes * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used which routed an entire cidr based on source, not only the bound address. * check bridge's port state (#468). fix #463 * Reset the route flag before moving the rule (#472). * replace juju/errors because of CNCF license scan (#458). ref to #457 * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin. The IPv6 address check loops over IPv4 addresses. - from version 0.8.5 * Bugfixes * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING (#434) fixes #370. * vlan: Fix vlan plugin returning error when device is already removed (#438). * Improvements * sysctl: Improve support of sysctl name separators (#437). - Update to version 0.8.7: * Fix race condition in GetCurrentNS * lo: CNI_IFNAME is no longer ignored * cni: bump to 0.8.0 * Bump Go version to 1.13 and 1.14 * Add contact info * Update firewall README.md CNI-ADMIN * firewall: fix some typos in docs * portmap DEL noop if no portMappings present * flannel: remove net conf file after DEL succeed - Update to version 0.9.0: * tuning: revert values on delete (#540) * go mod tidy * bump to go 1.15 * Add ability to trigger retests via comments * pkg/ns: fix test case to tolerate pids going away. * Add github build & test actions * bridge: fix testcase to check addresses we care about * Remove travis. * vendor: bump ginkgo, gover * portmap plugin should flush previous udp connections * Updating plugin README.md files (#549) * update netlink dependencies * Xdhcp: fix example configuration * VRF: extend supported version to 0.3.1 too. * VRF CNI: Add an optional table parameter. * Add more tests for the vrf cni plugin. * Update github.com/vishvananda/netlink to v1.1.0 * Introduce a new VRF CNI meta plugin. * Travis: run tests on arm64 * Replace nc with the local echo client. * Add an echo client to be used instead of nc. * Bump up the ubuntu version used in CI to bionic. * flannel: allow input ipam parameters as basis for delegate * ipvlan: make master config as optional * Remove extraneous test file in Windows plugin - Update to version 0.9.1: * ipam/dhcp: Add broadcast flag * add flannel to support dual stack ip * bandwidth: fix panic in tests * host-device: Add support for DPDK device * [main/vlan] Fix error handling for delegate IPAM plugin * dhcp: default dhcp clien timeout is 10s * vlan: fix error message text by removing ptp references * dhcp: daemon dhcp client timeout is configurable * dhcp: timeout value is set in DHCP daemon * remove unused function * deps: go mod tidy coreos/go-iptables * deps: bump coreos/go-iptables - Update to version 1.1.1: * ipam/dhcp: Fix client id in renew/release * call ipam.ExceDel after clean up device in netns fix #666 * portmap: fix checkPorts result when chain does not exist * portmap: fix bug that new udp connection deletes all existing conntrack entries * Enhanced dad set to 1 * Add boolean to enable/disable dad * Disable DAD for container side veth * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker * Fix host-device gofmt * host-device: Bring interfaces up after moving into container * pkg/ns: use file system magic numbers from golang.org/x/sys/unix * gofmt * go mod tidy * build: bump to go 1.17 * Remove arp notify setting per comment * plugins: replace arping package with arp_notify * fix #685 * Ran go fmt so tests would pass * Fixed DHCP problem that broke when fast retry was added. * dhcp ipam: adjust retry mechanism * add ipam tests for dpdk device * add ipam support for dpdk device * ipvlan: Send Gratuitous ARP after IPs are set * dhcp ipam: fix client id * dhcp ipam: rename inconsistent options among files * dhcp ipam: add more options capable for sending * dhcp ipam: add fast retry * dhcp ipam: support customizing dhcp options * dhcp ipam: truncate client id to 254 bytes * dhcp ipam: print error correctly without format string * dhcp ipam: using full config to regular the code * Allow setting sysctls on a particular interface * dhcp: remove implemented TODO * Don't redundantly filepath.Clean the output of filepath.Join * Use crypto/rand.Read, not crypto.Reader.Read * bridge: Add macspoofchk support * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped * vendor: bump to libcni v1.0.1 * static ipam: do not parse the CIDR twice * static ipam: improve error msgs when provisioning invalid CIDR * bump go to 1.16, other misc fixes * vendor: bump all direct dependencies * vendor: bump to libcni v1.0 * docs: Update the CI badge from Travis CI to GitHub Actions * bridge: Fix typo in error message for promiscuous mode * ip: place veth peer in host namspace directly * bridge: Add mac field to specify container iface mac * static ipam: decide wrong cidr error msg * static ipam: stop wrapping net.ParseCIDR errors * static ipam: show confusing error msg * utils, hwaddr: Remove unused package * ip, link_linux: Remove unused SetHWAddrByIP function * plugins: remove flannel * refactor(win-bridge): netconf * refactor(win-bridge): hcn api processing * refactor(win-bridge): hns api processing * chore(win-bridge): location related * chore(win-bridge): text related * Remove Bryan Boreham as maintainer * host-local: support ip/prefix in env args and CNI args * [sbr]: Use different tableID for every ipCfg Check tableID not in use for every ipCfg * Small typo improves in README.md * Allow multiple routes to be added for the same prefix. Enables ECMP * Update to lastest vendor/github.com/vishvananda/netlink * tuning: always update MAC in CNI result * vendor: bump to libcni v1.0-rc1 * tuning: Add support of altering the allmulticast flag * [sbr]: Use different tableID for every ipCfg Move default table routes which match the ipCfg config * Fix nil-pointer check * host-local: support custom IPs allocation through runtime configuration * pkg/ip: introduce a new type `IP` to support formated <ip>[/<prefix>] * go.mod: github.com/j-keck/arping v1.0.1 * go.mod: github.com/buger/jsonparser v1.1.1 * go.mod: github.com/alexflint/go-filemutex v1.1.0 * go.mod github.com/Microsoft/hcsshim v0.8.16 * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0 * go.mod: github.com/mattn/go-shellwords v1.0.11 * go.mod: github.com/sirupsen/logrus v1.8.1 * CI: Install linux-modules-extra for VRF module * Fix broken links to online docs in plugin READMEs * gha: update actions/setup-go@v2 * remove redundant startRange in RangeIter due to overlap check on multi ranges * fix(win-bridge): panic while calling HNS api * portmap: use slashes in sysctl template to support interface names which separated by dots * pkg/ipam: use slash as sysctl separator so interface name can have dot * [macvlan] Stop setting proxy-arp on macvlan interface * tuning: increase test coverage to 1.0.0 and older spec versions * portmap: increase test coverage to 1.0.0 and older spec versions * flannel: increase test coverage to 1.0.0 and older spec versions * firewall: increase test coverage to 1.0.0 and older spec versions * bandwidth: increase test coverage to 1.0.0 and older spec versions * host-local: increase test coverage to 1.0.0 and older spec versions * static: increase test coverage to 1.0.0 and older spec versions * dhcp: increase test coverage to 1.0.0 and older spec versions * dhcp: add -resendmax option to limit lease acquisition time for testcases * vlan: increase test coverage to 1.0.0 and older spec versions * ptp: increase test coverage to 1.0.0 and older spec versions * macvlan: increase test coverage to 1.0.0 and older spec versions * loopback: increase test coverage to 1.0.0 and older spec versions * ipvlan: increase test coverage to 1.0.0 and older spec versions * host-device: increase test coverage to 1.0.0 and older spec versions * bridge: increase test coverage to 1.0.0 and older spec versions * bridge: simplify version-based testcase code * testutils: add test utilities for spec version features * plugins: update to spec version 1.0.0 * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206) - Drop %go_nostrip - Version 1. - First public release. - Version 2: * Fix routes handling (gh#94). * Display those interfaces that are not managed by Wicked in a separate list (gh#95). As part of this enhancement, several visual improvements were introduced. * Just write the changes to the ifcfg-* files (gh#98). * Avoid calling too many external tools to get the list of ESSIDs (gh#91). * Adjust the label of the button that allows deleting an interface configuration (gh#102). - Version 3: * Properly remove the last route in /etc/sysconfig/network/routes (gh#110). * Improve detection of virtual interfaces (gh#113). * Usability improvements in the interfaces (gh#114, gh#115) and routes lists (gh#112). * Update dependencies to latest compatible versions (gh#116). * Added translations for Catalan, Japanese, Portuguese (Brazil and Portugal) and Spanish. - Version 4: * Properly detect whether the interface is up (gh#123 and bsc#1182189). * Clarify that the "Routing" tab is about user-defined routes (related to gh#122). - Version 4.1: * Fix a problem when detecting whether an interface is down and clean up the list of assigned addresses when they are released (gh#128, bsc#1182189 and bsc#1186736). * Update several dependencies to address security concerns (gh#127). * Add translations for German, Hindi and Sinhala (work in progress). * Update translations for Catalan, Czech, Italian, Japanese and Portuguese (Brazil). - Version 4.2: * Update a few dependencies to address security concerns (gh#132). - Fix a packaging problem that caused cockpit-wicked to do not work at all (bsc#1189611). - Version 4.3: * Update a few dependencies to address security concerns (gh#134). * Fix wicked wireless configuration parser (bsc#1196528). - Version 4.4: * Security: update a few dependencies to address security concerns (gh#136). * Packaging: add a conflict with cockpit-networkmanager (gh#135). * Update translations for Spanish. - Version 5: * Update the build system to support new cockpit build system * Update React components to patternfly 5 - Remove the node_modules service workaround and node-module-duplicate-fix.patch - Update to version 5~git8.c06c55b: * Fixed vulnerabilities reported by npm audit and updated minimum cockpit-devel version (CVE-2023-26364, bsc#1217325). * Update @css-tools to address a security issue (related to bsc#1217325) and replace/drop deprecated dependencies (gh#openSUSE/cockpit-wicked#143). - Version 1. - First public release. - Version 2: * Fix routes handling (gh#94). * Display those interfaces that are not managed by Wicked in a separate list (gh#95). As part of this enhancement, several visual improvements were introduced. * Just write the changes to the ifcfg-* files (gh#98). * Avoid calling too many external tools to get the list of ESSIDs (gh#91). * Adjust the label of the button that allows deleting an interface configuration (gh#102). - Version 3: * Properly remove the last route in /etc/sysconfig/network/routes (gh#110). * Improve detection of virtual interfaces (gh#113). * Usability improvements in the interfaces (gh#114, gh#115) and routes lists (gh#112). * Update dependencies to latest compatible versions (gh#116). * Added translations for Catalan, Japanese, Portuguese (Brazil and Portugal) and Spanish. - Version 4: * Properly detect whether the interface is up (gh#123 and bsc#1182189). * Clarify that the "Routing" tab is about user-defined routes (related to gh#122). - Version 4.1: * Fix a problem when detecting whether an interface is down and clean up the list of assigned addresses when they are released (gh#128, bsc#1182189 and bsc#1186736). * Update several dependencies to address security concerns (gh#127). * Add translations for German, Hindi and Sinhala (work in progress). * Update translations for Catalan, Czech, Italian, Japanese and Portuguese (Brazil). - Version 4.2: * Update a few dependencies to address security concerns (gh#132). - Fix a packaging problem that caused cockpit-wicked to do not work at all (bsc#1189611). - Version 4.3: * Update a few dependencies to address security concerns (gh#134). * Fix wicked wireless configuration parser (bsc#1196528). - Version 4.4: * Security: update a few dependencies to address security concerns (gh#136). * Packaging: add a conflict with cockpit-networkmanager (gh#135). * Update translations for Spanish. - Version 5: * Update the build system to support new cockpit build system * Update React components to patternfly 5 - Remove the node_modules service workaround and node-module-duplicate-fix.patch - Update to version 5~git8.c06c55b: * Fixed vulnerabilities reported by npm audit and updated minimum cockpit-devel version (CVE-2023-26364, bsc#1217325). * Update @css-tools to address a security issue (related to bsc#1217325) and replace/drop deprecated dependencies (gh#openSUSE/cockpit-wicked#143). - Update to version 1.4.1: + Bugfixes: - Add back the meson -Denable-systemd=false configure argument. - Add the fallback rules for older PolicyKit versions. - Define PATH_MAX if not available. - Enable C99 support in meson.build. - Include all the files in the GIR target. - Include the correct file when using Colord-1.0.gir. - Use appropriate feature macro for realpath(). - Use gio-2.0 when generating the VAPI. - Changes from version 1.4.0: + New Features: - Port to the Meson build system. - Enable Travis CI for Fedora 25 and Debian Stretch. - Make PolicyKit, gusb and udev a hard requirement. + Bugfixes: - Add some experimental tools for the HueyCOLOR sensor as found in the P70. - Conditionally build documentation and man pages. - Correctly build the ICC transfer curve for Rec709. - Do not build the examples as part of the regular build. - Do not spin the Huey LEDs when the sensor is embedded. - Do not use /tmp to create profiles. - Fix the version numbers in cd-version.h to reflect reality. - Get the Huey status before trying to unlock. - Use a different Huey unlock code on the W700 laptop. - Add meson BuildRequires, and switch autotools macros configure, make and makeinstall to meson, meson_build and meson_install following upstream switch to Meson Build System. - Add gtk-doc and docbook-utils BuildRequires: new dependencies. - Drop %glib2_gsettings_schema_* post/postun macros: the functionality is now covered by file triggers. - Drop intltool and vala BuildRequires: no longer needed. - Upstream rename of ColorHug-1.0.typelib file to Colorhug-1.0.typelib, thus its package has been renamed as well. - Add pkgconfig(vapigen) BuildRequires and pass enable-session-example=false, enable-bash-completion=true, enable-systemd=true, enable-libcolordcompat=true, enable-argyllcms-sensor=true, enable-reverse=false, enable-sane=false, enable-vala=true, enable-print-profiles=true, enable-tests=false, enable-installed-tests=false, with-daemon-user=colord, enable-man=true and enable-docs=true to meson, ensure we build the feature we want. - Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so that colprof is forced to work in chunks when generating the print profile rather than trying to allocate a 3.1 GiB chunk of RAM to put the entire B-to-A tables in. - Update package summaries. Replace old RPM shell variables. - Collapse files section for gtk-doc. - Modernize spec-file by calling spec-cleaner - Update to version 1.4.2: + New Features: - Add cd_icc_set_created. - Add --enable-timestamps option for CREATED header. + Bugfixes: - Avoid buffer overflow when reading profile_id. - Fix the detection of duplicate EDIDs. - Make udev hwdb optional by using pnp.ids as fallback. - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD. - Refactor build directory selection. - Set cd-create-profile date to SOURCE_DATE_EPOCH. - Pass new option enable-udev-rules=true to meson. - Update to version 1.4.3: + Bugfixes: - Make cd_color_get_blackbody_rgb_full safer. - Update style of Meson build options. - Update warning about running daemon as root. - Update options passed to meson following upstream changes. - Fix meson parameters: -Dargyllcms-sensor=true must be - Dargyllcms_sensor=true (boo#1124388). - Change BuildRequires to docbook-utils-minimal, otherwise the build pulls in half of texlive and all its dependencies. Only man pages and HTML API docs are generated, no need for PS/PDF generation. - Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230) - Update to version 1.4.4: + New Features: - Actually install the installed tests. - Allow building without the daemon. + Bugfixes: - Consistently search for spotread in $PATH. - Don't hard-require spotread to build argyll sensor. - Fix linker argument checks. - Include C header in Colorhug-1.0.gir. - Pass -DCD_COMPILATION to gir compiler. - Port manpages to xsltproc and DocBook 5. - Replace docbook-utils-minimal with docbook5-xsl-stylesheets BuildRequires following upstreams port. - Add _constraints file, avoid random buildfails for i586 and other arches. - Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5). - Move colord-session.service and tmpfiles config from libcolord-devel to colord package. - No longer recommend -lang: supplements are in use - Update to version 1.4.5: + New Features: - Add cd_icc_create_default_full - Add cd_icc_utils_get_adaptation_matrix - Add cd_mat33_is_finite - Add support for datacolor SpyderX + Bugfixes: - Check for errors from more sqlite calls - Fix cd_icc_load_data() annotation for the data array - Fix cd-sensor-dummy - Fix more annotation for data arrays - Fix owner and permissions on existing state files - Fix segfault due to dereferencing NULL pointer - Make the build reproductible - Refactor opening of mapping database and try again if fails - Drop add-spyderx.patch: Included upstream in new release. - allow access to /usr/local/share/color in AppArmor profile (boo#1180898) - Change to systemd-sysusers - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_colord.service.patch - Add colord-CVE-2021-42523.patch: fix a small memory leak in sqlite3_exec (boo#1202802 CVE-2021-42523). - Remove script in %pre to change ownership of /var/lib/colord (bsc#1208056). - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - Update to version 2.1.8: * stdio: ignore EIO for terminals (bsc#1217773) * ensure console socket buffers are properly sized * conmon: drop return after pexit() * ctrl: make accept4 failures fatal * logging: avoid opening /dev/null for each write * oom: restore old OOM score * Use default umask 0022 * cli: log parsing errors to stderr * Changes to build conmon for riscv64 * Changes to build conmon for ppc64le * Fix close_other_fds on FreeBSD - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - New upstream release 2.1.9 [#]## Bug fixes * fix some issues flagged by SAST scan * src: fix write after end of buffer * src: open all files with O_CLOEXEC * oom-score: restore oom score before running exit command [#]## Features * Forward more messages on the sd-notify socket * logging: -l passthrough accepts TTYs - Add fix-incorrect-free-in-conn_sock.patch This fixes a regression in 2.1.9 (https://github.com/containers/conmon/issues/475 and https://github.com/containers/conmon/issues/477) - New upstream release 2.1.10 Bug fixes: * Fix incorrect free in conn_sock (removes fix-incorrect-free-in-conn_sock.patch) * logging: Respect log-size-max immediately after open - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - Update to version 2.1.8: * stdio: ignore EIO for terminals (bsc#1217773) * ensure console socket buffers are properly sized * conmon: drop return after pexit() * ctrl: make accept4 failures fatal * logging: avoid opening /dev/null for each write * oom: restore old OOM score * Use default umask 0022 * cli: log parsing errors to stderr * Changes to build conmon for riscv64 * Changes to build conmon for ppc64le * Fix close_other_fds on FreeBSD - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - New upstream release 2.1.9 [#]## Bug fixes * fix some issues flagged by SAST scan * src: fix write after end of buffer * src: open all files with O_CLOEXEC * oom-score: restore oom score before running exit command [#]## Features * Forward more messages on the sd-notify socket * logging: -l passthrough accepts TTYs - Add fix-incorrect-free-in-conn_sock.patch This fixes a regression in 2.1.9 (https://github.com/containers/conmon/issues/475 and https://github.com/containers/conmon/issues/477) - New upstream release 2.1.10 Bug fixes: * Fix incorrect free in conn_sock (removes fix-incorrect-free-in-conn_sock.patch) * logging: Respect log-size-max immediately after open - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - Update to version 2.1.8: * stdio: ignore EIO for terminals (bsc#1217773) * ensure console socket buffers are properly sized * conmon: drop return after pexit() * ctrl: make accept4 failures fatal * logging: avoid opening /dev/null for each write * oom: restore old OOM score * Use default umask 0022 * cli: log parsing errors to stderr * Changes to build conmon for riscv64 * Changes to build conmon for ppc64le * Fix close_other_fds on FreeBSD - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - New upstream release 2.1.9 [#]## Bug fixes * fix some issues flagged by SAST scan * src: fix write after end of buffer * src: open all files with O_CLOEXEC * oom-score: restore oom score before running exit command [#]## Features * Forward more messages on the sd-notify socket * logging: -l passthrough accepts TTYs - Add fix-incorrect-free-in-conn_sock.patch This fixes a regression in 2.1.9 (https://github.com/containers/conmon/issues/475 and https://github.com/containers/conmon/issues/477) - New upstream release 2.1.10 Bug fixes: * Fix incorrect free in conn_sock (removes fix-incorrect-free-in-conn_sock.patch) * logging: Respect log-size-max immediately after open - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - Update to version 2.1.8: * stdio: ignore EIO for terminals (bsc#1217773) * ensure console socket buffers are properly sized * conmon: drop return after pexit() * ctrl: make accept4 failures fatal * logging: avoid opening /dev/null for each write * oom: restore old OOM score * Use default umask 0022 * cli: log parsing errors to stderr * Changes to build conmon for riscv64 * Changes to build conmon for ppc64le * Fix close_other_fds on FreeBSD - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - New upstream release 2.1.9 [#]## Bug fixes * fix some issues flagged by SAST scan * src: fix write after end of buffer * src: open all files with O_CLOEXEC * oom-score: restore oom score before running exit command [#]## Features * Forward more messages on the sd-notify socket * logging: -l passthrough accepts TTYs - Add fix-incorrect-free-in-conn_sock.patch This fixes a regression in 2.1.9 (https://github.com/containers/conmon/issues/475 and https://github.com/containers/conmon/issues/477) - New upstream release 2.1.10 Bug fixes: * Fix incorrect free in conn_sock (removes fix-incorrect-free-in-conn_sock.patch) * logging: Respect log-size-max immediately after open - Update to v2.0.12 - oom: fix potential race between verification steps - Update to v2.0.14 - drop usage of splice(2) - avoid hanging on stdin - stdio: sometimes quit main loop after io is done - ignore sigpipe - Update to v2.0.15 - store status while waiting for pid - Enable support for journald logging (bsc#1162432) - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - Update to v2.0.12 - oom: fix potential race between verification steps - Update to v2.0.14 - drop usage of splice(2) - avoid hanging on stdin - stdio: sometimes quit main loop after io is done - ignore sigpipe - Update to v2.0.15 - store status while waiting for pid - Enable support for journald logging (bsc#1162432) - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - Update to v2.0.12 - oom: fix potential race between verification steps - Update to v2.0.14 - drop usage of splice(2) - avoid hanging on stdin - stdio: sometimes quit main loop after io is done - ignore sigpipe - Update to v2.0.15 - store status while waiting for pid - Enable support for journald logging (bsc#1162432) - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - Update to v2.0.12 - oom: fix potential race between verification steps - Update to v2.0.14 - drop usage of splice(2) - avoid hanging on stdin - stdio: sometimes quit main loop after io is done - ignore sigpipe - Update to v2.0.15 - store status while waiting for pid - Enable support for journald logging (bsc#1162432) - Update to v2.0.16 - tty: flush pending data when fd is ready - Update to v2.0.17 - Add option to delay execution of exit command - Update to v2.0.20 (bsc#1175821) - journald: fix logging container name - container logging: Implement none driver - "off", "null" or "none" all work. - ctrl: warn if we fail to unlink - Drop fsync calls - Reap PIDs before running exit command - Fix log path parsing - Add --sync option to prevent conmon from double forking - Add --no-sync-log option to instruct conmon to not sync the logs of the containers upon shutting down. This feature fixes a regression where we unconditionally dropped the log sync. It is possible the container logs could be corrupted on a sudden power-off. If you need container logs to remain in consistent state after a sudden shutdown, please update from v2.0.19 to v2.0.20 - Update to version 2.0.21: * bump to v2.0.21 * protect against kill(-1) * Makefile: enable debuginfo generation * Remove go.sum file and add go.mod * Fail if conmon config could not be written * nix: remove double definition for e2fsprogs * Speedup static build by utilizing CI cache on `/nix` folder * Fix nix build for failing e2fsprogs tests * test: fix CI * Use Podman for building - Update to version 2.0.22: * added man page * attach: always chdir * conn_sock: Explicitly free a heap-allocated string * refactor I/O and add SD_NOTIFY proxy support - Update to version 2.0.26: * conn_sock: do not fail on EAGAIN * fix segfault from a double freed pointer * Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was. * improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it) * add full-attach option to allow callers to not truncate a very long path for the attach socket * close only opened FDs * set locale to inherit environment - Update to version 2.0.27: * bump to v2.0.27 * Add CRI-O integration test GitHub action * exec: don't fail on EBADFD * close_fds: fix close of external fds * Add arm64 static build binary * bump to v2.0.27-dev - Update to version 2.0.29: * Reset OOM score back to 0 for container runtime * call functions registered with atexit on SIGTERM * conn_sock: fix potential segfault - Update to version 2.0.30: * Remove unreachable code path * exit: report if the exit command was killed * exit: fix race zombie reaper * conn_sock: allow watchdog messages through the notify socket proxy * seccomp: add support for seccomp notify - Update to version 2.1.0 * logging: buffer partial messages to journald * exit: close all fds >= 3 * fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free. - Update to version 2.0.32 * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor. * exit_command: Fix: unset subreaper attribute before running exit command - Update to version 2.0.31 * logging: new mode -l passthrough * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald * conmon: Fix: free userdata files before exec cleanup - Update to version 2.1.2: * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285) * journald: print tag and name if both are specified * drop some logs to debug level - update to 2.1.3: * Port conmon to FreeBSD * Stop using g_unix_signal_add() to avoid threads * Rename CLI optionlog-size-global-max to log-global-size-max - Add patch to fix build with make >= 4.4: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Update to version 2.1.5: * don't leak syslog_identifier * logging: do not read more that the buf size * logging: fix error handling * Makefile: Fix install for FreeBSD * signal: Track changes to get_signal_descriptor in the FreeBSD version * Packit: initial enablement - Update to version 2.1.4: * Fix a bug where conmon crashed when it got a SIGCHLD - New upstream release 2.1.7 2.1.7: [#]## Bug Fixes Fix leaking symbolic links in the opt_socket_path directory cgroup: Stumble on if we can't set up oom handling (bsc#1208737) 2.1.6: [#]## Bug Fixes * Fix OOM watcher for cgroupv2 `oom_kill` events [#]## Misc * Use --detach instead of -d * ctrl: drop fifo perms to 0660 - Remove merged patch: * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch - Bump go version to 1.19 (bsc#1209307) - go 1.19 EOL, swith to go >= 1.20 * [bsc#1215806] - Initial version - Update to version 2.143.0 - support containerd/cri - Minimize BuildRequires - Update to version 2.145.0 - Add support for kubernetes_file_t - Allow container_t to open existing tun/tap - Update to version 2.150.0 - Add additional allow rules for kvm based containers using virtiofsd. - Don't use BuildRequires based on shell script output. OBS can't evaluate that. - Update to version 2.154.0 - Allow confined user domains to run confined container domains. - Allow all containers to use nfs shares, iff virt_use_nfs boolean is enabled. - Allow containers to read nsfs file systems. - KVM Container need to use tunnel sockets created by runtime. - Update to version 2.158.0 - Add nfs remount support - Allow containers to execmod on nfs, samba and cephs remote shares - Allow confined users to send dbus messages to container_runtime - Fix container runtime binary labels (bsc#1185030). You need to relable at least /usr/sbin if you're affected - Update to version 2.164.2 * Don't setup users for writing to pid_sockets * Allow container engines to be started from the staff user. * Allow spc_t domains to set bpf rules on any domain * Add support for k3s - Update to version 2.171.0 * Define kubernetes_file_t as a config_type * Allow containers to be socket activated by user domains and by systemd. * Allow iptables to use fifo files of a container runtime * Allow container_runtime create all tmpfs content as container_runtime_tmpfs_t * Allow containers to create lnk_file on tmpfs_t directories. - Update to version 2.180.0 * Allow container domains to read/write kvm_device_t * Update kublet mappings to inlcude /usr/local/* * Allow container domains to use container runtime tcp and udp sockets * Alow containers to use unix_stream_sockets leaked from container runtimes * Allow userdomains to execute conmon_exec_t and use it as an entrypoint * Allow conmon_exec_t as an entrypoint * Add container_use_devices boolean to allow containers to use any device * Add explicit range transition for conmon * Add missing dbus class declaration into container_runtime_run() * Remove lockdown allow rules * Remove k3s fcontexts * Allow container domains to be used by user roles - Changed source url to allow for download via source service - Add udica templates to the package - Update to version 2.187.0: * Allow container domains to use /dev/zero - Changes from 2.186.0: * Create policy for a container_device_t * Allow containers to shutdown & setopt userdomain:sockets - Changes from 2.183.0: * Allow containers to inherit all socket classes from container runtimes. - Changes from 2.182.0: * Allow containers to inherit all socket classes - Changes from 2.181.0: * Allow socket activated domains for tcp sockets from init_t and userdomains. - Update to version 2.188.0: * Allow confined containers to mount overlay filesystems Fixed bsc#1201348 - Allow iptables_t list directory permissions of container_file_t (bsc#1227442) - added 1227442-allow-iptables_t-list_dir_perms-container_file_t.patch - Initial version - Update to version 2.143.0 - support containerd/cri - Minimize BuildRequires - Update to version 2.145.0 - Add support for kubernetes_file_t - Allow container_t to open existing tun/tap - Update to version 2.150.0 - Add additional allow rules for kvm based containers using virtiofsd. - Don't use BuildRequires based on shell script output. OBS can't evaluate that. - Update to version 2.154.0 - Allow confined user domains to run confined container domains. - Allow all containers to use nfs shares, iff virt_use_nfs boolean is enabled. - Allow containers to read nsfs file systems. - KVM Container need to use tunnel sockets created by runtime. - Update to version 2.158.0 - Add nfs remount support - Allow containers to execmod on nfs, samba and cephs remote shares - Allow confined users to send dbus messages to container_runtime - Fix container runtime binary labels (bsc#1185030). You need to relable at least /usr/sbin if you're affected - Update to version 2.164.2 * Don't setup users for writing to pid_sockets * Allow container engines to be started from the staff user. * Allow spc_t domains to set bpf rules on any domain * Add support for k3s - Update to version 2.171.0 * Define kubernetes_file_t as a config_type * Allow containers to be socket activated by user domains and by systemd. * Allow iptables to use fifo files of a container runtime * Allow container_runtime create all tmpfs content as container_runtime_tmpfs_t * Allow containers to create lnk_file on tmpfs_t directories. - Update to version 2.180.0 * Allow container domains to read/write kvm_device_t * Update kublet mappings to inlcude /usr/local/* * Allow container domains to use container runtime tcp and udp sockets * Alow containers to use unix_stream_sockets leaked from container runtimes * Allow userdomains to execute conmon_exec_t and use it as an entrypoint * Allow conmon_exec_t as an entrypoint * Add container_use_devices boolean to allow containers to use any device * Add explicit range transition for conmon * Add missing dbus class declaration into container_runtime_run() * Remove lockdown allow rules * Remove k3s fcontexts * Allow container domains to be used by user roles - Changed source url to allow for download via source service - Add udica templates to the package - Update to version 2.187.0: * Allow container domains to use /dev/zero - Changes from 2.186.0: * Create policy for a container_device_t * Allow containers to shutdown & setopt userdomain:sockets - Changes from 2.183.0: * Allow containers to inherit all socket classes from container runtimes. - Changes from 2.182.0: * Allow containers to inherit all socket classes - Changes from 2.181.0: * Allow socket activated domains for tcp sockets from init_t and userdomains. - Update to version 2.188.0: * Allow confined containers to mount overlay filesystems Fixed bsc#1201348 - Allow iptables_t list directory permissions of container_file_t (bsc#1227442) - added 1227442-allow-iptables_t-list_dir_perms-container_file_t.patch - Install systemd service file as well (fixes bsc#1190826) - Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Install systemd service file as well (fixes bsc#1190826) - Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Install systemd service file as well (fixes bsc#1190826) - Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Install systemd service file as well (fixes bsc#1190826) - Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355 - Switch to Go 1.16.x compiler, in line with upstream. - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.22. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.22> - Bump minimum Go version to 1.22. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.23. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.23> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.22. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.22> - Bump minimum Go version to 1.22. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.23. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.23> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.22. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.22> - Bump minimum Go version to 1.22. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.23. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.23> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> Includes fixes for: - CVE-2022-1996 bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.10. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.10> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Add patch for bsc#1217952: + 0002-shim-Create-pid-file-with-0644-permissions.patch - Enable manpage generation - Make devel package noarch - adjust rpmlint filters - Use %patch -P N instead of deprecated %patchN. - Use obs_scm service instead of tar_scm - Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch (merged upstream at <https://github.com/containerd/containerd/pull/9571>) - Update to containerd v1.7.15. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.15> - Update to containerd v1.7.14. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.14> - Update to containerd v1.7.13. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.13> - Update to containerd v1.7.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.12> - Update to containerd v1.7.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.11> GHSA-jq35-85cj-fj4p bsc#1224323 - Update to containerd v1.7.17. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.17> - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth and storage than a locally-compressed tar.xz, it seems there's some weird issue with paths in obscpio that break our SLE-12-only patch. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.16. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.16> CVE-2023-45288 bsc#1221400 - Revert noarch for devel subpackage for SLE 15 Switching to noarch causes issues on SLES maintenance updates, reverting it fixes our image builds - Update to containerd v1.7.21. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.21> Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.22. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.22> - Bump minimum Go version to 1.22. - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.23. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.23> - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814 bsc#1193273 CVE-2021-41190 [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch [ This patch was only released in SLES and Leap. ] - Add patch for CVE-2022-23648. bsc#1196441 + CVE-2022-23648.patch - Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441 - Remove upstreamed patch: - CVE-2022-23648.patch - Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517 - Update to containerd v1.5.12. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.5.12> [ This patch was only released in SLES and Leap. ] - Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145 + bsc1200145-Limit-the-response-size-of-ExecSync.patch - Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements of Docker v20.10.17-ce. bsc#1200145 - Remove upstreamed patches: - bsc1200145-Limit-the-response-size-of-ExecSync.patch - add devel subpackage, which is needed by open-vm-tools - Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.9> - Update to containerd v1.6.11. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.11> - Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.12> - Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.16> - Re-build containerd to use updated golang-packaging. jsc#1342 - Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.19> Includes fixes for: - CVE-2023-25153 bsc#1208423 - CVE-2023-25173 bsc#1208426 - Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.20> [ This was only released in SLE. ] - unversion to golang requires to always use the current default go. (bsc#1210298) - Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.6.21> bsc#1211578 - Require a minimum Go version explicitly rather than using golang(API). Fixes the change for bsc#1210298. - Add `Provides: cri-runtime` to use containerd as container runtime in Factory Kubernetes packages - Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.6> bsc#1215323 - Update to containerd v1.7.7. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.7> - Add patch to fix build on SLE-12: + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Update to containerd v1.7.8. Upstream release notes: <https://github.com/containerd/containerd/releases/tag/v1.7.8> bsc#1200528 - Rebase patches: * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch - Disable changelog generation via tar_scm service (too verbose) - Update to version 1.34.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0 - Add REGISTRY variable - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727) 0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch - Add REGISTRY variable - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727) 0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch - Update to version 1.59.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1 - Disable changelog generation via tar_scm service (too verbose) - Update to version 1.34.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0 - Add REGISTRY variable - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727) 0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch - Add REGISTRY variable - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Use registry.suse.com as the default fallback for sle - Rename macro registry_path to kubevirt_registry_path - Update to version 1.35.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0 - Generate meta info for containers during rpm build - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.36.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0 - Update to version 1.37.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1 - Update to version 1.40.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0 - Update to version 1.41.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0 - Detect SLE15 SP4 build environment - Update to version 1.42.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0 - Update to version 1.43.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0 - Increase storage requirements in _constraints (bsc#1198791) - Pack only cdi-operator and cdi-cr release manifests - Update to version 1.51.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0 - Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528) 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update to version 1.55.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0 - Drop upstreamed patches: 0001-Update-go-restful-to-2.16.0.patch - Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller - Update SP5 kubevirt registry path (bsc#1204140) - Build tools/cdi-containerimage-server with CGO_ENABLED=0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Use recent golang compiler (bsc#1208916) - Update to version 1.57.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0 - Add registry path for SLE15 SP6 - Enable the build for ALP and remove no longer supported SLE versions from the distro check - Update to version 1.58.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0 - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727) 0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch - Update to version 1.59.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1 - Fixed file and directory permission flaw (#304180, CVE-2007-4129). - Fixed gcc 4.3 build errors. - Fixed wrong C++ delete (bnc#443369, Redhat#485032). - Merged latest Fedora patches (bnc#661643). - Remove redundant tags/sections from specfile - Use %_smp_mflags for parallel build - add libtool as buildrequire to make the spec file more reliable - Create baselibs.conf. - Add PKCS11 module to p11-kit-32bit (bsc#996047#c39). - Integrate latest Centos 7 patches [bsc#1049213] (coolkey-fix-token-removal-failure.patch, coolkey-piv-ecc-el7.patch, coolkey-1.1.0-noapplet.patch, coolkey-1.1.0-fix-spurious-event.patch, coolkey-1.1.0-p15.patch, coolkey-1.1.0-p15-coverity.patch, coolkey-1.1.0-more-keys.patch, coolkey-1.1.0-fail-on-bad-mechanisms.patch, coolkey-1.1.0-max-cpu-bug.patch, coolkey-1.1.0-rhel7-alt-cac.patch). * PK15 support. * Fix CAC card support. * Fix card removal issues. - Use original tarball (coolkey-1.1.0.tar.bz2 -> coolkey-1.1.0.tar.gz). - Drop patch coolkey-null.patch. It is now part of coolkey-piv-ecc-el7.patch. - Add nssdb installation scripts. - Run spec-cleaner. - Drop coolkey-1.1.0-evoandooo.patch: The patch does nothing now. Evolution and LibreOffice changed over time. They moved its directories and they don't use secmod.db any more. - Remove vision statement and development methods from description. - New SuSE package, version 1.1.0. - install pk11install - teach pk11install about evolution and openoffice - Fixed file and directory permission flaw (#304180, CVE-2007-4129). - Fixed gcc 4.3 build errors. - Fixed wrong C++ delete (bnc#443369, Redhat#485032). - Merged latest Fedora patches (bnc#661643). - Remove redundant tags/sections from specfile - Use %_smp_mflags for parallel build - add libtool as buildrequire to make the spec file more reliable - Create baselibs.conf. - Add PKCS11 module to p11-kit-32bit (bsc#996047#c39). - Integrate latest Centos 7 patches [bsc#1049213] (coolkey-fix-token-removal-failure.patch, coolkey-piv-ecc-el7.patch, coolkey-1.1.0-noapplet.patch, coolkey-1.1.0-fix-spurious-event.patch, coolkey-1.1.0-p15.patch, coolkey-1.1.0-p15-coverity.patch, coolkey-1.1.0-more-keys.patch, coolkey-1.1.0-fail-on-bad-mechanisms.patch, coolkey-1.1.0-max-cpu-bug.patch, coolkey-1.1.0-rhel7-alt-cac.patch). * PK15 support. * Fix CAC card support. * Fix card removal issues. - Use original tarball (coolkey-1.1.0.tar.bz2 -> coolkey-1.1.0.tar.gz). - Drop patch coolkey-null.patch. It is now part of coolkey-piv-ecc-el7.patch. - Add nssdb installation scripts. - Run spec-cleaner. - Drop coolkey-1.1.0-evoandooo.patch: The patch does nothing now. Evolution and LibreOffice changed over time. They moved its directories and they don't use secmod.db any more. - Remove vision statement and development methods from description. - Fixed file and directory permission flaw (#304180, CVE-2007-4129). - Fixed gcc 4.3 build errors. - Fixed wrong C++ delete (bnc#443369, Redhat#485032). - Merged latest Fedora patches (bnc#661643). - Remove redundant tags/sections from specfile - Use %_smp_mflags for parallel build - add libtool as buildrequire to make the spec file more reliable - Create baselibs.conf. - Add PKCS11 module to p11-kit-32bit (bsc#996047#c39). - Integrate latest Centos 7 patches [bsc#1049213] (coolkey-fix-token-removal-failure.patch, coolkey-piv-ecc-el7.patch, coolkey-1.1.0-noapplet.patch, coolkey-1.1.0-fix-spurious-event.patch, coolkey-1.1.0-p15.patch, coolkey-1.1.0-p15-coverity.patch, coolkey-1.1.0-more-keys.patch, coolkey-1.1.0-fail-on-bad-mechanisms.patch, coolkey-1.1.0-max-cpu-bug.patch, coolkey-1.1.0-rhel7-alt-cac.patch). * PK15 support. * Fix CAC card support. * Fix card removal issues. - Use original tarball (coolkey-1.1.0.tar.bz2 -> coolkey-1.1.0.tar.gz). - Drop patch coolkey-null.patch. It is now part of coolkey-piv-ecc-el7.patch. - Add nssdb installation scripts. - Run spec-cleaner. - Drop coolkey-1.1.0-evoandooo.patch: The patch does nothing now. Evolution and LibreOffice changed over time. They moved its directories and they don't use secmod.db any more. - Remove vision statement and development methods from description. - Update to 8.27 (for details see included NEWS file) - Refresh patches: * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-ocfs2_reflinks.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch * coreutils-testsuite.spec - coreutils.keyring: Update (now ascii-armored) by 'osc service localrun download_files'. - coreutils-tests-port-to-timezone-2017a.patch: Add patch to workaround a FP test failure with newer timezone-2017a. - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - Update to 8.27 (for details see included NEWS file) - Refresh patches: * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-ocfs2_reflinks.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch * coreutils-testsuite.spec - coreutils.keyring: Update (now ascii-armored) by 'osc service localrun download_files'. - coreutils-tests-port-to-timezone-2017a.patch: Add patch to workaround a FP test failure with newer timezone-2017a. - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - Update to 8.27 (for details see included NEWS file) - Refresh patches: * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-ocfs2_reflinks.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch * coreutils-testsuite.spec - coreutils.keyring: Update (now ascii-armored) by 'osc service localrun download_files'. - coreutils-tests-port-to-timezone-2017a.patch: Add patch to workaround a FP test failure with newer timezone-2017a. - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - Update to 8.27 (for details see included NEWS file) - Refresh patches: * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-ocfs2_reflinks.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch * coreutils-testsuite.spec - coreutils.keyring: Update (now ascii-armored) by 'osc service localrun download_files'. - coreutils-tests-port-to-timezone-2017a.patch: Add patch to workaround a FP test failure with newer timezone-2017a. - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - ls: avoid triggering automounts (bsc#1221632) - add coreutils-ls-avoid-triggering-automounts.patch - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - ls: avoid triggering automounts (bsc#1221632) - add coreutils-ls-avoid-triggering-automounts.patch - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - ls: avoid triggering automounts (bsc#1221632) - add coreutils-ls-avoid-triggering-automounts.patch - coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch: Add upstream patch to fix an heap overflow security issue in date(1) and touch(1) with a large TZ variable (CVE-2017-7476, rh#1444774, boo#1037124). - Drop coreutils-ocfs2_reflinks.patch OCFS2 file system has supported file clone ioctls like btrfs, then, coreutils doesn't need this patch from the kernel v4.10-rc1 - Update to 8.28 (for details see included NEWS file) - Refresh patches: * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.keyring: Update from upstream (Savannah). - Remove now-upstream patches: * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch * coreutils-tests-port-to-timezone-2017a.patch - coreutils.spec: Add "BuildRequires: user(bin)" for the tests. - Update to 8.29: * Noteworthy changes in release 8.29 (2017-12-27) [stable] * * Bug fixes b2sum no longer crashes when processing certain truncated check files. [bug introduced with b2sum coreutils-8.26] dd now ensures the correct cache ranges are specified for the "nocache" and "direct" flags. Previously some pages in the page cache were not invalidated. [bug introduced for "direct" in coreutils-7.5, and with the "nocache" implementation in coreutils-8.11] df no longer hangs when given a fifo argument. [bug introduced in coreutils-7.3] ptx -S no longer infloops for a pattern which returns zero-length matches. [the bug dates back to the initial implementation] shred --remove will again repeatedly rename files with shortening names to attempt to hide the original length of the file name. [bug introduced in coreutils-8.28] stty no longer crashes when processing settings with -F also specified. [bug introduced in fileutils-4.0] tail --bytes again supports non seekable inputs on all systems. On systems like android it always tried to process as seekable inputs. [bug introduced in coreutils-8.24] timeout will again notice its managed command exiting, even when invoked with blocked CHLD signal, or in a narrow window where this CHLD signal from the exiting child was missed. In each case timeout would have then waited for the time limit to expire. [bug introduced in coreutils-8.27] * * New features timeout now supports the --verbose option to diagnose forced termination. * * Improvements dd now supports iflag=direct with arbitrary sized files on all file systems. tail --bytes=NUM will efficiently seek to the end of block devices, rather than reading from the start. Utilities which do not support long options (other than the default --help and --version), e.g. cksum and sleep, now use more consistent error diagnostic for unknown long options. * * Build-related Default man pages are now distributed which are used if perl is not available on the build system, or when cross compiling. - Refresh patches (line number changes only): * coreutils-i18n.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-tests-shorten-extreme-factor-tests.patch - Use %license (boo#1082318) - Update to 8.30: * Noteworthy changes in release 8.30 (2018-07-01) [stable] * * Bug fixes 'cp --symlink SRC DST' will again correctly validate DST. If DST is a regular file and SRC is a symlink to DST, then cp will no longer allow that operation to clobber DST. Also with -d, if DST is a symlink, then it can always be replaced, even if it points to SRC on a separate device. [bugs introduced with coreutils-8.27] 'cp -n -u' and 'mv -n -u' now consistently ignore the -u option. Previously, this option combination suffered from race conditions that caused -u to sometimes override -n. [bug introduced with coreutils-7.1] 'cp -a --no-preserve=mode' now sets appropriate default permissions for non regular files like fifos and character device nodes etc., and leaves mode bits of existing files unchanged. Previously it would have set executable bits on created special files, and set mode bits for existing files as if they had been created. [bug introduced with coreutils-8.20] 'cp --remove-destination file symlink' now removes the symlink even if it can't be traversed. [bug introduced with --remove-destination in fileutils-4.1.1] ls no longer truncates the abbreviated month names that have a display width between 6 and 12 inclusive. Previously this would have output ambiguous months for Arabic or Catalan locales. 'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a. [bug introduced in coreutils-5.3.0] 'mv -n A B' no longer suffers from a race condition that can overwrite a simultaneously-created B. This bug fix requires platform support for the renameat2 or renameatx_np syscalls, found in recent Linux and macOS kernels. As a side effect, ‘mv -n A A’ now silently does nothing if A exists. [bug introduced with coreutils-7.1] * * Changes in behavior 'cp --force file symlink' now removes the symlink even if it is self referential. ls --color now matches file extensions case insensitively. * * New features cp --reflink now supports --reflink=never to enforce a standard copy. env supports a new -v/--debug option to show verbose information about each processing step. env supports a new -S/--split-string=S option to split a single argument string into multiple arguments. Used to pass multiple arguments in scripts (shebang lines). md5sum accepts a new option: --zero (-z) to delimit the output lines with a NUL instead of a newline character. This also disables file name escaping. This also applies to sha*sum and b2sum. rm --preserve-root now supports the --preserve-root=all option to reject any command line argument that is mounted to a separate file system. * * Improvements cut supports line lengths up to the max file size on 32 bit systems. Previously only offsets up to SIZE_MAX-1 were supported. stat and tail now know about the "exfs" file system, which is a version of XFS. stat -f --format=%T now reports the file system type, and tail -f uses inotify. wc avoids redundant processing of ASCII text in multibyte locales, which is especially significant on macOS. * * Build-related Adjust to glibc >= 2.28 (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756) - Refresh patches (line number changes only): * coreutils-build-timeout-as-pie.patch * coreutils-disable_tests.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later". * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079). - coreutils-i18n.patch: * src/exand.c,src/unexpand.c: Avoid -Wcomment warning. * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t to uintmax_t type to avoid a regression on i586, armv7l and ppc. Compare upstream, non-MB commit: https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272 (cut_fields_mb): Likewise for field_idx. * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are working since a while. - coreutils.keyring: Update Assaf Gordon's GPG public key. - Update to 8.31: * Noteworthy changes in release 8.31 (2019-03-10) [stable] * * Bug fixes 'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'. [bug introduced in coreutils-5.3.0] When B already exists, 'cp -il A B' no longer immediately fails after asking the user whether to proceed. [This bug was present in "the beginning".] df no longer corrupts displayed multibyte characters on macOS. [bug introduced with coreutils-8.18] seq no longer outputs inconsistent decimal point characters for the last number, when locales are misconfigured. [bug introduced in coreutils-7.0] shred, sort, and split no longer falsely report ftruncate errors when outputting to less-common file types. For example, the shell command 'sort /dev/null -o /dev/stdout | cat' no longer fails with an "error truncating" diagnostic. [bug was introduced with coreutils-8.18 for sort and split, and (for shared memory objects only) with fileutils-4.1 for shred] sync no longer fails for write-only file arguments. [bug introduced with argument support to sync in coreutils-8.24] 'tail -f file | filter' no longer exits immediately on AIX. [bug introduced in coreutils-8.28] 'tail -f file | filter' no longer goes into an infinite loop if filter exits and SIGPIPE is ignored. [bug introduced in coreutils-8.28] * * Changes in behavior cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink, uptime, users, whoami, yes: now always process --help and --version options, regardless of any other arguments present before any optional '--' end-of-options marker. nohup now processes --help and --version as first options even if other parameters follow. 'yes a -- b' now outputs 'a b' instead of including the end-of-options marker as before: 'a -- b'. echo now always processes backslash escapes when the POSIXLY_CORRECT environment variable is set. When possible 'ln A B' now merely links A to B and reports an error if this fails, instead of statting A and B before linking. This uses fewer system calls and avoids some races. The old statting approach is still used in situations where hard links to directories are allowed (e.g., NetBSD when superuser). ls --group-directories-first will also group symlinks to directories. 'test -a FILE' is not supported anymore. Long ago, there were concerns about the high probability of humans confusing the -a primary with the -a binary operator, so POSIX changed this to 'test -e FILE'. Scripts using it were already broken and non-portable; the -a unary operator was never documented. wc now treats non breaking space characters as word delimiters unless the POSIXLY_CORRECT environment variable is set. * * New features id now supports specifying multiple users. 'date' now supports the '+' conversion specification flag, introduced in POSIX.1-2017. printf, seq, sleep, tail, and timeout now accept floating point numbers in either the current or the C locale. For example, if the current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1' now mean the same thing. Previously, these commands accepted only C-locale syntax with '.' as the decimal point. The new behavior is more compatible with other implementations in non-C locales. test now supports the '-N FILE' unary operator (like e.g. bash) to check whether FILE exists and has been modified since it was last read. env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and '--block-signal[=SIG], to setup signal handling before executing a program. env now supports '--list-signal-handling' to indicate non-default signal handling before executing a program. * * New commands basenc is added to complement existing base64,base32 commands, and encodes and decodes printable text using various common encodings: base64,base64url,base32,base32hex,base16,base2,z85. * * Improvements ls -l now better aligns abbreviated months containing digits, which is common in Asian locales. stat and tail now know about the "sdcardfs" file system on Android. stat -f -c%T now reports the file system type, and tail -f uses inotify. stat now prints file creation time when supported by the file system, on GNU Linux systems with glibc >= 2.28 and kernel >= 4.11. - Refresh patches (line number changes only): * coreutils-disable_tests.patch * coreutils-i18n.patch * coreutils-misc.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils.spec: * Version: bump version. * URL: Use https scheme. * %description: Add 'basenc' tool. * Change gitweb to cgit URL with https in a comment. - coreutils.keyring: * Update for added section headers ('GPG keys of <MAINTAINER>'). - Do not recommend lang package. The lang package already has a supplements. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays - minor: remove obsolete comment in spec file. - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - Update to 8.32: * Noteworthy changes in release 8.32 (2020-03-05) [stable] * * Bug fixes cp now copies /dev/fd/N correctly on platforms like Solaris where it is a character-special file whose minor device number is N. [bug introduced in fileutils-4.1.6] dd conv=fdatasync no longer reports a "Bad file descriptor" error when fdatasync is interrupted, and dd now retries interrupted calls to close, fdatasync, fstat and fsync instead of incorrectly reporting an "Interrupted system call" error. [bugs introduced in coreutils-6.0] df now correctly parses the /proc/self/mountinfo file for unusual entries like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"), when the source field is empty ('mount -t tmpfs "" /mnt'), and when the filesystem type contains characters like a blank which need escaping. [bugs introduced in coreutils-8.24 with the introduction of reading the /proc/self/mountinfo file] factor again outputs immediately when stdout is a tty but stdin is not. [bug introduced in coreutils-8.24] ln works again on old systems without O_DIRECTORY support (like Solaris 10), and on systems where symlink ("x", ".") fails with errno == EINVAL (like Solaris 10 and Solaris 11). [bug introduced in coreutils-8.31] rmdir --ignore-fail-on-non-empty now works correctly for directories that fail to be removed due to permission issues. Previously the exit status was reversed, failing for non empty and succeeding for empty directories. [bug introduced in coreutils-6.11] 'shuf -r -n 0 file' no longer mistakenly reads from standard input. [bug introduced with the --repeat feature in coreutils-8.22] split no longer reports a "output file suffixes exhausted" error when the specified number of files is evenly divisible by 10, 16, 26, for --numeric, --hex, or default alphabetic suffixes respectively. [bug introduced in coreutils-8.24] seq no longer prints an extra line under certain circumstances (such as 'seq -f "%g " 1000000 1000000'). [bug introduced in coreutils-6.10] * * Changes in behavior Several programs now check that numbers end properly. For example, 'du -d 1x' now reports an error instead of silently ignoring the 'x'. Affected programs and options include du -d, expr's numeric operands on non-GMP builds, install -g and -o, ls's TABSIZE environment variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size and --parallel. date now parses military time zones in accordance with common usage: "A" to "M" are equivalent to UTC+1 to UTC+12 "N" to "Y" are equivalent to UTC-1 to UTC-12 "Z" is "zulu" time (UTC). For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone. Previously, military time zones were parsed according to the obsolete rfc822, with their value negated (e.g., "B" was equivalent to UTC-2). [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating coreutils package.] ls issues an error message on a removed directory, on GNU/Linux systems. Previously no error and no entries were output, and so indistinguishable from an empty directory, with default ls options. uniq no longer uses strcoll() to determine string equivalence, and so will operate more efficiently and consistently. * * New Features ls now supports the --time=birth option to display and sort by file creation time, where available. od --skip-bytes now can use lseek even if the input is not a regular file, greatly improving performance in some cases. stat(1) supports a new --cached= option, used on systems with statx(2) to control cache coherency of file system attributes, useful on network file systems. * * Improvements stat and ls now use the statx() system call where available, which can operate more efficiently by only retrieving requested attributes. stat and tail now know about the "binderfs", "dma-buf-fs", "erofs", "ppc-cmm-fs", and "z3fold" file systems. stat -f -c%T now reports the file system type, and tail -f uses inotify. * * Build-related gzip-compressed tarballs are distributed once again - Refresh patches: * coreutils-disable_tests.patch * coreutils-getaddrinfo.patch * coreutils-i18n.patch * coreutils-invalid-ids.patch * coreutils-remove_hostname_documentation.patch * coreutils-remove_kill_documentation.patch * coreutils-skip-gnulib-test-tls.patch * coreutils-tests-shorten-extreme-factor-tests.patch - coreutils-i18n.patch: * uniq: remove collation handling as required by newer POSIX; see - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5 - https://www.austingroupbugs.net/view.php?id=963 - coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch: * Add patch for 'ls' to restore 8.31 behavior on removed directories. - coreutils.spec: * Version: bump version. * %check: re-enable regular 'make check' for non-multibuild package. * reference the above new patch. - coreutils.keyring: * Update from upstream (Savannah). - add coreutils-use-python3.patch to minimally port away from python 2.x use of pyinotify in the testsuite - coreutils-gnulib-disable-test-float.patch: Add patch to temporarily disable the gnulib test 'test-float' failing on ppc and ppc64le. - coreutils.spec: Reference the patch. While at it, avoid conditional Patch and Source entries as that break cross-platform builds from source RPMs. - Drop suse-module-tools BuildRequires: this was used for the macro regenerate_initrd_post/posttrans, which have been moved to rpm-config-SUSE in Jan 2019. - gnulib-test-avoid-FP-perror-strerror.patch: Add patch to avoid false-positive error in gnulib tests 'test-perror2' and 'test-strerror_r', visible on armv7l. - coreutils.spec: Reference the patch. - prepare usrmerge (boo#1029961) - coreutils-df-fuse-portal-dummy.patch: df: Add "fuse.portal" as a dummy file system (used in flatpak implementations). (bsc#1189152) - tail: fix tailing sysfs files where PAGE_SIZE > BUFSIZ (bsc#1219321) - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch - ls: avoid triggering automounts (bsc#1221632) - add coreutils-ls-avoid-triggering-automounts.patch - add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds write in a way cpio parses certain cpio files [bsc#963448], [CVE-2016-2037] - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds write in a way cpio parses certain cpio files [bsc#963448], [CVE-2016-2037] - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds write in a way cpio parses certain cpio files [bsc#963448], [CVE-2016-2037] - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds write in a way cpio parses certain cpio files [bsc#963448], [CVE-2016-2037] - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - Fix cpio not working after the fix in bsc#1218571, fixes bsc#1219238 * fix-bsc1219238.patch - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - Fix cpio not working after the fix in bsc#1218571, fixes bsc#1219238 * fix-bsc1219238.patch - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - Fix cpio not working after the fix in bsc#1218571, fixes bsc#1219238 * fix-bsc1219238.patch - Disable mt building: this binary from mt_st package offers advanced capabilities with the same functionality. - Enable rmt building: 'dump' package no longer include it, besides cpio code base for rmt is more fresh. - Reflect those changes in the package description. - fix typos in the description - add 'Require: mt_st' in order not to surprise users by the missing 'mt' binary - Recommend mt_st as it is not hard dependency - cleanup with spec-cleaner - Enable mt building - Separated cpio-mt subpackge - Change recommend to own mt subpackge - Remove cpio-mt.patch - those features available in original mt-st package - Switch to use alternatives system for mt - Disable rmt building: this binary fully identical to rmt from tar - Change default rmt dir to /usr/bin - Use macro for configure and make install - Use update-alternatives according to current documentation - Enable testsuite - modify cpio-2.12-out_of_bounds_write.patch to fix a regression causing cpio to crash for tar and ustar archive types [bsc#1028410] - Use URL to fetch keyring - Do not force building with PIE, it is default now anyways - Use https for URLs - Install license - Use gettextize --no-changelog to drop build date to make package build reproducible (boo#1047218) - Do not recommend lang package. The lang package already has a supplements. - add cpio-2.12-CVE-2019-14866.patch to fix a security issue where cpio does not properly validate the values written in the header of a TAR file through the to_oct() function [bsc#1155199] [CVE-2019-14866] - starting with GCC 10, the default of '-fcommon' option will change to '-fno-common'. Because cpio build fails with 'fno-common', add '-fcommon' option to optflags as a temporary workaround for this problem till it's properly fixed [bsc#1160870] - update to 2.13: * CVE-2015-1197, CVE-2016-2037, CVE-2019-14866 - remove patches (upstream): cpio-2.12-out_of_bounds_write.patch, cpio-2.12-CVE-2019-14866.patch, cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch, cpio-check_for_symlinks.patch - add cpio-revert-CVE-2015-1197-fix.patch as recommended by upstream to fix https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00016.html - prepare usrmerge (boo#1029961) - Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr (CVE-2021-38185, bsc#1189206) * fix-CVE-2021-38185.patch - Fix regression in last update (bsc#1189465) * fix-CVE-2021-38185_2.patch * fix-CVE-2021-38185_3.patch - Update keyring - Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571) * fix-CVE-2023-7207.patch - Fix cpio not working after the fix in bsc#1218571, fixes bsc#1219238 * fix-bsc1219238.patch - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - Add crypto-policies-typos.patch to fix some typos - Test only supported modules - Add crypto-policies-test_supported_modules_only.patch - Fix the man pages generation - Add crypto-policies-asciidoc.patch - Update to git version 20210118 * Output sigalgs required by nss >=3.59 * Bump Python requirement to 3.6 * Kerberos 5: Fix policy generator to account for macs * Add AES-192 support (non-TLS scenarios) * Add documentation of the --check option - Update to git version 20210127 * Bump Python requirement to 3.6 * Output sigalgs required by nss >=3.59 * Do not require bind during build * Break build cycles with openssl and gnutls - Convert to use a proper git source _service: + To update, one just needs to update the commit/revision in the _service file and run `osc service dr`. + The version of the package is defined by the commit date of the revision, followed by the abbreviated git hash (The same revision used before results thus in a downgrade to 20210118, but as this is a alltime new package, this is acceptable. - Do not build the manpages to avoid build cycles - Add crypto-policies-no-build-manpages.patch - Use gzip instead of xz in obscpio and sources - Add a BuildIgnore for crypto-policies - Use tar_scm service, not obs_scm: With crypto-policies entering Ring0 (distro bootstrap) we want to be sure to keep the buildtime deps as low as possible. - Add python3-base BuildRequires: previously, OBS' tar service pulled this in for us. - Update to version 20210213.5c710c0: [bsc#1180938] * setup_directories(): perform safer creation of directories * save_config(): avoid re-opening output file for each iteration * save_config(): break after first match to avoid unnecessary stat() calls * CryptoPolicy.parse(): actually stop parsing line on syntax error * ProfileConfig.parse_string(): correctly extended subpolicies * Exclude RC4 from LEGACY * Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT * code style: fix 'not in' membership testing * pylintrc: tighten up a bit * formatting: avoid long lines * formatting: use f-strings instead of format() * formatting: reformat all python code with autopep8 * nss: postponing the version check again, to 3.61 * Revert "Unfortunately we have to keep ignoring the openssh check for sk-" - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938] * The minimum DTLS protocol version in the DEFAULT and FUTURE policies is DTLS1.2. * Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e - Remove not needed scripts: fips-finish-install fips-mode-setup - Update to version 20210225.05203d2: * Disable DTLS0.9 protocol in the DEFAULT policy. * policies/FIPS: insignificant reformatting * policygenerators/libssh: respect ssh_certs * policies/modules/OSPP: tighten to follow RHEL 8 * crypto-policies(7): drop not-reenableable comment * follow up on disabling RC4 - Update to version 20210917.c9d86d1: * openssl: fix disabling ChaCha20 * pacify pylint 2.11: use format strings * pacify pylint 2.11: specify explicit encoding * fix minor things found by new pylint * update-crypto-policies: --check against regenerated * update-crypto-policies: fix --check's walking order * policygenerators/gnutls: revert disabling DTLS0.9... * policygenerators/java: add javasystem backend * LEGACY: bump 1023 key size to 1024 * cryptopolicies: fix 'and' in deprecation warnings * *ssh: condition ecdh-sha2-nistp384 on SECP384R1 * nss: hopefully the last fix for nss sigalgs check * cryptopolicies: Python 3.10 compatibility * nss: postponing check + testing at least something * Rename 'policy modules' to 'subpolicies' * validation.rules: fix a missing word in error * cryptopolicies: raise errors right after warnings * update-crypto-policies: capitalize warnings * cryptopolicies: syntax-precheck scope errors * .gitlab-ci.yml, Makefile: enable codespell * all: fix several typos * docs: don't leave zero TLS/DTLS protocols on * openssl: separate TLS/DTLS MinProtocol/MaxProtocol * alg_lists: order protocols new-to-old for consistency * alg_lists: max_{d,}tls_version * update-crypto-policies: fix pregenerated + local.d * openssh: allow validation with pre-8.5 * .gitlab-ci.yml: run commit-range against upstream * openssh: Use the new name for PubkeyAcceptedKeyTypes * sha1_in_dnssec: deprecate * .gitlab-ci.yml: test commit ranges * FIPS:OSPP: sign = -*-SHA2-224 * scoped policies: documentation update * scoped policies: use new features to the fullest... * scoped policies: rewrite + minimal policy changes * scoped policies: rewrite preparations * nss: postponing the version check again, to 3.64 - Remove patches fixed upstream: crypto-policies-typos.patch - Rebase: crypto-policies-test_supported_modules_only.patch - Merge crypto-policies-asciidoc.patch into crypto-policies-no-build-manpages.patch - Remove the scripts and documentation regarding fips-finish-install and test-fips-setup * Add crypto-policies-FIPS.patch - Update the update-crypto-policies(8) man pages and README.SUSE to mention the supported back-end policies. [bsc#1209998] - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup and fips-finish-install commands, add also the man pages. * Adapt the fips-mode-setup script for SLE [jsc#PED-5041] * Rebase crypto-policies-FIPS.patch * Simplify the man pages creation: - Rebase crypto-policies-no-build-manpages.patch - Add crypto-policies-asciidoc.patch - FIPS: Adapt the fips-mode-setup script to use the pbl command from the perl-Bootloader package to replace grubby. Add a note for transactional systems. Ship the man 8 pages for fips-mode-setup and fips-finish-install [jsc#PED-5041]. * Rebase crypto-policies-FIPS.patch - Make the supported versions change in the update-crypto-policies(8) man page persistent [bsc#1209998]. * Add patch crypto-policies-supported.patch * Rebase patches: - crypto-policies-asciidoc.patch - crypto-policies-no-build-manpages.patch - Add crypto-policies-typos.patch to fix some typos - Test only supported modules - Add crypto-policies-test_supported_modules_only.patch - Fix the man pages generation - Add crypto-policies-asciidoc.patch - Update to git version 20210118 * Output sigalgs required by nss >=3.59 * Bump Python requirement to 3.6 * Kerberos 5: Fix policy generator to account for macs * Add AES-192 support (non-TLS scenarios) * Add documentation of the --check option - Update to git version 20210127 * Bump Python requirement to 3.6 * Output sigalgs required by nss >=3.59 * Do not require bind during build * Break build cycles with openssl and gnutls - Convert to use a proper git source _service: + To update, one just needs to update the commit/revision in the _service file and run `osc service dr`. + The version of the package is defined by the commit date of the revision, followed by the abbreviated git hash (The same revision used before results thus in a downgrade to 20210118, but as this is a alltime new package, this is acceptable. - Do not build the manpages to avoid build cycles - Add crypto-policies-no-build-manpages.patch - Use gzip instead of xz in obscpio and sources - Add a BuildIgnore for crypto-policies - Use tar_scm service, not obs_scm: With crypto-policies entering Ring0 (distro bootstrap) we want to be sure to keep the buildtime deps as low as possible. - Add python3-base BuildRequires: previously, OBS' tar service pulled this in for us. - Update to version 20210213.5c710c0: [bsc#1180938] * setup_directories(): perform safer creation of directories * save_config(): avoid re-opening output file for each iteration * save_config(): break after first match to avoid unnecessary stat() calls * CryptoPolicy.parse(): actually stop parsing line on syntax error * ProfileConfig.parse_string(): correctly extended subpolicies * Exclude RC4 from LEGACY * Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT * code style: fix 'not in' membership testing * pylintrc: tighten up a bit * formatting: avoid long lines * formatting: use f-strings instead of format() * formatting: reformat all python code with autopep8 * nss: postponing the version check again, to 3.61 * Revert "Unfortunately we have to keep ignoring the openssh check for sk-" - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938] * The minimum DTLS protocol version in the DEFAULT and FUTURE policies is DTLS1.2. * Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e - Remove not needed scripts: fips-finish-install fips-mode-setup - Update to version 20210225.05203d2: * Disable DTLS0.9 protocol in the DEFAULT policy. * policies/FIPS: insignificant reformatting * policygenerators/libssh: respect ssh_certs * policies/modules/OSPP: tighten to follow RHEL 8 * crypto-policies(7): drop not-reenableable comment * follow up on disabling RC4 - Update to version 20210917.c9d86d1: * openssl: fix disabling ChaCha20 * pacify pylint 2.11: use format strings * pacify pylint 2.11: specify explicit encoding * fix minor things found by new pylint * update-crypto-policies: --check against regenerated * update-crypto-policies: fix --check's walking order * policygenerators/gnutls: revert disabling DTLS0.9... * policygenerators/java: add javasystem backend * LEGACY: bump 1023 key size to 1024 * cryptopolicies: fix 'and' in deprecation warnings * *ssh: condition ecdh-sha2-nistp384 on SECP384R1 * nss: hopefully the last fix for nss sigalgs check * cryptopolicies: Python 3.10 compatibility * nss: postponing check + testing at least something * Rename 'policy modules' to 'subpolicies' * validation.rules: fix a missing word in error * cryptopolicies: raise errors right after warnings * update-crypto-policies: capitalize warnings * cryptopolicies: syntax-precheck scope errors * .gitlab-ci.yml, Makefile: enable codespell * all: fix several typos * docs: don't leave zero TLS/DTLS protocols on * openssl: separate TLS/DTLS MinProtocol/MaxProtocol * alg_lists: order protocols new-to-old for consistency * alg_lists: max_{d,}tls_version * update-crypto-policies: fix pregenerated + local.d * openssh: allow validation with pre-8.5 * .gitlab-ci.yml: run commit-range against upstream * openssh: Use the new name for PubkeyAcceptedKeyTypes * sha1_in_dnssec: deprecate * .gitlab-ci.yml: test commit ranges * FIPS:OSPP: sign = -*-SHA2-224 * scoped policies: documentation update * scoped policies: use new features to the fullest... * scoped policies: rewrite + minimal policy changes * scoped policies: rewrite preparations * nss: postponing the version check again, to 3.64 - Remove patches fixed upstream: crypto-policies-typos.patch - Rebase: crypto-policies-test_supported_modules_only.patch - Merge crypto-policies-asciidoc.patch into crypto-policies-no-build-manpages.patch - Remove the scripts and documentation regarding fips-finish-install and test-fips-setup * Add crypto-policies-FIPS.patch - Update the update-crypto-policies(8) man pages and README.SUSE to mention the supported back-end policies. [bsc#1209998] - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup and fips-finish-install commands, add also the man pages. * Adapt the fips-mode-setup script for SLE [jsc#PED-5041] * Rebase crypto-policies-FIPS.patch * Simplify the man pages creation: - Rebase crypto-policies-no-build-manpages.patch - Add crypto-policies-asciidoc.patch - FIPS: Adapt the fips-mode-setup script to use the pbl command from the perl-Bootloader package to replace grubby. Add a note for transactional systems. Ship the man 8 pages for fips-mode-setup and fips-finish-install [jsc#PED-5041]. * Rebase crypto-policies-FIPS.patch - Make the supported versions change in the update-crypto-policies(8) man page persistent [bsc#1209998]. * Add patch crypto-policies-supported.patch * Rebase patches: - crypto-policies-asciidoc.patch - crypto-policies-no-build-manpages.patch - Add crypto-policies-typos.patch to fix some typos - Test only supported modules - Add crypto-policies-test_supported_modules_only.patch - Fix the man pages generation - Add crypto-policies-asciidoc.patch - Update to git version 20210118 * Output sigalgs required by nss >=3.59 * Bump Python requirement to 3.6 * Kerberos 5: Fix policy generator to account for macs * Add AES-192 support (non-TLS scenarios) * Add documentation of the --check option - Update to git version 20210127 * Bump Python requirement to 3.6 * Output sigalgs required by nss >=3.59 * Do not require bind during build * Break build cycles with openssl and gnutls - Convert to use a proper git source _service: + To update, one just needs to update the commit/revision in the _service file and run `osc service dr`. + The version of the package is defined by the commit date of the revision, followed by the abbreviated git hash (The same revision used before results thus in a downgrade to 20210118, but as this is a alltime new package, this is acceptable. - Do not build the manpages to avoid build cycles - Add crypto-policies-no-build-manpages.patch - Use gzip instead of xz in obscpio and sources - Add a BuildIgnore for crypto-policies - Use tar_scm service, not obs_scm: With crypto-policies entering Ring0 (distro bootstrap) we want to be sure to keep the buildtime deps as low as possible. - Add python3-base BuildRequires: previously, OBS' tar service pulled this in for us. - Update to version 20210213.5c710c0: [bsc#1180938] * setup_directories(): perform safer creation of directories * save_config(): avoid re-opening output file for each iteration * save_config(): break after first match to avoid unnecessary stat() calls * CryptoPolicy.parse(): actually stop parsing line on syntax error * ProfileConfig.parse_string(): correctly extended subpolicies * Exclude RC4 from LEGACY * Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT * code style: fix 'not in' membership testing * pylintrc: tighten up a bit * formatting: avoid long lines * formatting: use f-strings instead of format() * formatting: reformat all python code with autopep8 * nss: postponing the version check again, to 3.61 * Revert "Unfortunately we have to keep ignoring the openssh check for sk-" - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938] * The minimum DTLS protocol version in the DEFAULT and FUTURE policies is DTLS1.2. * Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e - Remove not needed scripts: fips-finish-install fips-mode-setup - Update to version 20210225.05203d2: * Disable DTLS0.9 protocol in the DEFAULT policy. * policies/FIPS: insignificant reformatting * policygenerators/libssh: respect ssh_certs * policies/modules/OSPP: tighten to follow RHEL 8 * crypto-policies(7): drop not-reenableable comment * follow up on disabling RC4 - Update to version 20210917.c9d86d1: * openssl: fix disabling ChaCha20 * pacify pylint 2.11: use format strings * pacify pylint 2.11: specify explicit encoding * fix minor things found by new pylint * update-crypto-policies: --check against regenerated * update-crypto-policies: fix --check's walking order * policygenerators/gnutls: revert disabling DTLS0.9... * policygenerators/java: add javasystem backend * LEGACY: bump 1023 key size to 1024 * cryptopolicies: fix 'and' in deprecation warnings * *ssh: condition ecdh-sha2-nistp384 on SECP384R1 * nss: hopefully the last fix for nss sigalgs check * cryptopolicies: Python 3.10 compatibility * nss: postponing check + testing at least something * Rename 'policy modules' to 'subpolicies' * validation.rules: fix a missing word in error * cryptopolicies: raise errors right after warnings * update-crypto-policies: capitalize warnings * cryptopolicies: syntax-precheck scope errors * .gitlab-ci.yml, Makefile: enable codespell * all: fix several typos * docs: don't leave zero TLS/DTLS protocols on * openssl: separate TLS/DTLS MinProtocol/MaxProtocol * alg_lists: order protocols new-to-old for consistency * alg_lists: max_{d,}tls_version * update-crypto-policies: fix pregenerated + local.d * openssh: allow validation with pre-8.5 * .gitlab-ci.yml: run commit-range against upstream * openssh: Use the new name for PubkeyAcceptedKeyTypes * sha1_in_dnssec: deprecate * .gitlab-ci.yml: test commit ranges * FIPS:OSPP: sign = -*-SHA2-224 * scoped policies: documentation update * scoped policies: use new features to the fullest... * scoped policies: rewrite + minimal policy changes * scoped policies: rewrite preparations * nss: postponing the version check again, to 3.64 - Remove patches fixed upstream: crypto-policies-typos.patch - Rebase: crypto-policies-test_supported_modules_only.patch - Merge crypto-policies-asciidoc.patch into crypto-policies-no-build-manpages.patch - Remove the scripts and documentation regarding fips-finish-install and test-fips-setup * Add crypto-policies-FIPS.patch - Update the update-crypto-policies(8) man pages and README.SUSE to mention the supported back-end policies. [bsc#1209998] - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup and fips-finish-install commands, add also the man pages. * Adapt the fips-mode-setup script for SLE [jsc#PED-5041] * Rebase crypto-policies-FIPS.patch * Simplify the man pages creation: - Rebase crypto-policies-no-build-manpages.patch - Add crypto-policies-asciidoc.patch - FIPS: Adapt the fips-mode-setup script to use the pbl command from the perl-Bootloader package to replace grubby. Add a note for transactional systems. Ship the man 8 pages for fips-mode-setup and fips-finish-install [jsc#PED-5041]. * Rebase crypto-policies-FIPS.patch - Make the supported versions change in the update-crypto-policies(8) man page persistent [bsc#1209998]. * Add patch crypto-policies-supported.patch * Rebase patches: - crypto-policies-asciidoc.patch - crypto-policies-no-build-manpages.patch - Add crypto-policies-typos.patch to fix some typos - Test only supported modules - Add crypto-policies-test_supported_modules_only.patch - Fix the man pages generation - Add crypto-policies-asciidoc.patch - Update to git version 20210118 * Output sigalgs required by nss >=3.59 * Bump Python requirement to 3.6 * Kerberos 5: Fix policy generator to account for macs * Add AES-192 support (non-TLS scenarios) * Add documentation of the --check option - Update to git version 20210127 * Bump Python requirement to 3.6 * Output sigalgs required by nss >=3.59 * Do not require bind during build * Break build cycles with openssl and gnutls - Convert to use a proper git source _service: + To update, one just needs to update the commit/revision in the _service file and run `osc service dr`. + The version of the package is defined by the commit date of the revision, followed by the abbreviated git hash (The same revision used before results thus in a downgrade to 20210118, but as this is a alltime new package, this is acceptable. - Do not build the manpages to avoid build cycles - Add crypto-policies-no-build-manpages.patch - Use gzip instead of xz in obscpio and sources - Add a BuildIgnore for crypto-policies - Use tar_scm service, not obs_scm: With crypto-policies entering Ring0 (distro bootstrap) we want to be sure to keep the buildtime deps as low as possible. - Add python3-base BuildRequires: previously, OBS' tar service pulled this in for us. - Update to version 20210213.5c710c0: [bsc#1180938] * setup_directories(): perform safer creation of directories * save_config(): avoid re-opening output file for each iteration * save_config(): break after first match to avoid unnecessary stat() calls * CryptoPolicy.parse(): actually stop parsing line on syntax error * ProfileConfig.parse_string(): correctly extended subpolicies * Exclude RC4 from LEGACY * Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT * code style: fix 'not in' membership testing * pylintrc: tighten up a bit * formatting: avoid long lines * formatting: use f-strings instead of format() * formatting: reformat all python code with autopep8 * nss: postponing the version check again, to 3.61 * Revert "Unfortunately we have to keep ignoring the openssh check for sk-" - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938] * The minimum DTLS protocol version in the DEFAULT and FUTURE policies is DTLS1.2. * Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e - Remove not needed scripts: fips-finish-install fips-mode-setup - Update to version 20210225.05203d2: * Disable DTLS0.9 protocol in the DEFAULT policy. * policies/FIPS: insignificant reformatting * policygenerators/libssh: respect ssh_certs * policies/modules/OSPP: tighten to follow RHEL 8 * crypto-policies(7): drop not-reenableable comment * follow up on disabling RC4 - Update to version 20210917.c9d86d1: * openssl: fix disabling ChaCha20 * pacify pylint 2.11: use format strings * pacify pylint 2.11: specify explicit encoding * fix minor things found by new pylint * update-crypto-policies: --check against regenerated * update-crypto-policies: fix --check's walking order * policygenerators/gnutls: revert disabling DTLS0.9... * policygenerators/java: add javasystem backend * LEGACY: bump 1023 key size to 1024 * cryptopolicies: fix 'and' in deprecation warnings * *ssh: condition ecdh-sha2-nistp384 on SECP384R1 * nss: hopefully the last fix for nss sigalgs check * cryptopolicies: Python 3.10 compatibility * nss: postponing check + testing at least something * Rename 'policy modules' to 'subpolicies' * validation.rules: fix a missing word in error * cryptopolicies: raise errors right after warnings * update-crypto-policies: capitalize warnings * cryptopolicies: syntax-precheck scope errors * .gitlab-ci.yml, Makefile: enable codespell * all: fix several typos * docs: don't leave zero TLS/DTLS protocols on * openssl: separate TLS/DTLS MinProtocol/MaxProtocol * alg_lists: order protocols new-to-old for consistency * alg_lists: max_{d,}tls_version * update-crypto-policies: fix pregenerated + local.d * openssh: allow validation with pre-8.5 * .gitlab-ci.yml: run commit-range against upstream * openssh: Use the new name for PubkeyAcceptedKeyTypes * sha1_in_dnssec: deprecate * .gitlab-ci.yml: test commit ranges * FIPS:OSPP: sign = -*-SHA2-224 * scoped policies: documentation update * scoped policies: use new features to the fullest... * scoped policies: rewrite + minimal policy changes * scoped policies: rewrite preparations * nss: postponing the version check again, to 3.64 - Remove patches fixed upstream: crypto-policies-typos.patch - Rebase: crypto-policies-test_supported_modules_only.patch - Merge crypto-policies-asciidoc.patch into crypto-policies-no-build-manpages.patch - Remove the scripts and documentation regarding fips-finish-install and test-fips-setup * Add crypto-policies-FIPS.patch - Update the update-crypto-policies(8) man pages and README.SUSE to mention the supported back-end policies. [bsc#1209998] - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup and fips-finish-install commands, add also the man pages. * Adapt the fips-mode-setup script for SLE [jsc#PED-5041] * Rebase crypto-policies-FIPS.patch * Simplify the man pages creation: - Rebase crypto-policies-no-build-manpages.patch - Add crypto-policies-asciidoc.patch - FIPS: Adapt the fips-mode-setup script to use the pbl command from the perl-Bootloader package to replace grubby. Add a note for transactional systems. Ship the man 8 pages for fips-mode-setup and fips-finish-install [jsc#PED-5041]. * Rebase crypto-policies-FIPS.patch - Make the supported versions change in the update-crypto-policies(8) man page persistent [bsc#1209998]. * Add patch crypto-policies-supported.patch * Rebase patches: - crypto-policies-asciidoc.patch - crypto-policies-no-build-manpages.patch - Add crypto-policies-typos.patch to fix some typos - Test only supported modules - Add crypto-policies-test_supported_modules_only.patch - Fix the man pages generation - Add crypto-policies-asciidoc.patch - Update to git version 20210118 * Output sigalgs required by nss >=3.59 * Bump Python requirement to 3.6 * Kerberos 5: Fix policy generator to account for macs * Add AES-192 support (non-TLS scenarios) * Add documentation of the --check option - Update to git version 20210127 * Bump Python requirement to 3.6 * Output sigalgs required by nss >=3.59 * Do not require bind during build * Break build cycles with openssl and gnutls - Convert to use a proper git source _service: + To update, one just needs to update the commit/revision in the _service file and run `osc service dr`. + The version of the package is defined by the commit date of the revision, followed by the abbreviated git hash (The same revision used before results thus in a downgrade to 20210118, but as this is a alltime new package, this is acceptable. - Do not build the manpages to avoid build cycles - Add crypto-policies-no-build-manpages.patch - Use gzip instead of xz in obscpio and sources - Add a BuildIgnore for crypto-policies - Use tar_scm service, not obs_scm: With crypto-policies entering Ring0 (distro bootstrap) we want to be sure to keep the buildtime deps as low as possible. - Add python3-base BuildRequires: previously, OBS' tar service pulled this in for us. - Update to version 20210213.5c710c0: [bsc#1180938] * setup_directories(): perform safer creation of directories * save_config(): avoid re-opening output file for each iteration * save_config(): break after first match to avoid unnecessary stat() calls * CryptoPolicy.parse(): actually stop parsing line on syntax error * ProfileConfig.parse_string(): correctly extended subpolicies * Exclude RC4 from LEGACY * Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT * code style: fix 'not in' membership testing * pylintrc: tighten up a bit * formatting: avoid long lines * formatting: use f-strings instead of format() * formatting: reformat all python code with autopep8 * nss: postponing the version check again, to 3.61 * Revert "Unfortunately we have to keep ignoring the openssh check for sk-" - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938] * The minimum DTLS protocol version in the DEFAULT and FUTURE policies is DTLS1.2. * Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e - Remove not needed scripts: fips-finish-install fips-mode-setup - Update to version 20210225.05203d2: * Disable DTLS0.9 protocol in the DEFAULT policy. * policies/FIPS: insignificant reformatting * policygenerators/libssh: respect ssh_certs * policies/modules/OSPP: tighten to follow RHEL 8 * crypto-policies(7): drop not-reenableable comment * follow up on disabling RC4 - Update to version 20210917.c9d86d1: * openssl: fix disabling ChaCha20 * pacify pylint 2.11: use format strings * pacify pylint 2.11: specify explicit encoding * fix minor things found by new pylint * update-crypto-policies: --check against regenerated * update-crypto-policies: fix --check's walking order * policygenerators/gnutls: revert disabling DTLS0.9... * policygenerators/java: add javasystem backend * LEGACY: bump 1023 key size to 1024 * cryptopolicies: fix 'and' in deprecation warnings * *ssh: condition ecdh-sha2-nistp384 on SECP384R1 * nss: hopefully the last fix for nss sigalgs check * cryptopolicies: Python 3.10 compatibility * nss: postponing check + testing at least something * Rename 'policy modules' to 'subpolicies' * validation.rules: fix a missing word in error * cryptopolicies: raise errors right after warnings * update-crypto-policies: capitalize warnings * cryptopolicies: syntax-precheck scope errors * .gitlab-ci.yml, Makefile: enable codespell * all: fix several typos * docs: don't leave zero TLS/DTLS protocols on * openssl: separate TLS/DTLS MinProtocol/MaxProtocol * alg_lists: order protocols new-to-old for consistency * alg_lists: max_{d,}tls_version * update-crypto-policies: fix pregenerated + local.d * openssh: allow validation with pre-8.5 * .gitlab-ci.yml: run commit-range against upstream * openssh: Use the new name for PubkeyAcceptedKeyTypes * sha1_in_dnssec: deprecate * .gitlab-ci.yml: test commit ranges * FIPS:OSPP: sign = -*-SHA2-224 * scoped policies: documentation update * scoped policies: use new features to the fullest... * scoped policies: rewrite + minimal policy changes * scoped policies: rewrite preparations * nss: postponing the version check again, to 3.64 - Remove patches fixed upstream: crypto-policies-typos.patch - Rebase: crypto-policies-test_supported_modules_only.patch - Merge crypto-policies-asciidoc.patch into crypto-policies-no-build-manpages.patch - Remove the scripts and documentation regarding fips-finish-install and test-fips-setup * Add crypto-policies-FIPS.patch - Update the update-crypto-policies(8) man pages and README.SUSE to mention the supported back-end policies. [bsc#1209998] - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup and fips-finish-install commands, add also the man pages. * Adapt the fips-mode-setup script for SLE [jsc#PED-5041] * Rebase crypto-policies-FIPS.patch * Simplify the man pages creation: - Rebase crypto-policies-no-build-manpages.patch - Add crypto-policies-asciidoc.patch - FIPS: Adapt the fips-mode-setup script to use the pbl command from the perl-Bootloader package to replace grubby. Add a note for transactional systems. Ship the man 8 pages for fips-mode-setup and fips-finish-install [jsc#PED-5041]. * Rebase crypto-policies-FIPS.patch - Make the supported versions change in the update-crypto-policies(8) man page persistent [bsc#1209998]. * Add patch crypto-policies-supported.patch * Rebase patches: - crypto-policies-asciidoc.patch - crypto-policies-no-build-manpages.patch - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - Cleanup spec file with spec-cleaner - Add gpg signature - dmidecode.keyring was empty, reference the savannah keyring. but the tarball is signed by someone unknown without gpg signatures, so no keyring for now. - Update to upstream version 3.0 (FATE#320746, FATE#320773): * Adds support for SMBIOS 3.0. This includes a new (64-bit) entry point format and new enumerated values for recent hardware. * Adds support for the new kernel interface (as of Linux v4.2) as an alternative to relying on /dev/mem to access the entry point and DMI table. * Adds decoding of Acer-specific DMI type 170 and HP-specific DMI types 212, 219 and 233. * Obsoletes dmidecode-1.173-drop-cast.patch, dmidecode-1.175-fix-SMBIOS-2.8.0.patch, dmidecode-1.176-SMBIOS-2.8-is-supported.patch, dmidecode-1.177-decode-pcie3-slot-id.patch, dmidecode-1.181-decode-CPUID-recent-AMD.patch, and dmidecode-1.182-decode-ddr4-memory-type.patch. * Various minor fixes and clean-ups. * Skip the SMBIOS version comparison in quiet mode (bsc#974862). - dmidecode-01-add-no-sysfs-option-description-to-h-output.patch: Add "--no-sysfs" option description to -h output. - dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch: Fix 'No SMBIOS nor DMI entry point found' on SMBIOS3. - dmidecode-03-let-read_file-return-the-actual-data-size.patch: Let read_file return the actual data size. - dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch: Use read_file() to read the DMI table from sysfs. https://savannah.nongnu.org/bugs/?46176 - dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch: Use DWORD for Structure table maximum size in SMBIOS3. - dmidecode-06-hide-irrelevant-fixup-message.patch: Hide irrelevant fixup message. http://savannah.nongnu.org/support/?109024 - dmidecode-07-only-decode-one-dmi-table.patch: Only decode one DMI table. https://savannah.nongnu.org/bugs/?50022 - Update to upstream version 3.1: * Support for SMBIOS 3.1.0 and 3.1.1. This includes new chassis types, new processor family names, new processor family upgrade names, and new slot types, as well as support of larger BIOS ROM sizes and cache sizes, and a new structure type (43, TPM Device.) * A new command line option to query OEM strings. * All error messages are now printed on stderr (#47274, #48158.) * Fixes a crash with SIGBUS (#46066.) * Various minor fixes, improvements and cleanups. * Obsoletes dmidecode-01-add-no-sysfs-option-description-to-h-output.patch, dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch, dmidecode-03-let-read_file-return-the-actual-data-size.patch, dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch, dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch, dmidecode-06-hide-irrelevant-fixup-message.patch, and dmidecode-07-only-decode-one-dmi-table.patch. - Add missing bug numbers and FATE references in changes file (bsc#1041670). - dmioem-reflect-hpe-new-company-name.patch: Reflect HPE's new company name. - dmidecode-fix-tpm-device-firmware-version.patch: Fix firmware version of TPM device. - dmioem-fix-hpe-type-219-uefi-flag.patch: Fix the reporting of HP/HPE UEFI feature. - Update to upstream version 3.2 (FATE#326044): * [COMPATIBILITY] The UUID is now displayed using lowercase letters, per RFC 4122 (#53569). You must ensure that any code parsing it is case-insensitive. * Support for SMBIOS 3.2.0. This includes new processor names, new socket and port connector types, new system slot state and property, and support for non-volatile memory (NVDIMM). * Support for Redfish management controllers. * A new command line option to query a specific structure by its handle. * A new command line option to query the system family string. * Support for 3 ThinkPad-specific structures (patch #9642). * Support for HPE's new company name. * Support UEFI on FreeBSD. * Important bug fixes: Fix firmware version of TPM device Fix the HPE UEFI feature flag check * (biosdecode) A new command line option to fully decode PIR information (support request #109339). * Obsoletes dmioem-reflect-hpe-new-company-name.patch, dmidecode-fix-tpm-device-firmware-version.patch, and dmioem-fix-hpe-type-219-uefi-flag.patch. * CHANGELOG is gone, package more compact NEWS file instead. - Reenable signature checking. - Use %license for LICENSE file. - dmidecode-fix-redfish-hostname-print-length.patch: Fix Redfish Hostname print length (bsc#1112755). - Don't overwrite the path of license (boo#1121851). - dmidecode-add-logical-non-volatile-device.patch: Add "Logical non-volatile device" to the memory device types (bsc#1120149). - Use %doc directly on files instead of installing them explicitly. Partial support for SMBIOS 3.3.0: - dmidecode-add-enumerated-values-from-smbios-3.3.0.patch: Add enumerated values from SMBIOS 3.3.0 (bsc#1153533 bsc#1158833 jsc#SLE-10875). 3 recommended fixes from upstream: - dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch: Only scan /dev/mem for entry point on x86 (fixes reboot on ARM64). - dmidecode-fix-formatting-of-tpm-table-output.patch: Fix formatting of TPM table output (missing newlines). - dmidecode-fix-system-slot-information-for-pcie-ssd.patch: Fix System Slot Information for PCIe SSD. Partial support for SMBIOS 3.4.0: - dmidecode-add-memory-device-types-from-smbios-3.4.0.patch, dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch, dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch, dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch, dmidecode-add-system-slot-types-from-smbios-3.4.0.patch: Add enumerated values from SMBIOS 3.4.0 (bsc#1174257). 1 presentation fix from upstream: - dmidecode-skip-details-of-uninstalled-memory-modules.patch: Skip details of uninstalled memory modules (bsc#1174257). 1 recommended fix from upstream: - dmidecode-missing-commas.patch: Two missing commas in data arrays cause off-by-one or mangling during index resolution (bsc#1174257). - Update to upstream version 3.4: * This update implements jsc#SLE-24502 and jsc#PED-1466. * [COMPATIBILITY] Document how the UUID fields are interpreted. * [PORTABILITY] Don't use memcpy on /dev/mem on arm64. * Support for SMBIOS 3.4.0. This includes new memory device types, new processor upgrades, new slot types and characteristics, decoding of memory module extended speed, new system slot types, new processor characteristics and new format of Processor ID. * Support for SMBIOS 3.5.0. This includes new processor upgrades, BIOS characteristics, new slot characteristics, new on-board device types, new pointing device interface types, and a new record type (type 45 - Firmware Inventory Information). * Decode HPE OEM records 194, 199, 203, 236, 237, 238 ans 240. * Bug fixes: Fix OEM vendor name matching * Minor improvements: Add bios-revision, firmware-revision and system-sku-number to -s option Use the most appropriate unit for cache size Decode system slot base bus width and peers Skip details of uninstalled memory modules Don't display the raw CPU ID in quiet mode Improve the formatting of the manual pages * Obsoletes dmidecode-add-enumerated-values-from-smbios-3.3.0.patch, dmidecode-add-logical-non-volatile-device.patch, dmidecode-add-memory-device-types-from-smbios-3.4.0.patch, dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch, dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch, dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch, dmidecode-add-system-slot-types-from-smbios-3.4.0.patch, dmidecode-fix-formatting-of-tpm-table-output.patch, dmidecode-fix-redfish-hostname-print-length.patch, dmidecode-fix-system-slot-information-for-pcie-ssd.patch, dmidecode-missing-commas.patch, dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch and dmidecode-skip-details-of-uninstalled-memory-modules.patch. 2 recommended fixes from upstream: - news-fix-typo.patch: We ship the NEWS file so avoid including a typo in it. - dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch: Passing NULL to a %s printf conversion specifier is illegal, and can result in a segmentation fault. Current version of glibc doesn't mind, but alternative, past or future libc implementations could crash, so let's fix it. Security fixes (CVE-2023-30630) - dmidecode-split-table-fetching-from-decoding.patch: dmidecode: Clean up function dmi_table so that it does only one thing (bsc#1210418). - dmidecode-write-the-whole-dump-file-at-once.patch: When option - -dump-bin is used, write the whole dump file at once, instead of opening and closing the file separately for the table and then for the entry point (bsc#1210418). - dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch: Make sure that the file passed to option --dump-bin does not already exist (bsc#1210418). - ensure-dev-mem-is-a-character-device-file.patch: Add a safety check on the type of the mem device file we are asked to read from, if we are root (bsc#1210418). 3 recommended fixes from upstream: - dmioem-typo-fix-virutal-virtual.patch: Simple typo fix in a user-visible string. - dmidecode-fortify-entry-point-length-checks.patch: Ensure that the SMBIOS entry point is long enough to include all the fields we need. - dmioem-hpe-oem-record-237-firmware-change.patch: Properly decode the last field of HPE OEM record type 237. - use-read_file-to-read-from-dump.patch: Fix an old harmless bug which would prevent root from using the --from-dump option since the latest security fixes (bsc#1210418). - Update to upstream version 3.6 (jsc#PED-8574): * Support for SMBIOS 3.6.0. This includes new memory device types, new processor upgrades, and Loongarch support. * Support for SMBIOS 3.7.0. This includes new port types, new processor upgrades, new slot characteristics and new fields for memory modules. * Add bash completion. * Decode HPE OEM records 197, 216, 224, 230, 238, 239, 242 and 245. * Implement options --list-strings and --list-types. * Update HPE OEM records 203, 212, 216, 221, 233 and 236. * Update Redfish support. * Bug fixes: Fix enabled slot characteristics not being printed * Minor improvements: Print slot width on its own line Use standard strings for slot width * Add a --no-quirks option. * Drop the CPUID exception list. * Obsoletes dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch, dmidecode-fortify-entry-point-length-checks.patch, dmidecode-split-table-fetching-from-decoding.patch, dmidecode-write-the-whole-dump-file-at-once.patch, dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch, dmioem-hpe-oem-record-237-firmware-change.patch, dmioem-typo-fix-virutal-virtual.patch, ensure-dev-mem-is-a-character-device-file.patch, news-fix-typo.patch and use-read_file-to-read-from-dump.patch. Update for HPE servers from upstream: - dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in HPE type 238 records. - Cleanup spec file with spec-cleaner - Add gpg signature - dmidecode.keyring was empty, reference the savannah keyring. but the tarball is signed by someone unknown without gpg signatures, so no keyring for now. - Update to upstream version 3.0 (FATE#320746, FATE#320773): * Adds support for SMBIOS 3.0. This includes a new (64-bit) entry point format and new enumerated values for recent hardware. * Adds support for the new kernel interface (as of Linux v4.2) as an alternative to relying on /dev/mem to access the entry point and DMI table. * Adds decoding of Acer-specific DMI type 170 and HP-specific DMI types 212, 219 and 233. * Obsoletes dmidecode-1.173-drop-cast.patch, dmidecode-1.175-fix-SMBIOS-2.8.0.patch, dmidecode-1.176-SMBIOS-2.8-is-supported.patch, dmidecode-1.177-decode-pcie3-slot-id.patch, dmidecode-1.181-decode-CPUID-recent-AMD.patch, and dmidecode-1.182-decode-ddr4-memory-type.patch. * Various minor fixes and clean-ups. * Skip the SMBIOS version comparison in quiet mode (bsc#974862). - dmidecode-01-add-no-sysfs-option-description-to-h-output.patch: Add "--no-sysfs" option description to -h output. - dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch: Fix 'No SMBIOS nor DMI entry point found' on SMBIOS3. - dmidecode-03-let-read_file-return-the-actual-data-size.patch: Let read_file return the actual data size. - dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch: Use read_file() to read the DMI table from sysfs. https://savannah.nongnu.org/bugs/?46176 - dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch: Use DWORD for Structure table maximum size in SMBIOS3. - dmidecode-06-hide-irrelevant-fixup-message.patch: Hide irrelevant fixup message. http://savannah.nongnu.org/support/?109024 - dmidecode-07-only-decode-one-dmi-table.patch: Only decode one DMI table. https://savannah.nongnu.org/bugs/?50022 - Update to upstream version 3.1: * Support for SMBIOS 3.1.0 and 3.1.1. This includes new chassis types, new processor family names, new processor family upgrade names, and new slot types, as well as support of larger BIOS ROM sizes and cache sizes, and a new structure type (43, TPM Device.) * A new command line option to query OEM strings. * All error messages are now printed on stderr (#47274, #48158.) * Fixes a crash with SIGBUS (#46066.) * Various minor fixes, improvements and cleanups. * Obsoletes dmidecode-01-add-no-sysfs-option-description-to-h-output.patch, dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch, dmidecode-03-let-read_file-return-the-actual-data-size.patch, dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch, dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch, dmidecode-06-hide-irrelevant-fixup-message.patch, and dmidecode-07-only-decode-one-dmi-table.patch. - Add missing bug numbers and FATE references in changes file (bsc#1041670). - dmioem-reflect-hpe-new-company-name.patch: Reflect HPE's new company name. - dmidecode-fix-tpm-device-firmware-version.patch: Fix firmware version of TPM device. - dmioem-fix-hpe-type-219-uefi-flag.patch: Fix the reporting of HP/HPE UEFI feature. - Update to upstream version 3.2 (FATE#326044): * [COMPATIBILITY] The UUID is now displayed using lowercase letters, per RFC 4122 (#53569). You must ensure that any code parsing it is case-insensitive. * Support for SMBIOS 3.2.0. This includes new processor names, new socket and port connector types, new system slot state and property, and support for non-volatile memory (NVDIMM). * Support for Redfish management controllers. * A new command line option to query a specific structure by its handle. * A new command line option to query the system family string. * Support for 3 ThinkPad-specific structures (patch #9642). * Support for HPE's new company name. * Support UEFI on FreeBSD. * Important bug fixes: Fix firmware version of TPM device Fix the HPE UEFI feature flag check * (biosdecode) A new command line option to fully decode PIR information (support request #109339). * Obsoletes dmioem-reflect-hpe-new-company-name.patch, dmidecode-fix-tpm-device-firmware-version.patch, and dmioem-fix-hpe-type-219-uefi-flag.patch. * CHANGELOG is gone, package more compact NEWS file instead. - Reenable signature checking. - Use %license for LICENSE file. - dmidecode-fix-redfish-hostname-print-length.patch: Fix Redfish Hostname print length (bsc#1112755). - Don't overwrite the path of license (boo#1121851). - dmidecode-add-logical-non-volatile-device.patch: Add "Logical non-volatile device" to the memory device types (bsc#1120149). - Use %doc directly on files instead of installing them explicitly. Partial support for SMBIOS 3.3.0: - dmidecode-add-enumerated-values-from-smbios-3.3.0.patch: Add enumerated values from SMBIOS 3.3.0 (bsc#1153533 bsc#1158833 jsc#SLE-10875). 3 recommended fixes from upstream: - dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch: Only scan /dev/mem for entry point on x86 (fixes reboot on ARM64). - dmidecode-fix-formatting-of-tpm-table-output.patch: Fix formatting of TPM table output (missing newlines). - dmidecode-fix-system-slot-information-for-pcie-ssd.patch: Fix System Slot Information for PCIe SSD. Partial support for SMBIOS 3.4.0: - dmidecode-add-memory-device-types-from-smbios-3.4.0.patch, dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch, dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch, dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch, dmidecode-add-system-slot-types-from-smbios-3.4.0.patch: Add enumerated values from SMBIOS 3.4.0 (bsc#1174257). 1 presentation fix from upstream: - dmidecode-skip-details-of-uninstalled-memory-modules.patch: Skip details of uninstalled memory modules (bsc#1174257). 1 recommended fix from upstream: - dmidecode-missing-commas.patch: Two missing commas in data arrays cause off-by-one or mangling during index resolution (bsc#1174257). - Update to upstream version 3.4: * This update implements jsc#SLE-24502 and jsc#PED-1466. * [COMPATIBILITY] Document how the UUID fields are interpreted. * [PORTABILITY] Don't use memcpy on /dev/mem on arm64. * Support for SMBIOS 3.4.0. This includes new memory device types, new processor upgrades, new slot types and characteristics, decoding of memory module extended speed, new system slot types, new processor characteristics and new format of Processor ID. * Support for SMBIOS 3.5.0. This includes new processor upgrades, BIOS characteristics, new slot characteristics, new on-board device types, new pointing device interface types, and a new record type (type 45 - Firmware Inventory Information). * Decode HPE OEM records 194, 199, 203, 236, 237, 238 ans 240. * Bug fixes: Fix OEM vendor name matching * Minor improvements: Add bios-revision, firmware-revision and system-sku-number to -s option Use the most appropriate unit for cache size Decode system slot base bus width and peers Skip details of uninstalled memory modules Don't display the raw CPU ID in quiet mode Improve the formatting of the manual pages * Obsoletes dmidecode-add-enumerated-values-from-smbios-3.3.0.patch, dmidecode-add-logical-non-volatile-device.patch, dmidecode-add-memory-device-types-from-smbios-3.4.0.patch, dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch, dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch, dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch, dmidecode-add-system-slot-types-from-smbios-3.4.0.patch, dmidecode-fix-formatting-of-tpm-table-output.patch, dmidecode-fix-redfish-hostname-print-length.patch, dmidecode-fix-system-slot-information-for-pcie-ssd.patch, dmidecode-missing-commas.patch, dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch and dmidecode-skip-details-of-uninstalled-memory-modules.patch. 2 recommended fixes from upstream: - news-fix-typo.patch: We ship the NEWS file so avoid including a typo in it. - dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch: Passing NULL to a %s printf conversion specifier is illegal, and can result in a segmentation fault. Current version of glibc doesn't mind, but alternative, past or future libc implementations could crash, so let's fix it. Security fixes (CVE-2023-30630) - dmidecode-split-table-fetching-from-decoding.patch: dmidecode: Clean up function dmi_table so that it does only one thing (bsc#1210418). - dmidecode-write-the-whole-dump-file-at-once.patch: When option - -dump-bin is used, write the whole dump file at once, instead of opening and closing the file separately for the table and then for the entry point (bsc#1210418). - dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch: Make sure that the file passed to option --dump-bin does not already exist (bsc#1210418). - ensure-dev-mem-is-a-character-device-file.patch: Add a safety check on the type of the mem device file we are asked to read from, if we are root (bsc#1210418). 3 recommended fixes from upstream: - dmioem-typo-fix-virutal-virtual.patch: Simple typo fix in a user-visible string. - dmidecode-fortify-entry-point-length-checks.patch: Ensure that the SMBIOS entry point is long enough to include all the fields we need. - dmioem-hpe-oem-record-237-firmware-change.patch: Properly decode the last field of HPE OEM record type 237. - use-read_file-to-read-from-dump.patch: Fix an old harmless bug which would prevent root from using the --from-dump option since the latest security fixes (bsc#1210418). - Update to upstream version 3.6 (jsc#PED-8574): * Support for SMBIOS 3.6.0. This includes new memory device types, new processor upgrades, and Loongarch support. * Support for SMBIOS 3.7.0. This includes new port types, new processor upgrades, new slot characteristics and new fields for memory modules. * Add bash completion. * Decode HPE OEM records 197, 216, 224, 230, 238, 239, 242 and 245. * Implement options --list-strings and --list-types. * Update HPE OEM records 203, 212, 216, 221, 233 and 236. * Update Redfish support. * Bug fixes: Fix enabled slot characteristics not being printed * Minor improvements: Print slot width on its own line Use standard strings for slot width * Add a --no-quirks option. * Drop the CPUID exception list. * Obsoletes dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch, dmidecode-fortify-entry-point-length-checks.patch, dmidecode-split-table-fetching-from-decoding.patch, dmidecode-write-the-whole-dump-file-at-once.patch, dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch, dmioem-hpe-oem-record-237-firmware-change.patch, dmioem-typo-fix-virutal-virtual.patch, ensure-dev-mem-is-a-character-device-file.patch, news-fix-typo.patch and use-read_file-to-read-from-dump.patch. Update for HPE servers from upstream: - dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in HPE type 238 records. - Cleanup spec file with spec-cleaner - Add gpg signature - dmidecode.keyring was empty, reference the savannah keyring. but the tarball is signed by someone unknown without gpg signatures, so no keyring for now. - Update to upstream version 3.0 (FATE#320746, FATE#320773): * Adds support for SMBIOS 3.0. This includes a new (64-bit) entry point format and new enumerated values for recent hardware. * Adds support for the new kernel interface (as of Linux v4.2) as an alternative to relying on /dev/mem to access the entry point and DMI table. * Adds decoding of Acer-specific DMI type 170 and HP-specific DMI types 212, 219 and 233. * Obsoletes dmidecode-1.173-drop-cast.patch, dmidecode-1.175-fix-SMBIOS-2.8.0.patch, dmidecode-1.176-SMBIOS-2.8-is-supported.patch, dmidecode-1.177-decode-pcie3-slot-id.patch, dmidecode-1.181-decode-CPUID-recent-AMD.patch, and dmidecode-1.182-decode-ddr4-memory-type.patch. * Various minor fixes and clean-ups. * Skip the SMBIOS version comparison in quiet mode (bsc#974862). - dmidecode-01-add-no-sysfs-option-description-to-h-output.patch: Add "--no-sysfs" option description to -h output. - dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch: Fix 'No SMBIOS nor DMI entry point found' on SMBIOS3. - dmidecode-03-let-read_file-return-the-actual-data-size.patch: Let read_file return the actual data size. - dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch: Use read_file() to read the DMI table from sysfs. https://savannah.nongnu.org/bugs/?46176 - dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch: Use DWORD for Structure table maximum size in SMBIOS3. - dmidecode-06-hide-irrelevant-fixup-message.patch: Hide irrelevant fixup message. http://savannah.nongnu.org/support/?109024 - dmidecode-07-only-decode-one-dmi-table.patch: Only decode one DMI table. https://savannah.nongnu.org/bugs/?50022 - Update to upstream version 3.1: * Support for SMBIOS 3.1.0 and 3.1.1. This includes new chassis types, new processor family names, new processor family upgrade names, and new slot types, as well as support of larger BIOS ROM sizes and cache sizes, and a new structure type (43, TPM Device.) * A new command line option to query OEM strings. * All error messages are now printed on stderr (#47274, #48158.) * Fixes a crash with SIGBUS (#46066.) * Various minor fixes, improvements and cleanups. * Obsoletes dmidecode-01-add-no-sysfs-option-description-to-h-output.patch, dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch, dmidecode-03-let-read_file-return-the-actual-data-size.patch, dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch, dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch, dmidecode-06-hide-irrelevant-fixup-message.patch, and dmidecode-07-only-decode-one-dmi-table.patch. - Add missing bug numbers and FATE references in changes file (bsc#1041670). - dmioem-reflect-hpe-new-company-name.patch: Reflect HPE's new company name. - dmidecode-fix-tpm-device-firmware-version.patch: Fix firmware version of TPM device. - dmioem-fix-hpe-type-219-uefi-flag.patch: Fix the reporting of HP/HPE UEFI feature. - Update to upstream version 3.2 (FATE#326044): * [COMPATIBILITY] The UUID is now displayed using lowercase letters, per RFC 4122 (#53569). You must ensure that any code parsing it is case-insensitive. * Support for SMBIOS 3.2.0. This includes new processor names, new socket and port connector types, new system slot state and property, and support for non-volatile memory (NVDIMM). * Support for Redfish management controllers. * A new command line option to query a specific structure by its handle. * A new command line option to query the system family string. * Support for 3 ThinkPad-specific structures (patch #9642). * Support for HPE's new company name. * Support UEFI on FreeBSD. * Important bug fixes: Fix firmware version of TPM device Fix the HPE UEFI feature flag check * (biosdecode) A new command line option to fully decode PIR information (support request #109339). * Obsoletes dmioem-reflect-hpe-new-company-name.patch, dmidecode-fix-tpm-device-firmware-version.patch, and dmioem-fix-hpe-type-219-uefi-flag.patch. * CHANGELOG is gone, package more compact NEWS file instead. - Reenable signature checking. - Use %license for LICENSE file. - dmidecode-fix-redfish-hostname-print-length.patch: Fix Redfish Hostname print length (bsc#1112755). - Don't overwrite the path of license (boo#1121851). - dmidecode-add-logical-non-volatile-device.patch: Add "Logical non-volatile device" to the memory device types (bsc#1120149). - Use %doc directly on files instead of installing them explicitly. Partial support for SMBIOS 3.3.0: - dmidecode-add-enumerated-values-from-smbios-3.3.0.patch: Add enumerated values from SMBIOS 3.3.0 (bsc#1153533 bsc#1158833 jsc#SLE-10875). 3 recommended fixes from upstream: - dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch: Only scan /dev/mem for entry point on x86 (fixes reboot on ARM64). - dmidecode-fix-formatting-of-tpm-table-output.patch: Fix formatting of TPM table output (missing newlines). - dmidecode-fix-system-slot-information-for-pcie-ssd.patch: Fix System Slot Information for PCIe SSD. Partial support for SMBIOS 3.4.0: - dmidecode-add-memory-device-types-from-smbios-3.4.0.patch, dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch, dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch, dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch, dmidecode-add-system-slot-types-from-smbios-3.4.0.patch: Add enumerated values from SMBIOS 3.4.0 (bsc#1174257). 1 presentation fix from upstream: - dmidecode-skip-details-of-uninstalled-memory-modules.patch: Skip details of uninstalled memory modules (bsc#1174257). 1 recommended fix from upstream: - dmidecode-missing-commas.patch: Two missing commas in data arrays cause off-by-one or mangling during index resolution (bsc#1174257). - Update to upstream version 3.4: * This update implements jsc#SLE-24502 and jsc#PED-1466. * [COMPATIBILITY] Document how the UUID fields are interpreted. * [PORTABILITY] Don't use memcpy on /dev/mem on arm64. * Support for SMBIOS 3.4.0. This includes new memory device types, new processor upgrades, new slot types and characteristics, decoding of memory module extended speed, new system slot types, new processor characteristics and new format of Processor ID. * Support for SMBIOS 3.5.0. This includes new processor upgrades, BIOS characteristics, new slot characteristics, new on-board device types, new pointing device interface types, and a new record type (type 45 - Firmware Inventory Information). * Decode HPE OEM records 194, 199, 203, 236, 237, 238 ans 240. * Bug fixes: Fix OEM vendor name matching * Minor improvements: Add bios-revision, firmware-revision and system-sku-number to -s option Use the most appropriate unit for cache size Decode system slot base bus width and peers Skip details of uninstalled memory modules Don't display the raw CPU ID in quiet mode Improve the formatting of the manual pages * Obsoletes dmidecode-add-enumerated-values-from-smbios-3.3.0.patch, dmidecode-add-logical-non-volatile-device.patch, dmidecode-add-memory-device-types-from-smbios-3.4.0.patch, dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch, dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch, dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch, dmidecode-add-system-slot-types-from-smbios-3.4.0.patch, dmidecode-fix-formatting-of-tpm-table-output.patch, dmidecode-fix-redfish-hostname-print-length.patch, dmidecode-fix-system-slot-information-for-pcie-ssd.patch, dmidecode-missing-commas.patch, dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch and dmidecode-skip-details-of-uninstalled-memory-modules.patch. 2 recommended fixes from upstream: - news-fix-typo.patch: We ship the NEWS file so avoid including a typo in it. - dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch: Passing NULL to a %s printf conversion specifier is illegal, and can result in a segmentation fault. Current version of glibc doesn't mind, but alternative, past or future libc implementations could crash, so let's fix it. Security fixes (CVE-2023-30630) - dmidecode-split-table-fetching-from-decoding.patch: dmidecode: Clean up function dmi_table so that it does only one thing (bsc#1210418). - dmidecode-write-the-whole-dump-file-at-once.patch: When option - -dump-bin is used, write the whole dump file at once, instead of opening and closing the file separately for the table and then for the entry point (bsc#1210418). - dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch: Make sure that the file passed to option --dump-bin does not already exist (bsc#1210418). - ensure-dev-mem-is-a-character-device-file.patch: Add a safety check on the type of the mem device file we are asked to read from, if we are root (bsc#1210418). 3 recommended fixes from upstream: - dmioem-typo-fix-virutal-virtual.patch: Simple typo fix in a user-visible string. - dmidecode-fortify-entry-point-length-checks.patch: Ensure that the SMBIOS entry point is long enough to include all the fields we need. - dmioem-hpe-oem-record-237-firmware-change.patch: Properly decode the last field of HPE OEM record type 237. - use-read_file-to-read-from-dump.patch: Fix an old harmless bug which would prevent root from using the --from-dump option since the latest security fixes (bsc#1210418). - Update to upstream version 3.6 (jsc#PED-8574): * Support for SMBIOS 3.6.0. This includes new memory device types, new processor upgrades, and Loongarch support. * Support for SMBIOS 3.7.0. This includes new port types, new processor upgrades, new slot characteristics and new fields for memory modules. * Add bash completion. * Decode HPE OEM records 197, 216, 224, 230, 238, 239, 242 and 245. * Implement options --list-strings and --list-types. * Update HPE OEM records 203, 212, 216, 221, 233 and 236. * Update Redfish support. * Bug fixes: Fix enabled slot characteristics not being printed * Minor improvements: Print slot width on its own line Use standard strings for slot width * Add a --no-quirks option. * Drop the CPUID exception list. * Obsoletes dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch, dmidecode-fortify-entry-point-length-checks.patch, dmidecode-split-table-fetching-from-decoding.patch, dmidecode-write-the-whole-dump-file-at-once.patch, dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch, dmioem-hpe-oem-record-237-firmware-change.patch, dmioem-typo-fix-virutal-virtual.patch, ensure-dev-mem-is-a-character-device-file.patch, news-fix-typo.patch and use-read_file-to-read-from-dump.patch. Update for HPE servers from upstream: - dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in HPE type 238 records. - Fix building with lua54 - update to 2.84: * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH * Tidy initialisation in hash_questions.c * Optimise sort_rrset for the case where the RR type * Move fd into frec_src - Update to 2.85: * Fix problem with DNS retries in 2.83/2.84. * Tweak sort order of tags in get-version. * Avoid treating a --dhcp-host which has an IPv6 address as eligible for use with DHCPv4 on the grounds that it has no address, and vice-versa. * Add --dynamic-host option: A and AAAA records which take their network part from the network of a local interface. Useful for routers with dynamically prefixes. * Teach --bogus-nxdomain and --ignore-address to take an IPv4 subnet. * CVE-2021-3448, bsc#1183709: Use random source ports where possible if source addresses/interfaces in use. * Change the method of allocation of random source ports for DNS. * Scale the size of the DNS random-port pool based on the value of the --dns-forward-max configuration. * Tweak TFTP code to check sender of all received packets, as specified in RFC 1350 para 4. - Change to using systemd-sysusers on TW - Add now working CONFIG parameter to sysusers generator - Added hardening to systemd service(s) (bsc#1181400). - Update to 2.86: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load. * Major rewrite of the DNS server and domain handling code. This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers of domains. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain, with caveats. - -synth-domain=1234:4567::/56,example.com is now valid. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read (alphabetical order of filename). - jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1. - SLE bugs that got fixed upstream between 2.79 and 2.86, but for which we need to keep references when syncing: * bsc#1176076: dnsmasq-servfail.patch * bsc#1156543: dnsmasq-siocgstamp.patch * bsc#1138743: dnsmasq-cache-size.patch * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch * bsc#1180914: Open inotify socket only when used. * removed dnsmasq-dnspooq.patch - bsc#1173646, CVE-2020-14312: Set --local-service by default. - Use systemd-sysusers from 15.3 onwards - bsc#1192529, dnsmasq-resolv-conf.patch: Fix a segfault when re-reading an empty resolv.conf - Remove "nogroup" membership from the dnsmasq user. - bsc#1197872, CVE-2022-0934, dnsmasq-CVE-2022-0934.patch: Heap use after free in dhcp6_no_relay - Move the dbus-1 system.d file to /usr (bsc#1200344) - Ensure the dnsmasq user's group is used - Remove nogroup requirement - update to 2.87 (bsc#1197872, CVE-2022-0934): * Allow arbitrary prefix lengths in --rev-server and - -domain=....,local * Replace --address=/#/..... functionality which got missed in the 2.86 domain search rewrite. * Add --nftset option, like --ipset but for the newer nftables. * Add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. * Fix crash doing netbooting when --port is set to zero to disable the DNS server. Thanks to Drexl Johannes for the bug report. * Generalise --dhcp-relay. Sending via broadcast/multicast is now supported for both IPv4 and IPv6 and the configuration syntax made easier (but backwards compatible). * Add snooping of IPv6 prefix-delegations to the DHCP-relay system. * Finesse parsing of --dhcp-remoteid and --dhcp-subscrid. To be treated as hex, the pattern must consist of only hex digits AND contain at least one ':'. Thanks to Bengt-Erik Sandstrom who tripped over a pattern consisting of a decimal number which was interpreted surprisingly. * Include client address in TFTP file-not-found error reports. Thanks to Stefan Rink for the initial patch, which has been re-worked by me (srk). All bugs mine. * Note in manpage the change in behaviour of -address. This behaviour actually changed in v2.86, but was undocumented there. From 2.86 on, (eg) --address=/example.com/1.2.3.4 ONLY applies to A queries. All other types of query will be sent upstream. Pre 2.86, that would catch the whole example.com domain and queries for other types would get a local NODATA answer. The pre-2.86 behaviour is still available, by configuring --address=/example.com/1.2.3.4 --local=/example.com/ * Fix problem with binding DHCP sockets to an individual interface. Despite the fact that the system call tales the interface _name_ as a parameter, it actually, binds the socket to interface _index_. Deleting the interface and creating a new one with the same name leaves the socket bound to the old index. (Creating new sockets always allocates a fresh index, they are not reused). We now take this behaviour into account and keep up with changing indexes. * Add --conf-script configuration option. * Enhance --domain to accept, for instance, - -domain=net2.thekelleys.org.uk,eth2 so that hosts get a domain which relects the interface they are attached to in a way which doesn't require hard-coding addresses. Thanks to Sten Spans for the idea. * Fix write-after-free error in DHCPv6 server code. CVE-2022-0934 refers. * Add the ability to specify destination port in DHCP-relay mode. This change also removes a previous bug where --dhcp-alternate-port would affect the port used to relay _to_ as well as the port being listened on. The new feature allows configuration to provide bug-for-bug compatibility, if required. Thanks to Damian Kaczkowski for the feature suggestion. * Bound the value of UDP packet size in the EDNS0 header of forwarded queries to the configured or default value of edns-packet-max. There's no point letting a client set a larger value if we're unable to return the answer. Thanks to Bertie Taylor for pointing out the problem and supplying the patch. - drop dnsmasq-CVE-2022-0934.patch, dnsmasq-resolv-conf.patch (upstream) - update to 2.88: * Fix bug in --dynamic-host when an interface has /16 IPv4 * address. * Add --fast-dns-retry option. This gives dnsmasq the ability to originate retries for upstream DNS queries itself, rather than relying on the downstream client. This is most useful when doing DNSSEC over unreliable upstream networks. It comes with some cost in memory usage and network bandwidth. * Add --use-stale-cache option. When set, if a DNS name exists in the cache, but its time-to-live has expired, dnsmasq will return the data anyway. * handle removal of whole files or entries within files. - update to 2.89: * Fix bug introduced in 2.88 (commit fe91134b) which can result in corruption of the DNS cache internal data structures and logging of "cache internal error". This has only been seen in one place in the wild, and it took considerable effort to even generate a test case to reproduce it, but there's no way to be sure it won't strike, and the effect is to break the cache badly. Installations with DNSSEC enabled are more likely to see the problem, but not running DNSSEC does not guarantee that it won't happen. Thanks to Timo van Roermund for reporting the bug and for his great efforts in chasing it down. (boo#1207174) - remove no longer needed rpmlintrc filters - bsc#1209358, CVE-2023-28450, dnsmasq-CVE-2023-28450.patch: default maximum EDNS.0 UDP packet size should be 1232 - Correct rundir from /var/run to /run for pid file - SLP got dropped, remove config (bsc#1214884) - update to 2.90: * CVE-2023-50387, CVE-2023-50868, bsc#1219823, bsc#1219826: Denial Of Service while trying to validate specially crafted DNSSEC responses * Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6). * Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain. * Set the default maximum DNS UDP packet sice to 1232. Obsoletes: dnsmasq-CVE-2023-28450.patch * Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which inetrfaces are providing DHCP service. * Fix issue with stale caching * Add configurable caching for arbitrary RR-types. * Add --filter-rr option, to filter arbitrary RR-types. - Fix building with lua54 - update to 2.84: * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH * Tidy initialisation in hash_questions.c * Optimise sort_rrset for the case where the RR type * Move fd into frec_src - Update to 2.85: * Fix problem with DNS retries in 2.83/2.84. * Tweak sort order of tags in get-version. * Avoid treating a --dhcp-host which has an IPv6 address as eligible for use with DHCPv4 on the grounds that it has no address, and vice-versa. * Add --dynamic-host option: A and AAAA records which take their network part from the network of a local interface. Useful for routers with dynamically prefixes. * Teach --bogus-nxdomain and --ignore-address to take an IPv4 subnet. * CVE-2021-3448, bsc#1183709: Use random source ports where possible if source addresses/interfaces in use. * Change the method of allocation of random source ports for DNS. * Scale the size of the DNS random-port pool based on the value of the --dns-forward-max configuration. * Tweak TFTP code to check sender of all received packets, as specified in RFC 1350 para 4. - Change to using systemd-sysusers on TW - Add now working CONFIG parameter to sysusers generator - Added hardening to systemd service(s) (bsc#1181400). - Update to 2.86: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load. * Major rewrite of the DNS server and domain handling code. This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers of domains. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain, with caveats. - -synth-domain=1234:4567::/56,example.com is now valid. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read (alphabetical order of filename). - jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1. - SLE bugs that got fixed upstream between 2.79 and 2.86, but for which we need to keep references when syncing: * bsc#1176076: dnsmasq-servfail.patch * bsc#1156543: dnsmasq-siocgstamp.patch * bsc#1138743: dnsmasq-cache-size.patch * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch * bsc#1180914: Open inotify socket only when used. * removed dnsmasq-dnspooq.patch - bsc#1173646, CVE-2020-14312: Set --local-service by default. - Use systemd-sysusers from 15.3 onwards - bsc#1192529, dnsmasq-resolv-conf.patch: Fix a segfault when re-reading an empty resolv.conf - Remove "nogroup" membership from the dnsmasq user. - bsc#1197872, CVE-2022-0934, dnsmasq-CVE-2022-0934.patch: Heap use after free in dhcp6_no_relay - Move the dbus-1 system.d file to /usr (bsc#1200344) - Ensure the dnsmasq user's group is used - Remove nogroup requirement - update to 2.87 (bsc#1197872, CVE-2022-0934): * Allow arbitrary prefix lengths in --rev-server and - -domain=....,local * Replace --address=/#/..... functionality which got missed in the 2.86 domain search rewrite. * Add --nftset option, like --ipset but for the newer nftables. * Add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. * Fix crash doing netbooting when --port is set to zero to disable the DNS server. Thanks to Drexl Johannes for the bug report. * Generalise --dhcp-relay. Sending via broadcast/multicast is now supported for both IPv4 and IPv6 and the configuration syntax made easier (but backwards compatible). * Add snooping of IPv6 prefix-delegations to the DHCP-relay system. * Finesse parsing of --dhcp-remoteid and --dhcp-subscrid. To be treated as hex, the pattern must consist of only hex digits AND contain at least one ':'. Thanks to Bengt-Erik Sandstrom who tripped over a pattern consisting of a decimal number which was interpreted surprisingly. * Include client address in TFTP file-not-found error reports. Thanks to Stefan Rink for the initial patch, which has been re-worked by me (srk). All bugs mine. * Note in manpage the change in behaviour of -address. This behaviour actually changed in v2.86, but was undocumented there. From 2.86 on, (eg) --address=/example.com/1.2.3.4 ONLY applies to A queries. All other types of query will be sent upstream. Pre 2.86, that would catch the whole example.com domain and queries for other types would get a local NODATA answer. The pre-2.86 behaviour is still available, by configuring --address=/example.com/1.2.3.4 --local=/example.com/ * Fix problem with binding DHCP sockets to an individual interface. Despite the fact that the system call tales the interface _name_ as a parameter, it actually, binds the socket to interface _index_. Deleting the interface and creating a new one with the same name leaves the socket bound to the old index. (Creating new sockets always allocates a fresh index, they are not reused). We now take this behaviour into account and keep up with changing indexes. * Add --conf-script configuration option. * Enhance --domain to accept, for instance, - -domain=net2.thekelleys.org.uk,eth2 so that hosts get a domain which relects the interface they are attached to in a way which doesn't require hard-coding addresses. Thanks to Sten Spans for the idea. * Fix write-after-free error in DHCPv6 server code. CVE-2022-0934 refers. * Add the ability to specify destination port in DHCP-relay mode. This change also removes a previous bug where --dhcp-alternate-port would affect the port used to relay _to_ as well as the port being listened on. The new feature allows configuration to provide bug-for-bug compatibility, if required. Thanks to Damian Kaczkowski for the feature suggestion. * Bound the value of UDP packet size in the EDNS0 header of forwarded queries to the configured or default value of edns-packet-max. There's no point letting a client set a larger value if we're unable to return the answer. Thanks to Bertie Taylor for pointing out the problem and supplying the patch. - drop dnsmasq-CVE-2022-0934.patch, dnsmasq-resolv-conf.patch (upstream) - update to 2.88: * Fix bug in --dynamic-host when an interface has /16 IPv4 * address. * Add --fast-dns-retry option. This gives dnsmasq the ability to originate retries for upstream DNS queries itself, rather than relying on the downstream client. This is most useful when doing DNSSEC over unreliable upstream networks. It comes with some cost in memory usage and network bandwidth. * Add --use-stale-cache option. When set, if a DNS name exists in the cache, but its time-to-live has expired, dnsmasq will return the data anyway. * handle removal of whole files or entries within files. - update to 2.89: * Fix bug introduced in 2.88 (commit fe91134b) which can result in corruption of the DNS cache internal data structures and logging of "cache internal error". This has only been seen in one place in the wild, and it took considerable effort to even generate a test case to reproduce it, but there's no way to be sure it won't strike, and the effect is to break the cache badly. Installations with DNSSEC enabled are more likely to see the problem, but not running DNSSEC does not guarantee that it won't happen. Thanks to Timo van Roermund for reporting the bug and for his great efforts in chasing it down. (boo#1207174) - remove no longer needed rpmlintrc filters - bsc#1209358, CVE-2023-28450, dnsmasq-CVE-2023-28450.patch: default maximum EDNS.0 UDP packet size should be 1232 - Correct rundir from /var/run to /run for pid file - SLP got dropped, remove config (bsc#1214884) - update to 2.90: * CVE-2023-50387, CVE-2023-50868, bsc#1219823, bsc#1219826: Denial Of Service while trying to validate specially crafted DNSSEC responses * Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6). * Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain. * Set the default maximum DNS UDP packet sice to 1232. Obsoletes: dnsmasq-CVE-2023-28450.patch * Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which inetrfaces are providing DHCP service. * Fix issue with stale caching * Add configurable caching for arbitrary RR-types. * Add --filter-rr option, to filter arbitrary RR-types. - Fix building with lua54 - update to 2.84: * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH * Tidy initialisation in hash_questions.c * Optimise sort_rrset for the case where the RR type * Move fd into frec_src - Update to 2.85: * Fix problem with DNS retries in 2.83/2.84. * Tweak sort order of tags in get-version. * Avoid treating a --dhcp-host which has an IPv6 address as eligible for use with DHCPv4 on the grounds that it has no address, and vice-versa. * Add --dynamic-host option: A and AAAA records which take their network part from the network of a local interface. Useful for routers with dynamically prefixes. * Teach --bogus-nxdomain and --ignore-address to take an IPv4 subnet. * CVE-2021-3448, bsc#1183709: Use random source ports where possible if source addresses/interfaces in use. * Change the method of allocation of random source ports for DNS. * Scale the size of the DNS random-port pool based on the value of the --dns-forward-max configuration. * Tweak TFTP code to check sender of all received packets, as specified in RFC 1350 para 4. - Change to using systemd-sysusers on TW - Add now working CONFIG parameter to sysusers generator - Added hardening to systemd service(s) (bsc#1181400). - Update to 2.86: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load. * Major rewrite of the DNS server and domain handling code. This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers of domains. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain, with caveats. - -synth-domain=1234:4567::/56,example.com is now valid. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read (alphabetical order of filename). - jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1. - SLE bugs that got fixed upstream between 2.79 and 2.86, but for which we need to keep references when syncing: * bsc#1176076: dnsmasq-servfail.patch * bsc#1156543: dnsmasq-siocgstamp.patch * bsc#1138743: dnsmasq-cache-size.patch * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch * bsc#1180914: Open inotify socket only when used. * removed dnsmasq-dnspooq.patch - bsc#1173646, CVE-2020-14312: Set --local-service by default. - Use systemd-sysusers from 15.3 onwards - bsc#1192529, dnsmasq-resolv-conf.patch: Fix a segfault when re-reading an empty resolv.conf - Remove "nogroup" membership from the dnsmasq user. - bsc#1197872, CVE-2022-0934, dnsmasq-CVE-2022-0934.patch: Heap use after free in dhcp6_no_relay - Move the dbus-1 system.d file to /usr (bsc#1200344) - Ensure the dnsmasq user's group is used - Remove nogroup requirement - update to 2.87 (bsc#1197872, CVE-2022-0934): * Allow arbitrary prefix lengths in --rev-server and - -domain=....,local * Replace --address=/#/..... functionality which got missed in the 2.86 domain search rewrite. * Add --nftset option, like --ipset but for the newer nftables. * Add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. * Fix crash doing netbooting when --port is set to zero to disable the DNS server. Thanks to Drexl Johannes for the bug report. * Generalise --dhcp-relay. Sending via broadcast/multicast is now supported for both IPv4 and IPv6 and the configuration syntax made easier (but backwards compatible). * Add snooping of IPv6 prefix-delegations to the DHCP-relay system. * Finesse parsing of --dhcp-remoteid and --dhcp-subscrid. To be treated as hex, the pattern must consist of only hex digits AND contain at least one ':'. Thanks to Bengt-Erik Sandstrom who tripped over a pattern consisting of a decimal number which was interpreted surprisingly. * Include client address in TFTP file-not-found error reports. Thanks to Stefan Rink for the initial patch, which has been re-worked by me (srk). All bugs mine. * Note in manpage the change in behaviour of -address. This behaviour actually changed in v2.86, but was undocumented there. From 2.86 on, (eg) --address=/example.com/1.2.3.4 ONLY applies to A queries. All other types of query will be sent upstream. Pre 2.86, that would catch the whole example.com domain and queries for other types would get a local NODATA answer. The pre-2.86 behaviour is still available, by configuring --address=/example.com/1.2.3.4 --local=/example.com/ * Fix problem with binding DHCP sockets to an individual interface. Despite the fact that the system call tales the interface _name_ as a parameter, it actually, binds the socket to interface _index_. Deleting the interface and creating a new one with the same name leaves the socket bound to the old index. (Creating new sockets always allocates a fresh index, they are not reused). We now take this behaviour into account and keep up with changing indexes. * Add --conf-script configuration option. * Enhance --domain to accept, for instance, - -domain=net2.thekelleys.org.uk,eth2 so that hosts get a domain which relects the interface they are attached to in a way which doesn't require hard-coding addresses. Thanks to Sten Spans for the idea. * Fix write-after-free error in DHCPv6 server code. CVE-2022-0934 refers. * Add the ability to specify destination port in DHCP-relay mode. This change also removes a previous bug where --dhcp-alternate-port would affect the port used to relay _to_ as well as the port being listened on. The new feature allows configuration to provide bug-for-bug compatibility, if required. Thanks to Damian Kaczkowski for the feature suggestion. * Bound the value of UDP packet size in the EDNS0 header of forwarded queries to the configured or default value of edns-packet-max. There's no point letting a client set a larger value if we're unable to return the answer. Thanks to Bertie Taylor for pointing out the problem and supplying the patch. - drop dnsmasq-CVE-2022-0934.patch, dnsmasq-resolv-conf.patch (upstream) - update to 2.88: * Fix bug in --dynamic-host when an interface has /16 IPv4 * address. * Add --fast-dns-retry option. This gives dnsmasq the ability to originate retries for upstream DNS queries itself, rather than relying on the downstream client. This is most useful when doing DNSSEC over unreliable upstream networks. It comes with some cost in memory usage and network bandwidth. * Add --use-stale-cache option. When set, if a DNS name exists in the cache, but its time-to-live has expired, dnsmasq will return the data anyway. * handle removal of whole files or entries within files. - update to 2.89: * Fix bug introduced in 2.88 (commit fe91134b) which can result in corruption of the DNS cache internal data structures and logging of "cache internal error". This has only been seen in one place in the wild, and it took considerable effort to even generate a test case to reproduce it, but there's no way to be sure it won't strike, and the effect is to break the cache badly. Installations with DNSSEC enabled are more likely to see the problem, but not running DNSSEC does not guarantee that it won't happen. Thanks to Timo van Roermund for reporting the bug and for his great efforts in chasing it down. (boo#1207174) - remove no longer needed rpmlintrc filters - bsc#1209358, CVE-2023-28450, dnsmasq-CVE-2023-28450.patch: default maximum EDNS.0 UDP packet size should be 1232 - Correct rundir from /var/run to /run for pid file - SLP got dropped, remove config (bsc#1214884) - update to 2.90: * CVE-2023-50387, CVE-2023-50868, bsc#1219823, bsc#1219826: Denial Of Service while trying to validate specially crafted DNSSEC responses * Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6). * Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain. * Set the default maximum DNS UDP packet sice to 1232. Obsoletes: dnsmasq-CVE-2023-28450.patch * Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which inetrfaces are providing DHCP service. * Fix issue with stale caching * Add configurable caching for arbitrary RR-types. * Add --filter-rr option, to filter arbitrary RR-types. - Fix building with lua54 - update to 2.84: * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH * Tidy initialisation in hash_questions.c * Optimise sort_rrset for the case where the RR type * Move fd into frec_src - Update to 2.85: * Fix problem with DNS retries in 2.83/2.84. * Tweak sort order of tags in get-version. * Avoid treating a --dhcp-host which has an IPv6 address as eligible for use with DHCPv4 on the grounds that it has no address, and vice-versa. * Add --dynamic-host option: A and AAAA records which take their network part from the network of a local interface. Useful for routers with dynamically prefixes. * Teach --bogus-nxdomain and --ignore-address to take an IPv4 subnet. * CVE-2021-3448, bsc#1183709: Use random source ports where possible if source addresses/interfaces in use. * Change the method of allocation of random source ports for DNS. * Scale the size of the DNS random-port pool based on the value of the --dns-forward-max configuration. * Tweak TFTP code to check sender of all received packets, as specified in RFC 1350 para 4. - Change to using systemd-sysusers on TW - Add now working CONFIG parameter to sysusers generator - Added hardening to systemd service(s) (bsc#1181400). - Update to 2.86: * Handle DHCPREBIND requests in the DHCPv6 server code. * Fix bug which caused dnsmasq to lose track of processes forked to handle TCP DNS connections under heavy load. * Major rewrite of the DNS server and domain handling code. This should be largely transparent, but it drastically improves performance and reduces memory foot-print when configuring large numbers of domains. * Revise resource handling for number of concurrent DNS queries. * Improve efficiency of DNSSEC. * Connection track mark based DNS query filtering. * Allow smaller than 64 prefix lengths in synth-domain, with caveats. - -synth-domain=1234:4567::/56,example.com is now valid. * Make domains generated by --synth-domain appear in replies when in authoritative mode. * Ensure CAP_NET_ADMIN capability is available when conntrack is configured. * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are given a directory as argument, define the order in which files within that directory are read (alphabetical order of filename). - jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1. - SLE bugs that got fixed upstream between 2.79 and 2.86, but for which we need to keep references when syncing: * bsc#1176076: dnsmasq-servfail.patch * bsc#1156543: dnsmasq-siocgstamp.patch * bsc#1138743: dnsmasq-cache-size.patch * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch * bsc#1180914: Open inotify socket only when used. * removed dnsmasq-dnspooq.patch - bsc#1173646, CVE-2020-14312: Set --local-service by default. - Use systemd-sysusers from 15.3 onwards - bsc#1192529, dnsmasq-resolv-conf.patch: Fix a segfault when re-reading an empty resolv.conf - Remove "nogroup" membership from the dnsmasq user. - bsc#1197872, CVE-2022-0934, dnsmasq-CVE-2022-0934.patch: Heap use after free in dhcp6_no_relay - Move the dbus-1 system.d file to /usr (bsc#1200344) - Ensure the dnsmasq user's group is used - Remove nogroup requirement - update to 2.87 (bsc#1197872, CVE-2022-0934): * Allow arbitrary prefix lengths in --rev-server and - -domain=....,local * Replace --address=/#/..... functionality which got missed in the 2.86 domain search rewrite. * Add --nftset option, like --ipset but for the newer nftables. * Add --filter-A and --filter-AAAA options, to remove IPv4 or IPv6 addresses from DNS answers. * Fix crash doing netbooting when --port is set to zero to disable the DNS server. Thanks to Drexl Johannes for the bug report. * Generalise --dhcp-relay. Sending via broadcast/multicast is now supported for both IPv4 and IPv6 and the configuration syntax made easier (but backwards compatible). * Add snooping of IPv6 prefix-delegations to the DHCP-relay system. * Finesse parsing of --dhcp-remoteid and --dhcp-subscrid. To be treated as hex, the pattern must consist of only hex digits AND contain at least one ':'. Thanks to Bengt-Erik Sandstrom who tripped over a pattern consisting of a decimal number which was interpreted surprisingly. * Include client address in TFTP file-not-found error reports. Thanks to Stefan Rink for the initial patch, which has been re-worked by me (srk). All bugs mine. * Note in manpage the change in behaviour of -address. This behaviour actually changed in v2.86, but was undocumented there. From 2.86 on, (eg) --address=/example.com/1.2.3.4 ONLY applies to A queries. All other types of query will be sent upstream. Pre 2.86, that would catch the whole example.com domain and queries for other types would get a local NODATA answer. The pre-2.86 behaviour is still available, by configuring --address=/example.com/1.2.3.4 --local=/example.com/ * Fix problem with binding DHCP sockets to an individual interface. Despite the fact that the system call tales the interface _name_ as a parameter, it actually, binds the socket to interface _index_. Deleting the interface and creating a new one with the same name leaves the socket bound to the old index. (Creating new sockets always allocates a fresh index, they are not reused). We now take this behaviour into account and keep up with changing indexes. * Add --conf-script configuration option. * Enhance --domain to accept, for instance, - -domain=net2.thekelleys.org.uk,eth2 so that hosts get a domain which relects the interface they are attached to in a way which doesn't require hard-coding addresses. Thanks to Sten Spans for the idea. * Fix write-after-free error in DHCPv6 server code. CVE-2022-0934 refers. * Add the ability to specify destination port in DHCP-relay mode. This change also removes a previous bug where --dhcp-alternate-port would affect the port used to relay _to_ as well as the port being listened on. The new feature allows configuration to provide bug-for-bug compatibility, if required. Thanks to Damian Kaczkowski for the feature suggestion. * Bound the value of UDP packet size in the EDNS0 header of forwarded queries to the configured or default value of edns-packet-max. There's no point letting a client set a larger value if we're unable to return the answer. Thanks to Bertie Taylor for pointing out the problem and supplying the patch. - drop dnsmasq-CVE-2022-0934.patch, dnsmasq-resolv-conf.patch (upstream) - update to 2.88: * Fix bug in --dynamic-host when an interface has /16 IPv4 * address. * Add --fast-dns-retry option. This gives dnsmasq the ability to originate retries for upstream DNS queries itself, rather than relying on the downstream client. This is most useful when doing DNSSEC over unreliable upstream networks. It comes with some cost in memory usage and network bandwidth. * Add --use-stale-cache option. When set, if a DNS name exists in the cache, but its time-to-live has expired, dnsmasq will return the data anyway. * handle removal of whole files or entries within files. - update to 2.89: * Fix bug introduced in 2.88 (commit fe91134b) which can result in corruption of the DNS cache internal data structures and logging of "cache internal error". This has only been seen in one place in the wild, and it took considerable effort to even generate a test case to reproduce it, but there's no way to be sure it won't strike, and the effect is to break the cache badly. Installations with DNSSEC enabled are more likely to see the problem, but not running DNSSEC does not guarantee that it won't happen. Thanks to Timo van Roermund for reporting the bug and for his great efforts in chasing it down. (boo#1207174) - remove no longer needed rpmlintrc filters - bsc#1209358, CVE-2023-28450, dnsmasq-CVE-2023-28450.patch: default maximum EDNS.0 UDP packet size should be 1232 - Correct rundir from /var/run to /run for pid file - SLP got dropped, remove config (bsc#1214884) - update to 2.90: * CVE-2023-50387, CVE-2023-50868, bsc#1219823, bsc#1219826: Denial Of Service while trying to validate specially crafted DNSSEC responses * Fix reversion in --rev-server introduced in 2.88 which caused breakage if the prefix length is not exactly divisible by 8 (IPv4) or 4 (IPv6). * Fix possible SEGV when there server(s) for a particular domain are configured, but no server which is not qualified for a particular domain. * Set the default maximum DNS UDP packet sice to 1232. Obsoletes: dnsmasq-CVE-2023-28450.patch * Add --no-dhcpv4-interface and --no-dhcpv6-interface for better control over which inetrfaces are providing DHCP service. * Fix issue with stale caching * Add configurable caching for arbitrary RR-types. * Add --filter-rr option, to filter arbitrary RR-types. - Backport <https://github.com/containerd/fifo/pull/32> to fix a crash-on-start issue with dockerd. bsc#1200022 + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Backport <https://github.com/containerd/fifo/pull/32> to fix a crash-on-start issue with dockerd. bsc#1200022 + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Backport <https://github.com/containerd/fifo/pull/32> to fix a crash-on-start issue with dockerd. bsc#1200022 + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Backport <https://github.com/containerd/fifo/pull/32> to fix a crash-on-start issue with dockerd. bsc#1200022 + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Change to using systemd-sysusers - Allow to install container-selinux instead of apparmor-parser. - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Allow to disable apparmor support (ALP supports only SELinux) - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Allow to disable apparmor support (ALP supports only SELinux) - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Allow to disable apparmor support (ALP supports only SELinux) - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Fix syntax of boolean dependency - Add apparmor-parser as a Recommends to make sure that most users will end up with it installed even if they are primarily running SELinux. - Fix wrong After: in docker.service, fixes bsc#1188447 - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. bsc#1206065 bsc#1205375 CVE-2022-36109 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch * 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - The PRIVATE-REGISTRY patch will now output a warning if it is being used (in preparation for removing the feature). This feature was never meant to be used by users directly (and is only available in the -kubic/CaaSP version of the package anyway) and thus should not affect any users. - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelong online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Allow to disable apparmor support (ALP supports only SELinux) - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - update to 20.10.23-ce. * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023 - drop kubic flavor as kubic is EOL. this removes: kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch - Update to Docker 23.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2304>. bsc#1208074 - Fixes: * bsc#1214107 - CVE-2023-28840 * bsc#1214108 - CVE-2023-28841 * bsc#1214109 - CVE-2023-28842 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Renumbered patches: - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Remove upstreamed patches: - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch - Backport <https://github.com/docker/cli/pull/4228> to allow man pages to be built without internet access in OBS. + cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2305>. - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 23.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/23.0/#2306>. bsc#1211578 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Re-unify packaging for SLE-12 and SLE-15. - Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers (the uapi headers in SLE-12 are too old). + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch - Re-numbered patches: - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch` - Update to Docker 24.0.2-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2402>. bsc#1212368 * Includes the upstreamed fix for the mount table pollution issue. bsc#1210797 - Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as being provided by this package. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Add docker-rootless-extras subpackage (https://docs.docker.com/engine/security/rootless) - Recommend docker-rootless-extras instead of Require(ing) it, given it's an additional functionality and not inherently required for docker to function. - Update to Docker 24.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2403>. bsc#1213120 - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 24.0.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2404>. bsc#1213500 - Update to Docker 24.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2405>. bsc#1213229 - Update to Docker 24.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Switch from disabledrun to manualrun in _service. - Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141 - Add a patch to fix apparmor on SLE-12, reverting the upstream removal of version-specific templating for the default apparmor profile. bsc#1213500 + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch - Update to Docker 24.0.7-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513 * Deny containers access to /sys/devices/virtual/powercap by default. - CVE-2020-8694 bsc#1170415 - CVE-2020-8695 bsc#1170446 - CVE-2020-12912 bsc#1178760 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Vendor latest buildkit v0.11: Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that vendors in the latest v0.11 buildkit branch including bugfixes for the following: * bsc#1219438: CVE-2024-23653 * bsc#1219268: CVE-2024-23652 * bsc#1219267: CVE-2024-23651 - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - switch from %patchN to %patch -PN syntax - remove unused rpmlint filters and add filters to silence pointless bash & zsh completion warnings - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes a fix for CVE-2024-41110. bsc#1228324 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.0.1-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.0/#2601> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.1.0-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2610> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 26.1.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2614> - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 bsc#1229806 * CVE-2023-45142. bsc#1228553 bsc#1229806 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - Update to Docker 26.1.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2615> bsc#1230294 - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 * CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331 - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333 - Make some minor name macro updates to help with the docker-stable package fork. - Add %{_sysconfdir}/audit/rules.d to filelist. - Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. bsc#1231348 bsc#1232999 - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.17.1> - Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles. - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. - Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819 - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch - Update docker-buildx to v0.19.2. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.19.2>. Some notable changelogs from the last update: * <https://github.com/docker/buildx/releases/tag/v0.19.0> * <https://github.com/docker/buildx/releases/tag/v0.18.0> - Update to Go 1.22. - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.0.1-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.0/#2601> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.1.0-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2610> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 26.1.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2614> - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 bsc#1229806 * CVE-2023-45142. bsc#1228553 bsc#1229806 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - Update to Docker 26.1.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2615> bsc#1230294 - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 * CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331 - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333 - Make some minor name macro updates to help with the docker-stable package fork. - Add %{_sysconfdir}/audit/rules.d to filelist. - Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. bsc#1231348 bsc#1232999 - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.17.1> - Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles. - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. - Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819 - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch - Update docker-buildx to v0.19.2. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.19.2>. Some notable changelogs from the last update: * <https://github.com/docker/buildx/releases/tag/v0.19.0> * <https://github.com/docker/buildx/releases/tag/v0.18.0> - Update to Go 1.22. - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.0.1-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.0/#2601> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.1.0-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2610> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 26.1.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2614> - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 bsc#1229806 * CVE-2023-45142. bsc#1228553 bsc#1229806 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - Update to Docker 26.1.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2615> bsc#1230294 - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 * CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331 - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333 - Make some minor name macro updates to help with the docker-stable package fork. - Add %{_sysconfdir}/audit/rules.d to filelist. - Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. bsc#1231348 bsc#1232999 - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.17.1> - Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles. - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. - Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819 - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch - Update docker-buildx to v0.19.2. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.19.2>. Some notable changelogs from the last update: * <https://github.com/docker/buildx/releases/tag/v0.19.0> * <https://github.com/docker/buildx/releases/tag/v0.18.0> - Update to Go 1.22. - Update to Docker 25.0.3-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2503> - Fixes: * bsc#1219267 - CVE-2024-23651 * bsc#1219268 - CVE-2024-23652 * bsc#1219438 - CVE-2024-23653 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch - Allow to disable apparmor support (ALP supports only SELinux) [NOTE: This update was only ever released in SLES and Leap.] - Add patch to fix bsc#1220339 * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2505> bsc#1223409 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.0.1-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.0/#2601> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update --add-runtime to point to correct binary path. - Update to Docker 26.1.0-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2610> - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to Docker 26.1.4-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2614> - Rebase patches: * cli-0001-docs-include-required-tools-in-source-tree.patch - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and <https://github.com/moby/buildkit/pull/5060>. bsc#1221916 + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. Backport of <https://github.com/moby/moby/pull/48034>. bsc#1214855 + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch [NOTE: This update was only ever released in SLES and Leap.] - Update to Docker 25.0.6-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/25.0/#2506> - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 bsc#1229806 * CVE-2023-45142. bsc#1228553 bsc#1229806 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch - Update to Docker 26.1.5-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/26.1/#2615> bsc#1230294 - This update includes fixes for: * CVE-2024-41110. bsc#1228324 * CVE-2023-47108. bsc#1217070 * CVE-2023-45142. bsc#1228553 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331 - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333 - Make some minor name macro updates to help with the docker-stable package fork. - Add %{_sysconfdir}/audit/rules.d to filelist. - Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. bsc#1231348 bsc#1232999 - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.17.1> - Further merge docker and docker-stable specfiles to minimise the differences. The main thing is that we now include both halves of the Conflicts/Provides/Obsoletes dance in both specfiles. - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases. - Add docker-integration-tests-devel subpackage for building and running the upstream Docker integration tests on machines to test that Docker works properly. Users should not install this package. - docker-rpmlintrc updated to include allow-list for all of the integration tests package, since it contains a bunch of stuff that wouldn't normally be allowed. - Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819 - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999 In order to disable these mounts, just do echo 0 > /etc/docker/suse-secrets-enable and restart Docker. In order to re-enable them, just do echo 1 > /etc/docker/suse-secrets-enable and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not. * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch - Update docker-buildx to v0.19.2. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.19.2>. Some notable changelogs from the last update: * <https://github.com/docker/buildx/releases/tag/v0.19.0> * <https://github.com/docker/buildx/releases/tag/v0.18.0> - Update to Go 1.22. - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.242.g76ae5ce4: * fix(multipath): align multipathd.service type with upstream (bsc#1196958) * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.244.g2f624182: * fix(resume): only exclude this module when swap is netdev (bsc#1194915) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.248.g92d06110: * fix(resume): correct call to block_is_netdevice function (bsc#1197737) * chore(suse): remove fipscheck requirement (bsc#1198065) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.252.g4988b0bf: * fix(resume): do not add this module if there is no suitable swap (bsc#1198095) * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095) * feat(resume): sanity check (bsc#1197192) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.271.g70f710e4: * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970) * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461) * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967) * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635) * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604) * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267) * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508) * fix(bluetooth): make hostonly configuration files optional (bsc#1195047) - Update to version 055+suse.279.g3b3c36b2: * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236) * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360) * fix(convertfs): ignore commented lines in fstab (bsc#1200251) * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Update to version 055+suse.283.ge98ece25: * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975) * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709) - Update to version 055+suse.294.gc5bc4bb5: Missing network-manager module fixes (bsc#1201975): * fix(network-manager): avoid calling unavailable dracut-logger functions * fix(network-manager): skip non-directories in /sys/class/net * fix(network-manager): disable tty output if the console is not usable * fix(network-manager): show output on console only with rd.debug enabled * fix(network-manager): write DHCP filename option to dhcpopts file * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts * fix(network-manager): include nm-daemon-helper binary * fix(network-manager): don't pull in systemd-udev-settle * fix(network-manager): support teaming under NM+systemd * fix(network-manager): pull in network.target in nm-initrd.service - Update to version 055+suse.300.ge878982d: * chore(suse): change default persistent policy (jsc#PED-1885) * fix(systemd): add missing modprobe@.service (bsc#1203749) * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267) - Update to version 055+suse.306.g5b4feffc: * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235) * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894) - Update to version 055+suse.325.g6780025c: * fix(network-manager): always install the library plugins directory (bsc#1202014) * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014) A series of fixes for NVMeoF boot (bsc#1203368): * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto" * fix(network): avoid double brackets around IPv6 address * feat(nvmf): set rd.neednet=1 if tcp records encountered * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf * fix(network): don't use same ifname multiple times * fix(nvmf): run cmdline hook before parse-ip-opts.sh * fix(nvmf): avoid calling "exit" in a cmdline hook * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence * fix(nvmf): don't use "finished" queue for autoconnect * fix(nvmf): don't create did-setup file * fix(nvmf): no need to load the nvme module * fix(nvmf): don't try to validate network connections in cmdline hook * fix(nvmf): nvme list-subsys prints the address using commas as separator * fix(nvmf): deprecate old nvmf cmdline options * fix(nvmf): set executable bit on nvmf-autoconnect.sh - Update to version 055+suse.333.g39325ba0: * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056) * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169) * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175) * fix(nfs): chown using rpc default group (bsc#1204929) - Update to version 055+suse.343.g0113f4b9: A series of changes for the NVMeoF boot feature (jsc#PED-1449): * fix(dracut.spec): require jq for nvmf * fix(suse/dracut.spec): require program for duplicate IP address detection * fix(iscsi): install 8021q module unconditionally * fix(nvmf): install 8021q module unconditionally * feat(nvmf): enable module if NBFT exists * feat(nvmf): add NBFT connect support, and fix configuration priority * feat(nvmf): add code for parsing the NBFT * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) - Update to version 055+suse.345.g8b8708cb: * feat(lvm): always include all drivers that LVM can use (bsc#1206195) - Update to version 055+suse.353.g5603b001: A series of changes for the NVMeoF boot with IPv6 (bsc#1209166): * fix(nvmf): move connect logic to initqueue script * fix(nvmf): don't assume prefix lenth 64 by default * fix(nvmf): prefix syntax for static iBFT IPv6 addresses * fix(network): IPv6: don't wait for RA for static IPv6 assignments * fix(network-legacy): always include af_packet * fix(network): don't assume prefix lenth 64 by default * fix(iscsi): prefix syntax for static iBFT IPv6 addresses - Update to version 055+suse.360.g076f1113: * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640) fips=1 and separate /boot break s390x (bsc#1204478): * fix(fips): move fips-boot script to pre-pivot * fix(fips): only unmount /boot if it was mounted by the fips module * feat(fips): add progress messages * fix(fips): do not blindly remove /boot - Update to version 055+suse.364.g4c1d0276: * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080) * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072) * fix(nvmf): set netroot=nbft (bsc#1210909) - Update to version 055+suse.366.g14047665: * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662) - Update to version 055+suse.369.gde6c81bf: * fix(dracut-install): protect against broken links pointing to themselves * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081) - Update to version 055+suse.371.g5237e44a: * fix(nvmf): support /etc/nvme/config.json (bsc#1215578) - Update to version 055+suse.375.g1167ed75: * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031) * fix(network): correct network device naming (bsc#1192986) - Update to version 055+suse.382.g80b55af2: * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675) * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841) * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083) - Update to version 055+suse.388.g70c21afa: * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529) * fix(mdraid): try to assemble the missing raid device (bsc#1226412) * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690) - Update to version 055+suse.392.g7930ab23: * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398) * fix(convertfs): error in conditional expressions (bsc#1228847) - Update to version 055+suse.394.ga838b0c7: * fix(zfcp_rules): check for presence of legacy rules (bsc#1230330) - Update to version 055+suse.396.g701c6212: * fix(dasd-rules): handle all possible options in `rd.dasd` (bsc#1230110) - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Ship libduktape206-32bit: needed by libproxy since version 0.5. - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Update version number to 0.11.0 - Rebase patches (efibootmgr-0.11.0-derhat.diff, efibootmgr-0.11.0-check-boot-order.diff) - Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of the variable is handled properly now - Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn() are introduced to show more meaningful messages - Drop upstreamed patch (efibootmgr-0.6.0-gcc-Wall.diff, efibootmgr-0.6.0-write-unique-id-once.diff) - efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff: pass source validator check - switch homepage to https://github.com/vathpela/efibootmgr - Enable i586 build - Introduce partition UUID as selector for delete. [bsc#870211] (efibootmgr-0.6.0-delete-by-uuid.diff) - Allow disk/partition as selector for delete as well. [bsc#870211] (efibootmgr-delete-multiple.diff) - Remove version number from patches. (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff, efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff, efibootmgr-write-unique-id-once.diff; drop efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff, efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff, efibootmgr-0.6.0-set_boot_order.diff, efibootmgr-0.6.0-write-unique-id-once.diff) Note: this entry reflects obsoleted, SLE-only changes! - Update to 0.12 * This release is mostly a maintenance release that uses libefivar's new library API for creating device paths and load options. * Also DHCPv4 network boot entries are now something you can create without knowing an awful lot about ACPI. - Refresh patches efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff efibootmgr-0.11.0-check-boot-order.diff as efibootmgr-check-boot-order.diff - Update project and download url - Refresh for SLE12. [bsc#929677] (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff) - Properly latch long to short option for delete. [bsc#945705] (efibootmgr-delete-multiple.diff) - Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors caused by the efivar update - Add support for Memory Address Range Mirroring. [fate#320999, bsc#987599] (add MARM-add-m-and-M-options.diff, MARM-fix-insufficient-validation-check-of-M-option.diff, MARM-introduce-man-for-m-and-M-option.diff, MARM-extend-man-for-M-option.diff, MARM-sanitize-set_mirror.diff) - add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix efibootmgr -v with new efivar (boo#993458) - Build on all archs. There is no reason not to. [boo#1025520] - Depend on new enough efivar. Build fails otherwise. - Update to 14 plus upstream fixes. [fate#322108] (0001-Don-t-use-fshort-wchar-when-building-63.patch, 0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch, 0003-Add-support-for-parsing-optional-data-as-ucs2.patch) - Forward port and refresh SLE patches (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff efibootmgr-delete-multiple.diff) - Drop upstreamed patches (efibootmgr-check-boot-order.diff, efibootmgr-fix-efivar-0.24.patch, efibootmgr-fix-usage-of-efi_loadopt_path-again.patch, MARM-add-m-and-M-options.diff, MARM-extend-man-for-M-option.diff, MARM-fix-insufficient-validation-check-of-M-option.diff, MARM-introduce-man-for-m-and-M-option.diff) - forcefully enable PIE - Use %license instead of %doc [bsc#1082318] - Update to v17: [jsc#SLE-22542] * use efivar's logging facility more (more info in -v2 , -v3, etc) * Various bug fixes * Better -e parsing * fix pkg-config invocation for ldflags * Make efibootmgr use EFIDIR / efibootmgr.efidir like fwupdate does * make --loader default build-time configurable * sanitize set_mirror()/get_mirror() * Add support for parsing loader options as UCS2 * GCC 7 fixes * Don't use -fshort-wchar since we don't run on EFI machines. - Drop 0001-Don-t-use-fshort-wchar-when-building-63.patch (upstreamed) - Drop 0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch (upstreamed) - Drop 0003-Add-support-for-parsing-optional-data-as-ucs2.patch (upstreamed) - Drop MARM-sanitize-set_mirror.diff (upstreamed) - Drop efibootmgr-derhat.diff (upstreamed) - Rebase efibootmgr-delete-multiple.diff - Print EFI status for failed '--create' as well. [bnc#811767] (efibootmgr-0.5.4-fail-visibly.diff) - Update version number to 0.6.0, - Integrate SLE11 patches. [bnc#830784] (efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-set_boot_order.diff) - Fix gcc warnings. (efibootmgr-0.6.0-gcc-Wall.diff) - Make default '--loader' build-time configurable. (efibootmgr-0.6.0-derhat.diff) - Don't let '--write-signature' overwrite unique signatures. (efibootmgr-0.6.0-write-unique-id-once.diff) - Drop obsolete patches (efibootmgr-0.5.4.diff, efibootmgr-0.5.4-catchup.diff, efibootmgr-0.5.4-sector-size.diff) - Add efibootmgr-0.6.0-check-boot-order.diff to delete BootOrder if there is no more boot option. [bnc#883545] - Enable for aarch64 [fate#318444] - Update version number to 0.11.0 - Rebase patches (efibootmgr-0.11.0-derhat.diff, efibootmgr-0.11.0-check-boot-order.diff) - Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of the variable is handled properly now - Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn() are introduced to show more meaningful messages - Drop upstreamed patch (efibootmgr-0.6.0-gcc-Wall.diff, efibootmgr-0.6.0-write-unique-id-once.diff) - efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff: pass source validator check - switch homepage to https://github.com/vathpela/efibootmgr - Enable i586 build - Introduce partition UUID as selector for delete. [bsc#870211] (efibootmgr-0.6.0-delete-by-uuid.diff) - Allow disk/partition as selector for delete as well. [bsc#870211] (efibootmgr-delete-multiple.diff) - Remove version number from patches. (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff, efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff, efibootmgr-write-unique-id-once.diff; drop efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff, efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff, efibootmgr-0.6.0-set_boot_order.diff, efibootmgr-0.6.0-write-unique-id-once.diff) Note: this entry reflects obsoleted, SLE-only changes! - Update to 0.12 * This release is mostly a maintenance release that uses libefivar's new library API for creating device paths and load options. * Also DHCPv4 network boot entries are now something you can create without knowing an awful lot about ACPI. - Refresh patches efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff efibootmgr-0.11.0-check-boot-order.diff as efibootmgr-check-boot-order.diff - Update project and download url - Refresh for SLE12. [bsc#929677] (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff) - Properly latch long to short option for delete. [bsc#945705] (efibootmgr-delete-multiple.diff) - Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors caused by the efivar update - Add support for Memory Address Range Mirroring. [fate#320999, bsc#987599] (add MARM-add-m-and-M-options.diff, MARM-fix-insufficient-validation-check-of-M-option.diff, MARM-introduce-man-for-m-and-M-option.diff, MARM-extend-man-for-M-option.diff, MARM-sanitize-set_mirror.diff) - add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix efibootmgr -v with new efivar (boo#993458) - Build on all archs. There is no reason not to. [boo#1025520] - Depend on new enough efivar. Build fails otherwise. - Update to 14 plus upstream fixes. [fate#322108] (0001-Don-t-use-fshort-wchar-when-building-63.patch, 0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch, 0003-Add-support-for-parsing-optional-data-as-ucs2.patch) - Forward port and refresh SLE patches (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff efibootmgr-delete-multiple.diff) - Drop upstreamed patches (efibootmgr-check-boot-order.diff, efibootmgr-fix-efivar-0.24.patch, efibootmgr-fix-usage-of-efi_loadopt_path-again.patch, MARM-add-m-and-M-options.diff, MARM-extend-man-for-M-option.diff, MARM-fix-insufficient-validation-check-of-M-option.diff, MARM-introduce-man-for-m-and-M-option.diff) - forcefully enable PIE - Use %license instead of %doc [bsc#1082318] - Update to v17: [jsc#SLE-22542] * use efivar's logging facility more (more info in -v2 , -v3, etc) * Various bug fixes * Better -e parsing * fix pkg-config invocation for ldflags * Make efibootmgr use EFIDIR / efibootmgr.efidir like fwupdate does * make --loader default build-time configurable * sanitize set_mirror()/get_mirror() * Add support for parsing loader options as UCS2 * GCC 7 fixes * Don't use -fshort-wchar since we don't run on EFI machines. - Drop 0001-Don-t-use-fshort-wchar-when-building-63.patch (upstreamed) - Drop 0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch (upstreamed) - Drop 0003-Add-support-for-parsing-optional-data-as-ucs2.patch (upstreamed) - Drop MARM-sanitize-set_mirror.diff (upstreamed) - Drop efibootmgr-derhat.diff (upstreamed) - Rebase efibootmgr-delete-multiple.diff - Update version number to 0.11.0 - Rebase patches (efibootmgr-0.11.0-derhat.diff, efibootmgr-0.11.0-check-boot-order.diff) - Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of the variable is handled properly now - Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn() are introduced to show more meaningful messages - Drop upstreamed patch (efibootmgr-0.6.0-gcc-Wall.diff, efibootmgr-0.6.0-write-unique-id-once.diff) - efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff: pass source validator check - switch homepage to https://github.com/vathpela/efibootmgr - Enable i586 build - Introduce partition UUID as selector for delete. [bsc#870211] (efibootmgr-0.6.0-delete-by-uuid.diff) - Allow disk/partition as selector for delete as well. [bsc#870211] (efibootmgr-delete-multiple.diff) - Remove version number from patches. (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff, efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff, efibootmgr-write-unique-id-once.diff; drop efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff, efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff, efibootmgr-0.6.0-set_boot_order.diff, efibootmgr-0.6.0-write-unique-id-once.diff) Note: this entry reflects obsoleted, SLE-only changes! - Update to 0.12 * This release is mostly a maintenance release that uses libefivar's new library API for creating device paths and load options. * Also DHCPv4 network boot entries are now something you can create without knowing an awful lot about ACPI. - Refresh patches efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff efibootmgr-0.11.0-check-boot-order.diff as efibootmgr-check-boot-order.diff - Update project and download url - Refresh for SLE12. [bsc#929677] (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff) - Properly latch long to short option for delete. [bsc#945705] (efibootmgr-delete-multiple.diff) - Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors caused by the efivar update - Add support for Memory Address Range Mirroring. [fate#320999, bsc#987599] (add MARM-add-m-and-M-options.diff, MARM-fix-insufficient-validation-check-of-M-option.diff, MARM-introduce-man-for-m-and-M-option.diff, MARM-extend-man-for-M-option.diff, MARM-sanitize-set_mirror.diff) - add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix efibootmgr -v with new efivar (boo#993458) - Build on all archs. There is no reason not to. [boo#1025520] - Depend on new enough efivar. Build fails otherwise. - Update to 14 plus upstream fixes. [fate#322108] (0001-Don-t-use-fshort-wchar-when-building-63.patch, 0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch, 0003-Add-support-for-parsing-optional-data-as-ucs2.patch) - Forward port and refresh SLE patches (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff efibootmgr-delete-multiple.diff) - Drop upstreamed patches (efibootmgr-check-boot-order.diff, efibootmgr-fix-efivar-0.24.patch, efibootmgr-fix-usage-of-efi_loadopt_path-again.patch, MARM-add-m-and-M-options.diff, MARM-extend-man-for-M-option.diff, MARM-fix-insufficient-validation-check-of-M-option.diff, MARM-introduce-man-for-m-and-M-option.diff) - forcefully enable PIE - Use %license instead of %doc [bsc#1082318] - Update to v17: [jsc#SLE-22542] * use efivar's logging facility more (more info in -v2 , -v3, etc) * Various bug fixes * Better -e parsing * fix pkg-config invocation for ldflags * Make efibootmgr use EFIDIR / efibootmgr.efidir like fwupdate does * make --loader default build-time configurable * sanitize set_mirror()/get_mirror() * Add support for parsing loader options as UCS2 * GCC 7 fixes * Don't use -fshort-wchar since we don't run on EFI machines. - Drop 0001-Don-t-use-fshort-wchar-when-building-63.patch (upstreamed) - Drop 0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch (upstreamed) - Drop 0003-Add-support-for-parsing-optional-data-as-ucs2.patch (upstreamed) - Drop MARM-sanitize-set_mirror.diff (upstreamed) - Drop efibootmgr-derhat.diff (upstreamed) - Rebase efibootmgr-delete-multiple.diff - Version update to 2.2.7 (CVE-2018-20843, bsc#1139937) * Security fixes: - CVE-2018-20843 - Fix extraction of namespace prefixes from XML names; XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks * Other changes: - Autotools/CMake: Utilize -fvisibility=hidden to stop exporting non-API symbols - Autotools: Add --without-examples and --without-tests - Autotools: Modernize configure.ac - Autotools: Fix check for -fvisibility=hidden for Clang - Autotools: Fix compilation for lack of docbook2x-man - CMake: Make libdir of pkgconfig expat.pc support multilib - CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR - Remove fallback to bcopy, assume that memmove(3) exists - Removed expat-2.2.6-fix-make-clean.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - security update - added patches fix CVE-2024-50602 [bsc#1232579], DoS via XML_ResumeParser + expat-CVE-2024-50602.patch - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - This is the successor of sdo-client EPIC: SLE/SLE-22946 - Removed build key via utils/keys_gen.sh. (bsc#1216293) - Create initial package for version 0.3 - Update to v0.4.1 (bsc#1137860): - create_directory: do not redeclare variable buf - fuse-overlayfs: accept option "dev" - fuse-overlayfs: add check to readdir for the node parent - fuse-overlayfs: add cleanup for layers - fuse-overlayfs: drop usage of static arrays for paths - fuse-overlayfs: refactor some xattrs common code - fuse-overlayfs: start using GCC autocleanup - fuse-overlayfs: use cleanup function for initializing node - fuse-overlays: fix interaction of unlink(2) with readdir(2) - main: add missing debug messages - main: do the unlink only after we created the temporary file - main: fix a fd leak - main: ignore EINVAL when copying xattrs - setattr: use fd from fi->fh for ftruncate() whenever possible - Update to v0.5.1 - support fuse writeback cache and enable it by default - update to latest gnulib - add option to disable fsync - add option to disable xattrs - add option to skip ino number check in lower layers - fix fd validity check - fix memory leak - fix read after free - fix type for flistxattr return - fix warnings reported by lgtm.com - enable parallel dirops - Update to v0.7.2 - introduce inodes cache - correctly read inode for unix sockets - avoid hash map lookup when possible - use st_dev for the ino key - check whether writeback is supported - set_attrs: don't require write to S_IFREG - ioctl: do not reuse fi->fh for directories - fix skip whiteout deletion optimization - store the new mode after chmod - Update to v0.7.3 - fix build with -fno-common - fix possible segmentation fault in direct_fsync() - use the data store to create missing whiteouts - after a rename, force a directory reload - Update to v0.7.4 - fix fallocate for deleted files. - ignore O_DIRECT. It causes issues with libfuse not using an aligned buffer, causing write(2) to fail with EINVAL. - on copyup, do not copy the opaque xattr. - fix a wrong lookup for whiteout files, that could happen on a double unlink. - Update to v0.7.5 - do not expose internal xattrs through listxattr and getxattr - Update to v0.7.6 (bsc#1160460) - do not look in lower layers for the ino if there is no origin xattr set - attempt to use the file path if the operation on the fd fails with ENXIO - Update to v0.7.7 - make sure the destination is deleted before doing a rename(2). It prevents a left over directory to cause delete to fail with EEXIST. - honor --debug. - Update to v0.7.8 - report correctly the number of links for a directory also for subsequent stat calls - stop looking up the ino in the lower layers if the file could not be opened - Update to v1.0.0 - Fix portability issue to 32 bits architectures - Update to v1.1.0 - use openat2(2) when available. - accept "ro" as mount option. - fix set mtime for a symlink. - fix some issues reported by static analysis. - fix potential infinite loop on a short read. - fix creating a directory if the destination already exists in the upper layer. - udpate to 1.1.2 (bsc#1175821) - fix build issues with libmusl. - fix memory leak when creating whiteout files. - fix lookup for overflow uid when it is different than the overflow gid. - Create initial package for version 0.3 - Update to v0.4.1 (bsc#1137860): - create_directory: do not redeclare variable buf - fuse-overlayfs: accept option "dev" - fuse-overlayfs: add check to readdir for the node parent - fuse-overlayfs: add cleanup for layers - fuse-overlayfs: drop usage of static arrays for paths - fuse-overlayfs: refactor some xattrs common code - fuse-overlayfs: start using GCC autocleanup - fuse-overlayfs: use cleanup function for initializing node - fuse-overlays: fix interaction of unlink(2) with readdir(2) - main: add missing debug messages - main: do the unlink only after we created the temporary file - main: fix a fd leak - main: ignore EINVAL when copying xattrs - setattr: use fd from fi->fh for ftruncate() whenever possible - Update to v0.5.1 - support fuse writeback cache and enable it by default - update to latest gnulib - add option to disable fsync - add option to disable xattrs - add option to skip ino number check in lower layers - fix fd validity check - fix memory leak - fix read after free - fix type for flistxattr return - fix warnings reported by lgtm.com - enable parallel dirops - Update to v0.7.2 - introduce inodes cache - correctly read inode for unix sockets - avoid hash map lookup when possible - use st_dev for the ino key - check whether writeback is supported - set_attrs: don't require write to S_IFREG - ioctl: do not reuse fi->fh for directories - fix skip whiteout deletion optimization - store the new mode after chmod - Update to v0.7.3 - fix build with -fno-common - fix possible segmentation fault in direct_fsync() - use the data store to create missing whiteouts - after a rename, force a directory reload - Update to v0.7.4 - fix fallocate for deleted files. - ignore O_DIRECT. It causes issues with libfuse not using an aligned buffer, causing write(2) to fail with EINVAL. - on copyup, do not copy the opaque xattr. - fix a wrong lookup for whiteout files, that could happen on a double unlink. - Update to v0.7.5 - do not expose internal xattrs through listxattr and getxattr - Update to v0.7.6 (bsc#1160460) - do not look in lower layers for the ino if there is no origin xattr set - attempt to use the file path if the operation on the fd fails with ENXIO - Update to v0.7.7 - make sure the destination is deleted before doing a rename(2). It prevents a left over directory to cause delete to fail with EEXIST. - honor --debug. - Update to v0.7.8 - report correctly the number of links for a directory also for subsequent stat calls - stop looking up the ino in the lower layers if the file could not be opened - Update to v1.0.0 - Fix portability issue to 32 bits architectures - Update to v1.1.0 - use openat2(2) when available. - accept "ro" as mount option. - fix set mtime for a symlink. - fix some issues reported by static analysis. - fix potential infinite loop on a short read. - fix creating a directory if the destination already exists in the upper layer. - udpate to 1.1.2 (bsc#1175821) - fix build issues with libmusl. - fix memory leak when creating whiteout files. - fix lookup for overflow uid when it is different than the overflow gid. - Create initial package for version 0.3 - Update to v0.4.1 (bsc#1137860): - create_directory: do not redeclare variable buf - fuse-overlayfs: accept option "dev" - fuse-overlayfs: add check to readdir for the node parent - fuse-overlayfs: add cleanup for layers - fuse-overlayfs: drop usage of static arrays for paths - fuse-overlayfs: refactor some xattrs common code - fuse-overlayfs: start using GCC autocleanup - fuse-overlayfs: use cleanup function for initializing node - fuse-overlays: fix interaction of unlink(2) with readdir(2) - main: add missing debug messages - main: do the unlink only after we created the temporary file - main: fix a fd leak - main: ignore EINVAL when copying xattrs - setattr: use fd from fi->fh for ftruncate() whenever possible - Update to v0.5.1 - support fuse writeback cache and enable it by default - update to latest gnulib - add option to disable fsync - add option to disable xattrs - add option to skip ino number check in lower layers - fix fd validity check - fix memory leak - fix read after free - fix type for flistxattr return - fix warnings reported by lgtm.com - enable parallel dirops - Update to v0.7.2 - introduce inodes cache - correctly read inode for unix sockets - avoid hash map lookup when possible - use st_dev for the ino key - check whether writeback is supported - set_attrs: don't require write to S_IFREG - ioctl: do not reuse fi->fh for directories - fix skip whiteout deletion optimization - store the new mode after chmod - Update to v0.7.3 - fix build with -fno-common - fix possible segmentation fault in direct_fsync() - use the data store to create missing whiteouts - after a rename, force a directory reload - Update to v0.7.4 - fix fallocate for deleted files. - ignore O_DIRECT. It causes issues with libfuse not using an aligned buffer, causing write(2) to fail with EINVAL. - on copyup, do not copy the opaque xattr. - fix a wrong lookup for whiteout files, that could happen on a double unlink. - Update to v0.7.5 - do not expose internal xattrs through listxattr and getxattr - Update to v0.7.6 (bsc#1160460) - do not look in lower layers for the ino if there is no origin xattr set - attempt to use the file path if the operation on the fd fails with ENXIO - Update to v0.7.7 - make sure the destination is deleted before doing a rename(2). It prevents a left over directory to cause delete to fail with EEXIST. - honor --debug. - Update to v0.7.8 - report correctly the number of links for a directory also for subsequent stat calls - stop looking up the ino in the lower layers if the file could not be opened - Update to v1.0.0 - Fix portability issue to 32 bits architectures - Update to v1.1.0 - use openat2(2) when available. - accept "ro" as mount option. - fix set mtime for a symlink. - fix some issues reported by static analysis. - fix potential infinite loop on a short read. - fix creating a directory if the destination already exists in the upper layer. - udpate to 1.1.2 (bsc#1175821) - fix build issues with libmusl. - fix memory leak when creating whiteout files. - fix lookup for overflow uid when it is different than the overflow gid. - Create initial package for version 0.3 - Update to v0.4.1 (bsc#1137860): - create_directory: do not redeclare variable buf - fuse-overlayfs: accept option "dev" - fuse-overlayfs: add check to readdir for the node parent - fuse-overlayfs: add cleanup for layers - fuse-overlayfs: drop usage of static arrays for paths - fuse-overlayfs: refactor some xattrs common code - fuse-overlayfs: start using GCC autocleanup - fuse-overlayfs: use cleanup function for initializing node - fuse-overlays: fix interaction of unlink(2) with readdir(2) - main: add missing debug messages - main: do the unlink only after we created the temporary file - main: fix a fd leak - main: ignore EINVAL when copying xattrs - setattr: use fd from fi->fh for ftruncate() whenever possible - Update to v0.5.1 - support fuse writeback cache and enable it by default - update to latest gnulib - add option to disable fsync - add option to disable xattrs - add option to skip ino number check in lower layers - fix fd validity check - fix memory leak - fix read after free - fix type for flistxattr return - fix warnings reported by lgtm.com - enable parallel dirops - Update to v0.7.2 - introduce inodes cache - correctly read inode for unix sockets - avoid hash map lookup when possible - use st_dev for the ino key - check whether writeback is supported - set_attrs: don't require write to S_IFREG - ioctl: do not reuse fi->fh for directories - fix skip whiteout deletion optimization - store the new mode after chmod - Update to v0.7.3 - fix build with -fno-common - fix possible segmentation fault in direct_fsync() - use the data store to create missing whiteouts - after a rename, force a directory reload - Update to v0.7.4 - fix fallocate for deleted files. - ignore O_DIRECT. It causes issues with libfuse not using an aligned buffer, causing write(2) to fail with EINVAL. - on copyup, do not copy the opaque xattr. - fix a wrong lookup for whiteout files, that could happen on a double unlink. - Update to v0.7.5 - do not expose internal xattrs through listxattr and getxattr - Update to v0.7.6 (bsc#1160460) - do not look in lower layers for the ino if there is no origin xattr set - attempt to use the file path if the operation on the fd fails with ENXIO - Update to v0.7.7 - make sure the destination is deleted before doing a rename(2). It prevents a left over directory to cause delete to fail with EEXIST. - honor --debug. - Update to v0.7.8 - report correctly the number of links for a directory also for subsequent stat calls - stop looking up the ino in the lower layers if the file could not be opened - Update to v1.0.0 - Fix portability issue to 32 bits architectures - Update to v1.1.0 - use openat2(2) when available. - accept "ro" as mount option. - fix set mtime for a symlink. - fix some issues reported by static analysis. - fix potential infinite loop on a short read. - fix creating a directory if the destination already exists in the upper layer. - udpate to 1.1.2 (bsc#1175821) - fix build issues with libmusl. - fix memory leak when creating whiteout files. - fix lookup for overflow uid when it is different than the overflow gid. - Amend License: field with BSD2c, from https://github.com/libfuse/libfuse/commit/4c699e7debd99b178b9574e7dd20f36937ef296e#diff-3f1e2bdc537057b6ac2f74d095a431b8 - Update to 3.5.0: * Changed ioctl commands to "unsigned int" in order to support commands which do not fit into a signed int. Commands issued by applications are still truncated to 32 bits. * Added SMB2 to whitelist (so users can now mount FUSE filesystems on mountpoints within SMB 2.0 filesystems). * Added a new cache_readdir flag to fuse_file_info to enable caching of readdir results. Supported by kernels 4.20 and newer. * Add support and documentation for FUSE_CAP_NO_OPENDIR_SUPPORT. - Update to version 3.6.0 * Added a new example (passthrough_hp). The functionality is similar to passthrough_ll, but the implementation focuses on performance and correctness rather than simplicity. * Added support for fuse kernel feature max_pages which allows to increase the maximum number of pages that can be used per request. This feature was introduced in kernel 4.20. max_pages is set based on the value in max_write. By default max_write will be 1MiB now for kernels that support max_pages. If you want smaller buffers or writes you have to set max_write manually. - Update to version 3.6.1 (bsc#1137860) * Fixed version number (release 3.6.0 was shipped with a declared version of 3.0.0). - Disable LTO due to symbol versioning (boo#1138803). - Update to version 3.6.2 * The init script is now installed to /etc/ rather than /usr/local/etc by default. * Minor bugfixes - Drop fuse-install-fix.patch, not needed with -Duseroot=false - Add conf-rename.patch, which is split from the above now removed patch - Update to version 3.8.0 * Added support for FUSE_LSEEK operation which can be used to report holes in sparse files. - Update to version 3.9.0 * Added support for FUSE_EXPLICIT_INVAL_DATA to enable onl invalidate cached pages on explicit request. - Update to version 3.9.1 * Fixed memory leak in fuse_session_new(). * Fixed an issue with the linker version script. * Make ioctl prototype conditional on FUSE_USE_VERSION. Define FUSE_USE_VERSION < 35 to get old ioctl prototype with int commands; define FUSE_USE_VERSION >= 35 to get new ioctl prototype with unsigned int commands. * Various small bugfixes. - Update to version 3.9.2 * Remove obsolete workarounds in examples. * Do not require C++ compiler for building. * Minor bugfixes. - Drop BR on c++_compiler - Update to version 3.9.3 * Minor bugfixes, documentation updates - Update to release 3.10.0 * Add FUSE_CAP_CACHE_SYMLINKS: allow caching symlinks in kernel page cache. - Drop /sbin links; they do not seem to be used from anywhere. - Package "permission" is required in %post, not %pre. - Update descriptions. - Update to release 3.10.1 * Unspecified "various minor fixes" - prepare usrmerge (boo#1029961) - Update to release 3.10.2 * Allow "nonempty" as a mount option, for backwards compatibility with fusermount 2. The option has no effect since mounting over non-empty directories is allowed by default. * FUSE filesystems can now be mounted underneath EXFAT mountpoints. - Update to release 3.10.3 * Fix returning d_ino and d_type from readdir(3) in non-plus mode - Update to release 3.10.4 * Source code: fixed memory leaks in examples. - Update to release 3.10.5 * Various improvements to make unit tests more robust. - Update fuse3 to the version >= 3.9.1 (jsc#SLE-21826) - Amend the spec file to detect SLE/openSUSE (bsc#990228) - Relax the requirement of efivar-devel and disable the efivar API patch for openSUSE Leap 42.x and SLE - Enable efivar API patch based on pkg-config data and require at least gnu-efi-3.0.2. (ramification of FATE#322108) - Remove the debug source and info of the EFI files when disabling the debug build (bsc#1031554) + Also remove the efi-debuginfo subpackage since the debug file is packaged correctly now. - Update to 9+git21.gcd8f7d7 (FATE#322805) - Add the new BuildRequires: libsmbios-devel - Update the so version of libfwup - Refresh fwupdate-suse-build.patch - Remove the upstream patches + fwupdate-fix-efivar-0.24-api.patch + fwupdate-bsc988000-set-a-mode-with-efi_set_variable.patch + fwupdate-unset-immutable-flag.patch - Drop fwupdate-bsc988886-add-leading-space.patch (Need shim >= 11) - Add fwupdate-list-firmware-types.patch to list the supported firmware types - Add back fwupdate-bsc988886-add-leading-space.patch due to the long pending shim signature request. Also drop the shim version requirement. - disable _unique_debug_names fow now fwupdate wants to install it's own debug files, but doesn't know about this option yet - EFI updates through fwupdate are also possible on Aarch64. smbios support is only relevant for some Dell machines, i.e. x86 only. - bring back accidental removed needssslcertforbuild - Remove fwupdate-bsc988886-add-leading-space.patch and bump the shim version requirement since we got the new signature for shim (bsc#1054712) - Require shim only for x86_64 (bsc#1088434) - Update to version 11 + lots of fixes from cov-scan and clang analyzer + support for Lenovo machines + experimental support for UI Capsules + Dell WMI support + lots of bugfixes + configurable EFI ESP location by setting ESPMOUNTPOINT or the git config property fwupdate.espmountdir during the build. + Lots of coverity work + ABI compatibility checking during the release process + Make subdirectory builds work - removed fwupdate-list-firmware-types.patch - Correct the requirement of efivar-devel version - Update to version 12 (FATE#326702) + Better CI. + Limit how large our WMI buffer can be. + Add fwup_version() because fwupd wants it. + Fix linking on (some) platforms that need libgcc_eh.a. + abicheck improvements. + Default to creating a UX capsule, whatever it may actually do. - Refresh fwupdate-suse-build.patch with quilt. - Use url for source tarball and license tag for COPYING. - Amend the spec file to avoid fwup*.efi from being removed mistakenly (bsc#1112832) - Move 'efi'-executables to '/usr/share/efi' (FATE#326960) - Fix the destination of 'efi'-executables for i586 (FATE#326960) - Add fwupdate-bsc1152928-update-aarch64-linker-script.patch to update the linker script for AArch64 to match the one in gnu-efi (bsc#1152928) - Add fwupdate-bsc1182057-add-sbat-support.patch to add SBAT section to EFI images (bsc#1182057) + Also specify the vendor SBAT - Update the email address of security team in SBAT (bsc#1221301) - Update fwupdate-bsc1182057-add-sbat-support.patch for elf_aarch64_efi.lds to set the memory permission explicitly to avoid ld warning like "LOAD segment with RWX permissions" - Amend the spec file to detect SLE/openSUSE (bsc#990228) - Relax the requirement of efivar-devel and disable the efivar API patch for openSUSE Leap 42.x and SLE - Enable efivar API patch based on pkg-config data and require at least gnu-efi-3.0.2. (ramification of FATE#322108) - Remove the debug source and info of the EFI files when disabling the debug build (bsc#1031554) + Also remove the efi-debuginfo subpackage since the debug file is packaged correctly now. - Update to 9+git21.gcd8f7d7 (FATE#322805) - Add the new BuildRequires: libsmbios-devel - Update the so version of libfwup - Refresh fwupdate-suse-build.patch - Remove the upstream patches + fwupdate-fix-efivar-0.24-api.patch + fwupdate-bsc988000-set-a-mode-with-efi_set_variable.patch + fwupdate-unset-immutable-flag.patch - Drop fwupdate-bsc988886-add-leading-space.patch (Need shim >= 11) - Add fwupdate-list-firmware-types.patch to list the supported firmware types - Add back fwupdate-bsc988886-add-leading-space.patch due to the long pending shim signature request. Also drop the shim version requirement. - disable _unique_debug_names fow now fwupdate wants to install it's own debug files, but doesn't know about this option yet - EFI updates through fwupdate are also possible on Aarch64. smbios support is only relevant for some Dell machines, i.e. x86 only. - bring back accidental removed needssslcertforbuild - Remove fwupdate-bsc988886-add-leading-space.patch and bump the shim version requirement since we got the new signature for shim (bsc#1054712) - Require shim only for x86_64 (bsc#1088434) - Update to version 11 + lots of fixes from cov-scan and clang analyzer + support for Lenovo machines + experimental support for UI Capsules + Dell WMI support + lots of bugfixes + configurable EFI ESP location by setting ESPMOUNTPOINT or the git config property fwupdate.espmountdir during the build. + Lots of coverity work + ABI compatibility checking during the release process + Make subdirectory builds work - removed fwupdate-list-firmware-types.patch - Correct the requirement of efivar-devel version - Update to version 12 (FATE#326702) + Better CI. + Limit how large our WMI buffer can be. + Add fwup_version() because fwupd wants it. + Fix linking on (some) platforms that need libgcc_eh.a. + abicheck improvements. + Default to creating a UX capsule, whatever it may actually do. - Refresh fwupdate-suse-build.patch with quilt. - Use url for source tarball and license tag for COPYING. - Amend the spec file to avoid fwup*.efi from being removed mistakenly (bsc#1112832) - Move 'efi'-executables to '/usr/share/efi' (FATE#326960) - Fix the destination of 'efi'-executables for i586 (FATE#326960) - Add fwupdate-bsc1152928-update-aarch64-linker-script.patch to update the linker script for AArch64 to match the one in gnu-efi (bsc#1152928) - Add fwupdate-bsc1182057-add-sbat-support.patch to add SBAT section to EFI images (bsc#1182057) + Also specify the vendor SBAT - Update the email address of security team in SBAT (bsc#1221301) - Update fwupdate-bsc1182057-add-sbat-support.patch for elf_aarch64_efi.lds to set the memory permission explicitly to avoid ld warning like "LOAD segment with RWX permissions" - Amend the spec file to detect SLE/openSUSE (bsc#990228) - Relax the requirement of efivar-devel and disable the efivar API patch for openSUSE Leap 42.x and SLE - Enable efivar API patch based on pkg-config data and require at least gnu-efi-3.0.2. (ramification of FATE#322108) - Remove the debug source and info of the EFI files when disabling the debug build (bsc#1031554) + Also remove the efi-debuginfo subpackage since the debug file is packaged correctly now. - Update to 9+git21.gcd8f7d7 (FATE#322805) - Add the new BuildRequires: libsmbios-devel - Update the so version of libfwup - Refresh fwupdate-suse-build.patch - Remove the upstream patches + fwupdate-fix-efivar-0.24-api.patch + fwupdate-bsc988000-set-a-mode-with-efi_set_variable.patch + fwupdate-unset-immutable-flag.patch - Drop fwupdate-bsc988886-add-leading-space.patch (Need shim >= 11) - Add fwupdate-list-firmware-types.patch to list the supported firmware types - Add back fwupdate-bsc988886-add-leading-space.patch due to the long pending shim signature request. Also drop the shim version requirement. - disable _unique_debug_names fow now fwupdate wants to install it's own debug files, but doesn't know about this option yet - EFI updates through fwupdate are also possible on Aarch64. smbios support is only relevant for some Dell machines, i.e. x86 only. - bring back accidental removed needssslcertforbuild - Remove fwupdate-bsc988886-add-leading-space.patch and bump the shim version requirement since we got the new signature for shim (bsc#1054712) - Require shim only for x86_64 (bsc#1088434) - Update to version 11 + lots of fixes from cov-scan and clang analyzer + support for Lenovo machines + experimental support for UI Capsules + Dell WMI support + lots of bugfixes + configurable EFI ESP location by setting ESPMOUNTPOINT or the git config property fwupdate.espmountdir during the build. + Lots of coverity work + ABI compatibility checking during the release process + Make subdirectory builds work - removed fwupdate-list-firmware-types.patch - Correct the requirement of efivar-devel version - Update to version 12 (FATE#326702) + Better CI. + Limit how large our WMI buffer can be. + Add fwup_version() because fwupd wants it. + Fix linking on (some) platforms that need libgcc_eh.a. + abicheck improvements. + Default to creating a UX capsule, whatever it may actually do. - Refresh fwupdate-suse-build.patch with quilt. - Use url for source tarball and license tag for COPYING. - Amend the spec file to avoid fwup*.efi from being removed mistakenly (bsc#1112832) - Move 'efi'-executables to '/usr/share/efi' (FATE#326960) - Fix the destination of 'efi'-executables for i586 (FATE#326960) - Add fwupdate-bsc1152928-update-aarch64-linker-script.patch to update the linker script for AArch64 to match the one in gnu-efi (bsc#1152928) - Add fwupdate-bsc1182057-add-sbat-support.patch to add SBAT section to EFI images (bsc#1182057) + Also specify the vendor SBAT - Update the email address of security team in SBAT (bsc#1221301) - Update fwupdate-bsc1182057-add-sbat-support.patch for elf_aarch64_efi.lds to set the memory permission explicitly to avoid ld warning like "LOAD segment with RWX permissions" - Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78 - Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215 * includes libgomp mold linker detection fix * includes nvptx offload compiler build fix * includes s390x tsan executable stack fix - Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287 * includes build fixes when building against glibc 2.33. - Add Provides of libstdc++6-pp-gccN to libstdc++6-pp. [bsc#1201848] - Remove workaround for obs-service-format_spec_file. - Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372 * includes release candidate for GCC 12.2 - Allow cross-pru-gcc12-bootstrap for armv7l architecture. PRU architecture is used for real-time MCUs embedded into TI armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for armv7l in order to build both host applications and PRU firmware during the same build. - Add gcc12-fifo-jobserver-support.patch that adds support for FIFO jobserver for make. - Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416 * includes GCC 12.2 release * includes recent fixes backported from trunk - Prune invalid-license rpmlint warnings, the SLE12 codestream doesn't get fixed but FF applies there, too. [bsc#1185337] - add gcc12-riscv-inline-atomics.patch, gcc12-riscv-pthread.patch: handle subword size inline atomics (needed by several openSUSE packages) - Update embedded newlib to version 4.2.0 * includes newlib-4.1.0-aligned_alloc.patch - Update to gcc-12 branch head, 0aaef83351473e8f4eb774f8f99, git537 - avoid trailing backslashes at the end of post install scripts - Update to gcc-12 branch head, e4b5fec75aa8d0d01f6e042ec28, git696 * remove gcc12-fifo-jobserver-support.patch which is now included upstream - Don't rely on %usrmerged, set it based on standard %suse_version - Update to gcc-12 branch head, 193f7e62815b4089dfaed4c2bd3, git749 - Speed up builds with --enable-link-serialization. - Update to GCC 12.3 release, 0c61aa720e62f1baf0bfd178e283, git1204 * includes regression bug fixes - Add gcc12-testsuite-fixes.patch to pick testsuite related fixes from the branch after the release. - Add gcc12-aarch64-bsc1214052.patch to fix -fstack-protector issues with variable length stack allocations on aarch64. Fixes CVE-2023-4039. [bsc#1214052] - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - strncpy-power9-vsx.patch: powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334, BZ #29197) - static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051) - static-tls-surplus.patch: Remove tunables (bsc#1201560) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - disable-check-consistency.patch: i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - memcmp-power10.patch: powerpc: Optimized memcmp for power10 (jsc#PED-987) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - x86-shared-non-temporal-threshold.patch: Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - dlopen-filter-object.patch: elf: Allow dlopen of filter object to work (bsc#1207571, BZ #16272) - powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors with recent GCC - strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition check (bsc#1208358, BZ #25933) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow (CVE-2023-0687, bsc#1207975, BZ #29444) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - amd-cacheinfo.patch: x86: Cache computation for AMD architecture (bsc#1207957) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - Exclude static archives from preparation for live patching (bnc#1208721) - getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid is unset (bsc#1209229, BZ #30235) - ulp-prologue-into-asm-functions.patch: Add support for livepatches in ASM written functions (bsc#1211726) - resolv-conf-lock.patch: resolv_conf: release lock on allocation failure (bsc#1211828, BZ #30527) - remove-excessive-p-align-check.patch: elf: Remove excessive p_align check on PT_LOAD segments (bsc#1211829, BZ #28688) - segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829, BZ #28676) - ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the first segment (BZ #30452) - nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses in files database (bsc#1212819, BZ #25457) - nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache invalidation if epoll is used (bsc#1212910, BZ #29415) - gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243) - gai-merge-continue-actions.patch: Simplify allocations and fix merge and continue actions (CVE-2023-4813, bsc#1215286, BZ #28931) - dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to page size (bsc#1215891, BZ #28676) - aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr (bsc#1217445, BZ #31113) - getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to EAI_MEMORY (bsc#1217589, BZ #31163) - qsort-invalid-cmp.patch: qsort: handle degenerated compare function (bsc#1218866) - duplocale-global-locale.patch: duplocale: protect use of global locale (bsc#1220441, BZ #23970) - iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence (CVE-2024-2961, bsc#1222992) - glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch: nscd: Stack-based buffer overflow in netgroup cache (CVE-2024-33599, bsc#1223423, BZ #31677) - glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch: nscd: Avoid null pointer crashes after notfound response (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch: nscd: Do not send missing not-found response in addgetnetgrentX (CVE-2024-33600, bsc#1223424, BZ #31678) - glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch: netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601, CVE-2024-33602, bsc#1223425, BZ #31680) - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue for _start routine (bsc#1221940) - nscd-netgroup-cache-timeout.patch: Use time_t for return type of addgetnetgrentX (CVE-2024-33602, bsc#1223425) - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228043, BZ [#31934]) - tcache-thread-shutdown.patch: malloc: Initiate tcache shutdown even without allocations (bsc#1228661, BZ #28028) - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - update to 2.2.19: * gpg: Fix double free when decrypting for hidden recipients * gpg: Use auto-key-locate for encryption even for mail addressed given with angle brackets * gpgsm: Add special case for certain expired intermediate certificates - Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534] * Web of Trust forgeries using collisions in SHA-1 signatures * Ignore all SHA-1 signatures in 3rd party key signatures. * Forbid the creation of SHA-1 third-party key signatures. * Add option --allow-weak-key-signatures - Add gnupg-CVE-2019-14855.patch - Accept key updates even without UIDs [bsc#1143158] - Add patches: * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch * gnupg-add-test-cases-for-import-without-uid.patch - Fix build with GCC-10: [bsc#1160394] * Always use EXTERN_UNLESS_MAIN_MODULE pattern * In GCC-10, the default option -fcommon will change to -fno-common - Add gpg2-gcc10-build-fno-common.patch - Split dirmngr into a subpackage to avoid a hard dependency of gpg2 on libgnutls - GnuPG 2.2.20: * Protect the error counter against overflow to guarantee that the tools can't be tricked into returning success after an error * gpg: Make really sure that --verify-files always returns an error * gpg: Fix key listing --with-secret if a pattern is given * gpg: Fix detection of certain keys used as default-key * gpg: Fix default-key selection when a card is available * gpg: Fix key expiration and key usage for keys created with a creation date of zero * gpgsm: Fix import of some CR,LF terminated certificates * gpg: New options --include-key-block and --auto-key-import to allow encrypted replies after an initial signed message * gpg: Allow the use of a fingerprint with --trusted-key * gpg: New property "fpr" for use by --export-filter * scdaemon: Disable the pinpad if a KDF DO is used * dirmngr: Improve finding OCSP certificates - drop gpg2-gcc10-build-fno-common.patch, upstream - Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811] - Refresh patches: * gnupg-2.2.8-files-are-digests.patch * gnupg-add_legacy_FIPS_mode_option.patch - Fix warning: agent returned different signature type ssh-rsa * The gpg-agent's ssh-agent does not handle flags in signing requests properly [bsc#1161268, bsc#1172308] * Add gnupg-gpg-agent-ssh-agent.patch - GnuPG 2.2.21: * gpg: Improve symmetric decryption speed by about 25% * gpg: Support decryption of AEAD encrypted data packets * gpg: Add option --no-include-key-block * gpg: Allow for extra padding in ECDH * gpg: Only a single pinentry is shown for symmetric encryption if the pinentry supports this * gpg: Print a note if no keys are given to --delete-key * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore shown * gpgsm: Certificates without a CRL distribution point are now considered valid without looking up a CRL. The new option - -enable-issuer-based-crl-check can be used to revert to the former behaviour * gpgsm: Support rsaPSS signature verification * gpgsm: Unless CRL checking is disabled lookup a missing issuer certificate using the certificate's authorityInfoAccess * gpgsm: Print the certificate's serial number also in decimal notation * gpgsm: Fix possible NULL-deref in messages of --gen-key * scd: Support the CardOS 5 based D-Trust Card 3.1 * dirmngr: Allow http URLs with "LOOKUP --url" * wkd: Take name of sendmail from configure. Fixes an OpenBSD specific bug - Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007] - Add gnupg-gpgme-t-encrypt-sym.patch - GnuPG 2.2.22: * gpg: Change the default key algorithm to rsa3072 * gpg: Add regular expression support for Trust Signatures on all platforms * gpg: Ignore --personal-digest-prefs for ECDSA keys * gpgsm: Make rsaPSS a de-vs compliant scheme * gpgsm: Show also the SHA256 fingerprint in key listings * gpgsm: Do not require a default keyring for --gpgconf-list * gpg-agent: Default to extended key format and record the creation time of keys Add new option --disable-extended-key-format * gpg-agent: Support the WAYLAND_DISPLAY envvar * gpg-agent: Allow using --gpgconf-list even if HOME does not exist * gpg-agent: Make the Pinentry work even if the envvar TERM is set to the empty string * scdaemon: Add a workaround for Gnuk tokens <= 2.15 which wrongly incremented the error counter when using the "verify" command of "gpg --edit-key" with only the signature key being present * dirmngr: Better handle systems with disabled IPv6 * gpgpslit: Install tool. It was not installed in the past to avoid conflicts with the version installed by GnuPG 1.4 * gpgtar: Make --files-from and --null work as documented - drop gnupg-gpgme-t-encrypt-sym.patch, upstream - Fix segv importing certain keys (e.g. ed25519). [bsc#1176034] - Add gnupg-2.2.22-fix-segv-import-keys.patch - GnuPG 2.2.23: * gpg: fix AHEAD preference list overflow boo#1176034 / CVE-2020-25125 * gpg: fix possible segv in the key cleaning code * gpgsm: fix a minor RFC2253 parser gub * scdaemon: Fix a PIN verify failure on certain OpenPGP card implementations - GnuPG 2.2.24: * gpg: New command --quick-revoke-sig * gpg: Do not use weak digest algos if selected by recipient preference during sign+encrypt * gpg: Switch to AES256 for symmetric encryption in de-vs mode * gpg: Silence weak digest warnings with --quiet * gpg: Print new status line CANCELED_BY_USER for a cancel during symmetric encryption * gpg: Fix the encrypt+sign hash algo preference selection for ECDSA. This is in particular needed for keys created from existing smartcard based keys * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys * agent: Keep some permissions of private-keys-v1.d * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and gnutls builds * dirmngr: Fix the pool keyserver case for a single host in the pool * scd: Fix the use case of verify_chv2 by CHECKPIN * scd: Various improvements to the ccid-driver * scd: Minor fixes for Yubikey * gpgconf: New option --show-versions * i18n: Complete overhaul and completion of the Italian translation - GnuPG 2.2.25: * scd: Fix regression in 2.2.24 requiring gpg --card-status before signing or decrypting * gpgsm: Using Libksba 1.5.0 signatures with a rarely used combination of attributes can now be verified - GnuPG 2.2.27: * gpgconf: Fix case with neither local nor global gpg.conf * gpgconf: Fix description of two new options - includes changes from 2.2.26: * gpg: New AKL method "ntds" * gpg: Fix --trusted-key with fingerprint arg * scd: Fix writing of ECC keys to an OpenPGP card * scd: Make an USB error fix specific to SPR532 readers * dirmngr: With new LDAP keyservers store the new attributes. Never store the useless pgpSignerID. Fix a long standing bug storing some keys on an ldap server. * dirmngr: Support the new Active Direcory LDAP schema for keyservers * dirmngr: Allow LDAP OpenPGP searches via fingerprint * dirmngr: Do not block other threads during keyserver LDAP calls * Support global configuration files * Fix the iconv fallback handling to UTF-8 - Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572] - Remove patches fixed upstream: * gnupg-gpg-agent-ssh-agent.patch * gnupg-2.2.22-fix-segv-import-keys.patch * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch * gnupg-CRL-fetching-via-https.patch * gnupg-CVE-2018-1000858.patch * gnupg-CVE-2018-12020.patch * gnupg-CVE-2019-13050_0_of_5.patch * gnupg-CVE-2019-13050_1_of_5.patch * gnupg-CVE-2019-13050_2_of_5.patch * gnupg-CVE-2019-13050_3_of_5.patch * gnupg-CVE-2019-13050_4_of_5.patch * gnupg-CVE-2019-13050_5_of_5.patch * gnupg-CVE-2019-14855.patch - Update gpg2.keyring - gnupg-detect_FIPS_mode.patch: use AES as default cipher instead of 3DES if we are in FIPS mode. (bsc#1196125) - Security fix [CVE-2022-34903, bsc#1201225] - Vulnerable to status injection - Added patch gnupg-CVE-2022-34903.patch - Suppress error message on trial reading as PEM format when using dirmngr to validate broken DER encoded files (bsc#1217212) * Add patches: - gnupg-dirmngr-Suppress-error-message-on-trial-reading-as-PEM.patch - gnupg-dirmngr-Clear-the-error-count-to-try-certificate-as-binary.patch - update to 2.2.19: * gpg: Fix double free when decrypting for hidden recipients * gpg: Use auto-key-locate for encryption even for mail addressed given with angle brackets * gpgsm: Add special case for certain expired intermediate certificates - Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534] * Web of Trust forgeries using collisions in SHA-1 signatures * Ignore all SHA-1 signatures in 3rd party key signatures. * Forbid the creation of SHA-1 third-party key signatures. * Add option --allow-weak-key-signatures - Add gnupg-CVE-2019-14855.patch - Accept key updates even without UIDs [bsc#1143158] - Add patches: * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch * gnupg-add-test-cases-for-import-without-uid.patch - Fix build with GCC-10: [bsc#1160394] * Always use EXTERN_UNLESS_MAIN_MODULE pattern * In GCC-10, the default option -fcommon will change to -fno-common - Add gpg2-gcc10-build-fno-common.patch - Split dirmngr into a subpackage to avoid a hard dependency of gpg2 on libgnutls - GnuPG 2.2.20: * Protect the error counter against overflow to guarantee that the tools can't be tricked into returning success after an error * gpg: Make really sure that --verify-files always returns an error * gpg: Fix key listing --with-secret if a pattern is given * gpg: Fix detection of certain keys used as default-key * gpg: Fix default-key selection when a card is available * gpg: Fix key expiration and key usage for keys created with a creation date of zero * gpgsm: Fix import of some CR,LF terminated certificates * gpg: New options --include-key-block and --auto-key-import to allow encrypted replies after an initial signed message * gpg: Allow the use of a fingerprint with --trusted-key * gpg: New property "fpr" for use by --export-filter * scdaemon: Disable the pinpad if a KDF DO is used * dirmngr: Improve finding OCSP certificates - drop gpg2-gcc10-build-fno-common.patch, upstream - Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811] - Refresh patches: * gnupg-2.2.8-files-are-digests.patch * gnupg-add_legacy_FIPS_mode_option.patch - Fix warning: agent returned different signature type ssh-rsa * The gpg-agent's ssh-agent does not handle flags in signing requests properly [bsc#1161268, bsc#1172308] * Add gnupg-gpg-agent-ssh-agent.patch - GnuPG 2.2.21: * gpg: Improve symmetric decryption speed by about 25% * gpg: Support decryption of AEAD encrypted data packets * gpg: Add option --no-include-key-block * gpg: Allow for extra padding in ECDH * gpg: Only a single pinentry is shown for symmetric encryption if the pinentry supports this * gpg: Print a note if no keys are given to --delete-key * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore shown * gpgsm: Certificates without a CRL distribution point are now considered valid without looking up a CRL. The new option - -enable-issuer-based-crl-check can be used to revert to the former behaviour * gpgsm: Support rsaPSS signature verification * gpgsm: Unless CRL checking is disabled lookup a missing issuer certificate using the certificate's authorityInfoAccess * gpgsm: Print the certificate's serial number also in decimal notation * gpgsm: Fix possible NULL-deref in messages of --gen-key * scd: Support the CardOS 5 based D-Trust Card 3.1 * dirmngr: Allow http URLs with "LOOKUP --url" * wkd: Take name of sendmail from configure. Fixes an OpenBSD specific bug - Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007] - Add gnupg-gpgme-t-encrypt-sym.patch - GnuPG 2.2.22: * gpg: Change the default key algorithm to rsa3072 * gpg: Add regular expression support for Trust Signatures on all platforms * gpg: Ignore --personal-digest-prefs for ECDSA keys * gpgsm: Make rsaPSS a de-vs compliant scheme * gpgsm: Show also the SHA256 fingerprint in key listings * gpgsm: Do not require a default keyring for --gpgconf-list * gpg-agent: Default to extended key format and record the creation time of keys Add new option --disable-extended-key-format * gpg-agent: Support the WAYLAND_DISPLAY envvar * gpg-agent: Allow using --gpgconf-list even if HOME does not exist * gpg-agent: Make the Pinentry work even if the envvar TERM is set to the empty string * scdaemon: Add a workaround for Gnuk tokens <= 2.15 which wrongly incremented the error counter when using the "verify" command of "gpg --edit-key" with only the signature key being present * dirmngr: Better handle systems with disabled IPv6 * gpgpslit: Install tool. It was not installed in the past to avoid conflicts with the version installed by GnuPG 1.4 * gpgtar: Make --files-from and --null work as documented - drop gnupg-gpgme-t-encrypt-sym.patch, upstream - Fix segv importing certain keys (e.g. ed25519). [bsc#1176034] - Add gnupg-2.2.22-fix-segv-import-keys.patch - GnuPG 2.2.23: * gpg: fix AHEAD preference list overflow boo#1176034 / CVE-2020-25125 * gpg: fix possible segv in the key cleaning code * gpgsm: fix a minor RFC2253 parser gub * scdaemon: Fix a PIN verify failure on certain OpenPGP card implementations - GnuPG 2.2.24: * gpg: New command --quick-revoke-sig * gpg: Do not use weak digest algos if selected by recipient preference during sign+encrypt * gpg: Switch to AES256 for symmetric encryption in de-vs mode * gpg: Silence weak digest warnings with --quiet * gpg: Print new status line CANCELED_BY_USER for a cancel during symmetric encryption * gpg: Fix the encrypt+sign hash algo preference selection for ECDSA. This is in particular needed for keys created from existing smartcard based keys * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys * agent: Keep some permissions of private-keys-v1.d * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and gnutls builds * dirmngr: Fix the pool keyserver case for a single host in the pool * scd: Fix the use case of verify_chv2 by CHECKPIN * scd: Various improvements to the ccid-driver * scd: Minor fixes for Yubikey * gpgconf: New option --show-versions * i18n: Complete overhaul and completion of the Italian translation - GnuPG 2.2.25: * scd: Fix regression in 2.2.24 requiring gpg --card-status before signing or decrypting * gpgsm: Using Libksba 1.5.0 signatures with a rarely used combination of attributes can now be verified - GnuPG 2.2.27: * gpgconf: Fix case with neither local nor global gpg.conf * gpgconf: Fix description of two new options - includes changes from 2.2.26: * gpg: New AKL method "ntds" * gpg: Fix --trusted-key with fingerprint arg * scd: Fix writing of ECC keys to an OpenPGP card * scd: Make an USB error fix specific to SPR532 readers * dirmngr: With new LDAP keyservers store the new attributes. Never store the useless pgpSignerID. Fix a long standing bug storing some keys on an ldap server. * dirmngr: Support the new Active Direcory LDAP schema for keyservers * dirmngr: Allow LDAP OpenPGP searches via fingerprint * dirmngr: Do not block other threads during keyserver LDAP calls * Support global configuration files * Fix the iconv fallback handling to UTF-8 - Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572] - Remove patches fixed upstream: * gnupg-gpg-agent-ssh-agent.patch * gnupg-2.2.22-fix-segv-import-keys.patch * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch * gnupg-CRL-fetching-via-https.patch * gnupg-CVE-2018-1000858.patch * gnupg-CVE-2018-12020.patch * gnupg-CVE-2019-13050_0_of_5.patch * gnupg-CVE-2019-13050_1_of_5.patch * gnupg-CVE-2019-13050_2_of_5.patch * gnupg-CVE-2019-13050_3_of_5.patch * gnupg-CVE-2019-13050_4_of_5.patch * gnupg-CVE-2019-13050_5_of_5.patch * gnupg-CVE-2019-14855.patch - Update gpg2.keyring - gnupg-detect_FIPS_mode.patch: use AES as default cipher instead of 3DES if we are in FIPS mode. (bsc#1196125) - Security fix [CVE-2022-34903, bsc#1201225] - Vulnerable to status injection - Added patch gnupg-CVE-2022-34903.patch - Suppress error message on trial reading as PEM format when using dirmngr to validate broken DER encoded files (bsc#1217212) * Add patches: - gnupg-dirmngr-Suppress-error-message-on-trial-reading-as-PEM.patch - gnupg-dirmngr-Clear-the-error-count-to-try-certificate-as-binary.patch - update to 2.2.19: * gpg: Fix double free when decrypting for hidden recipients * gpg: Use auto-key-locate for encryption even for mail addressed given with angle brackets * gpgsm: Add special case for certain expired intermediate certificates - Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534] * Web of Trust forgeries using collisions in SHA-1 signatures * Ignore all SHA-1 signatures in 3rd party key signatures. * Forbid the creation of SHA-1 third-party key signatures. * Add option --allow-weak-key-signatures - Add gnupg-CVE-2019-14855.patch - Accept key updates even without UIDs [bsc#1143158] - Add patches: * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch * gnupg-add-test-cases-for-import-without-uid.patch - Fix build with GCC-10: [bsc#1160394] * Always use EXTERN_UNLESS_MAIN_MODULE pattern * In GCC-10, the default option -fcommon will change to -fno-common - Add gpg2-gcc10-build-fno-common.patch - Split dirmngr into a subpackage to avoid a hard dependency of gpg2 on libgnutls - GnuPG 2.2.20: * Protect the error counter against overflow to guarantee that the tools can't be tricked into returning success after an error * gpg: Make really sure that --verify-files always returns an error * gpg: Fix key listing --with-secret if a pattern is given * gpg: Fix detection of certain keys used as default-key * gpg: Fix default-key selection when a card is available * gpg: Fix key expiration and key usage for keys created with a creation date of zero * gpgsm: Fix import of some CR,LF terminated certificates * gpg: New options --include-key-block and --auto-key-import to allow encrypted replies after an initial signed message * gpg: Allow the use of a fingerprint with --trusted-key * gpg: New property "fpr" for use by --export-filter * scdaemon: Disable the pinpad if a KDF DO is used * dirmngr: Improve finding OCSP certificates - drop gpg2-gcc10-build-fno-common.patch, upstream - Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811] - Refresh patches: * gnupg-2.2.8-files-are-digests.patch * gnupg-add_legacy_FIPS_mode_option.patch - Fix warning: agent returned different signature type ssh-rsa * The gpg-agent's ssh-agent does not handle flags in signing requests properly [bsc#1161268, bsc#1172308] * Add gnupg-gpg-agent-ssh-agent.patch - GnuPG 2.2.21: * gpg: Improve symmetric decryption speed by about 25% * gpg: Support decryption of AEAD encrypted data packets * gpg: Add option --no-include-key-block * gpg: Allow for extra padding in ECDH * gpg: Only a single pinentry is shown for symmetric encryption if the pinentry supports this * gpg: Print a note if no keys are given to --delete-key * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore shown * gpgsm: Certificates without a CRL distribution point are now considered valid without looking up a CRL. The new option - -enable-issuer-based-crl-check can be used to revert to the former behaviour * gpgsm: Support rsaPSS signature verification * gpgsm: Unless CRL checking is disabled lookup a missing issuer certificate using the certificate's authorityInfoAccess * gpgsm: Print the certificate's serial number also in decimal notation * gpgsm: Fix possible NULL-deref in messages of --gen-key * scd: Support the CardOS 5 based D-Trust Card 3.1 * dirmngr: Allow http URLs with "LOOKUP --url" * wkd: Take name of sendmail from configure. Fixes an OpenBSD specific bug - Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007] - Add gnupg-gpgme-t-encrypt-sym.patch - GnuPG 2.2.22: * gpg: Change the default key algorithm to rsa3072 * gpg: Add regular expression support for Trust Signatures on all platforms * gpg: Ignore --personal-digest-prefs for ECDSA keys * gpgsm: Make rsaPSS a de-vs compliant scheme * gpgsm: Show also the SHA256 fingerprint in key listings * gpgsm: Do not require a default keyring for --gpgconf-list * gpg-agent: Default to extended key format and record the creation time of keys Add new option --disable-extended-key-format * gpg-agent: Support the WAYLAND_DISPLAY envvar * gpg-agent: Allow using --gpgconf-list even if HOME does not exist * gpg-agent: Make the Pinentry work even if the envvar TERM is set to the empty string * scdaemon: Add a workaround for Gnuk tokens <= 2.15 which wrongly incremented the error counter when using the "verify" command of "gpg --edit-key" with only the signature key being present * dirmngr: Better handle systems with disabled IPv6 * gpgpslit: Install tool. It was not installed in the past to avoid conflicts with the version installed by GnuPG 1.4 * gpgtar: Make --files-from and --null work as documented - drop gnupg-gpgme-t-encrypt-sym.patch, upstream - Fix segv importing certain keys (e.g. ed25519). [bsc#1176034] - Add gnupg-2.2.22-fix-segv-import-keys.patch - GnuPG 2.2.23: * gpg: fix AHEAD preference list overflow boo#1176034 / CVE-2020-25125 * gpg: fix possible segv in the key cleaning code * gpgsm: fix a minor RFC2253 parser gub * scdaemon: Fix a PIN verify failure on certain OpenPGP card implementations - GnuPG 2.2.24: * gpg: New command --quick-revoke-sig * gpg: Do not use weak digest algos if selected by recipient preference during sign+encrypt * gpg: Switch to AES256 for symmetric encryption in de-vs mode * gpg: Silence weak digest warnings with --quiet * gpg: Print new status line CANCELED_BY_USER for a cancel during symmetric encryption * gpg: Fix the encrypt+sign hash algo preference selection for ECDSA. This is in particular needed for keys created from existing smartcard based keys * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys * agent: Keep some permissions of private-keys-v1.d * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and gnutls builds * dirmngr: Fix the pool keyserver case for a single host in the pool * scd: Fix the use case of verify_chv2 by CHECKPIN * scd: Various improvements to the ccid-driver * scd: Minor fixes for Yubikey * gpgconf: New option --show-versions * i18n: Complete overhaul and completion of the Italian translation - GnuPG 2.2.25: * scd: Fix regression in 2.2.24 requiring gpg --card-status before signing or decrypting * gpgsm: Using Libksba 1.5.0 signatures with a rarely used combination of attributes can now be verified - GnuPG 2.2.27: * gpgconf: Fix case with neither local nor global gpg.conf * gpgconf: Fix description of two new options - includes changes from 2.2.26: * gpg: New AKL method "ntds" * gpg: Fix --trusted-key with fingerprint arg * scd: Fix writing of ECC keys to an OpenPGP card * scd: Make an USB error fix specific to SPR532 readers * dirmngr: With new LDAP keyservers store the new attributes. Never store the useless pgpSignerID. Fix a long standing bug storing some keys on an ldap server. * dirmngr: Support the new Active Direcory LDAP schema for keyservers * dirmngr: Allow LDAP OpenPGP searches via fingerprint * dirmngr: Do not block other threads during keyserver LDAP calls * Support global configuration files * Fix the iconv fallback handling to UTF-8 - Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572] - Remove patches fixed upstream: * gnupg-gpg-agent-ssh-agent.patch * gnupg-2.2.22-fix-segv-import-keys.patch * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch * gnupg-CRL-fetching-via-https.patch * gnupg-CVE-2018-1000858.patch * gnupg-CVE-2018-12020.patch * gnupg-CVE-2019-13050_0_of_5.patch * gnupg-CVE-2019-13050_1_of_5.patch * gnupg-CVE-2019-13050_2_of_5.patch * gnupg-CVE-2019-13050_3_of_5.patch * gnupg-CVE-2019-13050_4_of_5.patch * gnupg-CVE-2019-13050_5_of_5.patch * gnupg-CVE-2019-14855.patch - Update gpg2.keyring - gnupg-detect_FIPS_mode.patch: use AES as default cipher instead of 3DES if we are in FIPS mode. (bsc#1196125) - Security fix [CVE-2022-34903, bsc#1201225] - Vulnerable to status injection - Added patch gnupg-CVE-2022-34903.patch - Suppress error message on trial reading as PEM format when using dirmngr to validate broken DER encoded files (bsc#1217212) * Add patches: - gnupg-dirmngr-Suppress-error-message-on-trial-reading-as-PEM.patch - gnupg-dirmngr-Clear-the-error-count-to-try-certificate-as-binary.patch - update to 2.2.19: * gpg: Fix double free when decrypting for hidden recipients * gpg: Use auto-key-locate for encryption even for mail addressed given with angle brackets * gpgsm: Add special case for certain expired intermediate certificates - Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534] * Web of Trust forgeries using collisions in SHA-1 signatures * Ignore all SHA-1 signatures in 3rd party key signatures. * Forbid the creation of SHA-1 third-party key signatures. * Add option --allow-weak-key-signatures - Add gnupg-CVE-2019-14855.patch - Accept key updates even without UIDs [bsc#1143158] - Add patches: * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch * gnupg-add-test-cases-for-import-without-uid.patch - Fix build with GCC-10: [bsc#1160394] * Always use EXTERN_UNLESS_MAIN_MODULE pattern * In GCC-10, the default option -fcommon will change to -fno-common - Add gpg2-gcc10-build-fno-common.patch - Split dirmngr into a subpackage to avoid a hard dependency of gpg2 on libgnutls - GnuPG 2.2.20: * Protect the error counter against overflow to guarantee that the tools can't be tricked into returning success after an error * gpg: Make really sure that --verify-files always returns an error * gpg: Fix key listing --with-secret if a pattern is given * gpg: Fix detection of certain keys used as default-key * gpg: Fix default-key selection when a card is available * gpg: Fix key expiration and key usage for keys created with a creation date of zero * gpgsm: Fix import of some CR,LF terminated certificates * gpg: New options --include-key-block and --auto-key-import to allow encrypted replies after an initial signed message * gpg: Allow the use of a fingerprint with --trusted-key * gpg: New property "fpr" for use by --export-filter * scdaemon: Disable the pinpad if a KDF DO is used * dirmngr: Improve finding OCSP certificates - drop gpg2-gcc10-build-fno-common.patch, upstream - Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811] - Refresh patches: * gnupg-2.2.8-files-are-digests.patch * gnupg-add_legacy_FIPS_mode_option.patch - Fix warning: agent returned different signature type ssh-rsa * The gpg-agent's ssh-agent does not handle flags in signing requests properly [bsc#1161268, bsc#1172308] * Add gnupg-gpg-agent-ssh-agent.patch - GnuPG 2.2.21: * gpg: Improve symmetric decryption speed by about 25% * gpg: Support decryption of AEAD encrypted data packets * gpg: Add option --no-include-key-block * gpg: Allow for extra padding in ECDH * gpg: Only a single pinentry is shown for symmetric encryption if the pinentry supports this * gpg: Print a note if no keys are given to --delete-key * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore shown * gpgsm: Certificates without a CRL distribution point are now considered valid without looking up a CRL. The new option - -enable-issuer-based-crl-check can be used to revert to the former behaviour * gpgsm: Support rsaPSS signature verification * gpgsm: Unless CRL checking is disabled lookup a missing issuer certificate using the certificate's authorityInfoAccess * gpgsm: Print the certificate's serial number also in decimal notation * gpgsm: Fix possible NULL-deref in messages of --gen-key * scd: Support the CardOS 5 based D-Trust Card 3.1 * dirmngr: Allow http URLs with "LOOKUP --url" * wkd: Take name of sendmail from configure. Fixes an OpenBSD specific bug - Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007] - Add gnupg-gpgme-t-encrypt-sym.patch - GnuPG 2.2.22: * gpg: Change the default key algorithm to rsa3072 * gpg: Add regular expression support for Trust Signatures on all platforms * gpg: Ignore --personal-digest-prefs for ECDSA keys * gpgsm: Make rsaPSS a de-vs compliant scheme * gpgsm: Show also the SHA256 fingerprint in key listings * gpgsm: Do not require a default keyring for --gpgconf-list * gpg-agent: Default to extended key format and record the creation time of keys Add new option --disable-extended-key-format * gpg-agent: Support the WAYLAND_DISPLAY envvar * gpg-agent: Allow using --gpgconf-list even if HOME does not exist * gpg-agent: Make the Pinentry work even if the envvar TERM is set to the empty string * scdaemon: Add a workaround for Gnuk tokens <= 2.15 which wrongly incremented the error counter when using the "verify" command of "gpg --edit-key" with only the signature key being present * dirmngr: Better handle systems with disabled IPv6 * gpgpslit: Install tool. It was not installed in the past to avoid conflicts with the version installed by GnuPG 1.4 * gpgtar: Make --files-from and --null work as documented - drop gnupg-gpgme-t-encrypt-sym.patch, upstream - Fix segv importing certain keys (e.g. ed25519). [bsc#1176034] - Add gnupg-2.2.22-fix-segv-import-keys.patch - GnuPG 2.2.23: * gpg: fix AHEAD preference list overflow boo#1176034 / CVE-2020-25125 * gpg: fix possible segv in the key cleaning code * gpgsm: fix a minor RFC2253 parser gub * scdaemon: Fix a PIN verify failure on certain OpenPGP card implementations - GnuPG 2.2.24: * gpg: New command --quick-revoke-sig * gpg: Do not use weak digest algos if selected by recipient preference during sign+encrypt * gpg: Switch to AES256 for symmetric encryption in de-vs mode * gpg: Silence weak digest warnings with --quiet * gpg: Print new status line CANCELED_BY_USER for a cancel during symmetric encryption * gpg: Fix the encrypt+sign hash algo preference selection for ECDSA. This is in particular needed for keys created from existing smartcard based keys * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys * agent: Keep some permissions of private-keys-v1.d * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and gnutls builds * dirmngr: Fix the pool keyserver case for a single host in the pool * scd: Fix the use case of verify_chv2 by CHECKPIN * scd: Various improvements to the ccid-driver * scd: Minor fixes for Yubikey * gpgconf: New option --show-versions * i18n: Complete overhaul and completion of the Italian translation - GnuPG 2.2.25: * scd: Fix regression in 2.2.24 requiring gpg --card-status before signing or decrypting * gpgsm: Using Libksba 1.5.0 signatures with a rarely used combination of attributes can now be verified - GnuPG 2.2.27: * gpgconf: Fix case with neither local nor global gpg.conf * gpgconf: Fix description of two new options - includes changes from 2.2.26: * gpg: New AKL method "ntds" * gpg: Fix --trusted-key with fingerprint arg * scd: Fix writing of ECC keys to an OpenPGP card * scd: Make an USB error fix specific to SPR532 readers * dirmngr: With new LDAP keyservers store the new attributes. Never store the useless pgpSignerID. Fix a long standing bug storing some keys on an ldap server. * dirmngr: Support the new Active Direcory LDAP schema for keyservers * dirmngr: Allow LDAP OpenPGP searches via fingerprint * dirmngr: Do not block other threads during keyserver LDAP calls * Support global configuration files * Fix the iconv fallback handling to UTF-8 - Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572] - Remove patches fixed upstream: * gnupg-gpg-agent-ssh-agent.patch * gnupg-2.2.22-fix-segv-import-keys.patch * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch * gnupg-CRL-fetching-via-https.patch * gnupg-CVE-2018-1000858.patch * gnupg-CVE-2018-12020.patch * gnupg-CVE-2019-13050_0_of_5.patch * gnupg-CVE-2019-13050_1_of_5.patch * gnupg-CVE-2019-13050_2_of_5.patch * gnupg-CVE-2019-13050_3_of_5.patch * gnupg-CVE-2019-13050_4_of_5.patch * gnupg-CVE-2019-13050_5_of_5.patch * gnupg-CVE-2019-14855.patch - Update gpg2.keyring - gnupg-detect_FIPS_mode.patch: use AES as default cipher instead of 3DES if we are in FIPS mode. (bsc#1196125) - Security fix [CVE-2022-34903, bsc#1201225] - Vulnerable to status injection - Added patch gnupg-CVE-2022-34903.patch - Suppress error message on trial reading as PEM format when using dirmngr to validate broken DER encoded files (bsc#1217212) * Add patches: - gnupg-dirmngr-Suppress-error-message-on-trial-reading-as-PEM.patch - gnupg-dirmngr-Clear-the-error-count-to-try-certificate-as-binary.patch - modify groff_1.22.2-2.debian.diff - remove the part related to src/preproc/html/pre-html.cpp, fixes bnc#755533 - Move important non-graphical macros from groff-full back to groff as otherwise many packages do not build anymore - Take care of mmroff.1.gz as well as of mmroff perl script - move man.local and mdoc.local from groff-full to groff * fixes libssh2.org testsuite - build with PIE - Version bump to latest release 1.22.3: * X11 resources for `gxditview', which were previously installed in /usr/X11/lib/X11/app-defaults no matter which `prefix' was set, are now installed in appresdir=$prefix/lib/X11/app-defaults. If `appresdir' is not a standard X11 resource directory, the environment variable XFILESEARCHPATH should be set to this path. The standard default directories depends on the system `libXt'. * This new preprocessor (contributed by Bernd Warken) allows embedding of code for GNU LilyPond (http://www.lilypond.org), a music typesetter. The data gets automatically processed and embedded as EPS images. * Bernd Warken contributed a new preprocessor to handle Perl code that can be evaluated and then processed by groff. * Another preprocessor from Bernd Warken to pretty-print Pinyin syllables like `guo2wang2' as `guówáng'. * The pdfroff utility script now activates its `--no-toc-relocation' option by default, unless a request similar to: .if !\n[PHASE] .tm pdfroff-option:set toc_relocation=enabled is invoked during input file processing; (`.if !\n[PHASE] ...' ensures that the effect of the `.tm' request is restricted to the document setup phase of processing, as pdfroff sets it to 1 or 2 in the output phase, but leaves it unset in the setup phase). The bundled `spdf.tmac' macro package, which implicitly activates `-mpdfmark' for `ms' macro users, ensures that TOC relocation is appropriately enabled, when the `.TC' macro is invoked. * The -mom macro package now has full support for eqn, pic, and tbl, as well as captioning and labelling of pdf images and preprocessor output. Lists of Figures, Equations, and Tables can now be autogenerated. PDF_IMAGE has a new FRAME option. * A French introduction to the -me macro package has been added (file `meintro_fr.me'). * In -mdoc, command %C is now available, providing a city or place reference. - Refreshed patches: * groff-1.21-CVE-2009-5081.patch * groff-1.21-groffer-libexecdir.patch * groff-force-locale-usage.patch - Replaced patches: * deleted groff_1.22.2-2.debian.diff * added groff_1.22.3-1.debian.diff - New patches: * groff-multi-thread.patch - Add patch for bnc#989903 and move all scripts from libdir to libexecdir - Replace xorg-x11-devel buildrequires by the needed individual libraries - Set the license to GPL-3.0+ as per COPYING - Use %license instead of %doc [bsc#1082318] - add groff-reproducible-mdate.patch and groff-use-SDE.patch to allow to override build time to make package build reproducible (boo#1047218) - Switch to multibuild in order to avoid having to manage 2 differentiating spec files - Version update to 1.22.4: * Many fixes for hyphenation helping * Various build tweaks * See the NEWS file for details - New signature -> update keyring file - Remove upstream merged patches: * groff-multi-thread.patch * groff-reproducible-mdate.patch * groff-use-SDE.patch - Remove groff-1.21-groffer-libexecdir.patch as upstream redid the autotools rules and uses configure option now - Rebase patch groff-1.20.1-deunicode.patch - Rebase patch groff-1.21-CVE-2009-5081.patch - Drop patch groff-1.21-CVE-2009-5080.patch as it seems the shell script now properly safeguards against this - Rebase patch 0002-documentation-for-the-locale-keyword.patch - Recreate groff-force-locale-usage.patch for autotools buildsystem - Add patch 0004-don-t-use-usr-bin-env-in-shebang.patch - Remove groff_1.22.3-1.debian.diff and replace it with split debian patches: * bash-scripts.patch * sort-perl-hash-keys.patch - Trim tm signs - install essential build files needed by ghostscript-fonts-grops - Add man page roff(7) to alternatives to avoid conflict with mandoc. - don't recommend groff-full as that would pull in X etc by default. Instead use packageand on groff and ghostscript-library to only install groff-full when other deps are already there. - Don't create recursive link 'current' inside /usr/share/groff/%{version}. - Remove /usr/share/groff/current from groff-full. It creates file conflicts during version upgrade (bsc#1192195#c8). - Do not fail with rpm --excludedocs (bsc#1192195). - build with PIE - Version bump to latest release 1.22.3: * X11 resources for `gxditview', which were previously installed in /usr/X11/lib/X11/app-defaults no matter which `prefix' was set, are now installed in appresdir=$prefix/lib/X11/app-defaults. If `appresdir' is not a standard X11 resource directory, the environment variable XFILESEARCHPATH should be set to this path. The standard default directories depends on the system `libXt'. * This new preprocessor (contributed by Bernd Warken) allows embedding of code for GNU LilyPond (http://www.lilypond.org), a music typesetter. The data gets automatically processed and embedded as EPS images. * Bernd Warken contributed a new preprocessor to handle Perl code that can be evaluated and then processed by groff. * Another preprocessor from Bernd Warken to pretty-print Pinyin syllables like `guo2wang2' as `guówáng'. * The pdfroff utility script now activates its `--no-toc-relocation' option by default, unless a request similar to: .if !\n[PHASE] .tm pdfroff-option:set toc_relocation=enabled is invoked during input file processing; (`.if !\n[PHASE] ...' ensures that the effect of the `.tm' request is restricted to the document setup phase of processing, as pdfroff sets it to 1 or 2 in the output phase, but leaves it unset in the setup phase). The bundled `spdf.tmac' macro package, which implicitly activates `-mpdfmark' for `ms' macro users, ensures that TOC relocation is appropriately enabled, when the `.TC' macro is invoked. * The -mom macro package now has full support for eqn, pic, and tbl, as well as captioning and labelling of pdf images and preprocessor output. Lists of Figures, Equations, and Tables can now be autogenerated. PDF_IMAGE has a new FRAME option. * A French introduction to the -me macro package has been added (file `meintro_fr.me'). * In -mdoc, command %C is now available, providing a city or place reference. - Refreshed patches: * groff-1.21-CVE-2009-5081.patch * groff-1.21-groffer-libexecdir.patch * groff-force-locale-usage.patch - Replaced patches: * deleted groff_1.22.2-2.debian.diff * added groff_1.22.3-1.debian.diff - New patches: * groff-multi-thread.patch - Add patch for bnc#989903 and move all scripts from libdir to libexecdir - Replace xorg-x11-devel buildrequires by the needed individual libraries - Set the license to GPL-3.0+ as per COPYING - Use %license instead of %doc [bsc#1082318] - add groff-reproducible-mdate.patch and groff-use-SDE.patch to allow to override build time to make package build reproducible (boo#1047218) - Switch to multibuild in order to avoid having to manage 2 differentiating spec files - Version update to 1.22.4: * Many fixes for hyphenation helping * Various build tweaks * See the NEWS file for details - New signature -> update keyring file - Remove upstream merged patches: * groff-multi-thread.patch * groff-reproducible-mdate.patch * groff-use-SDE.patch - Remove groff-1.21-groffer-libexecdir.patch as upstream redid the autotools rules and uses configure option now - Rebase patch groff-1.20.1-deunicode.patch - Rebase patch groff-1.21-CVE-2009-5081.patch - Drop patch groff-1.21-CVE-2009-5080.patch as it seems the shell script now properly safeguards against this - Rebase patch 0002-documentation-for-the-locale-keyword.patch - Recreate groff-force-locale-usage.patch for autotools buildsystem - Add patch 0004-don-t-use-usr-bin-env-in-shebang.patch - Remove groff_1.22.3-1.debian.diff and replace it with split debian patches: * bash-scripts.patch * sort-perl-hash-keys.patch - Trim tm signs - install essential build files needed by ghostscript-fonts-grops - Add man page roff(7) to alternatives to avoid conflict with mandoc. - don't recommend groff-full as that would pull in X etc by default. Instead use packageand on groff and ghostscript-library to only install groff-full when other deps are already there. - Don't create recursive link 'current' inside /usr/share/groff/%{version}. - Remove /usr/share/groff/current from groff-full. It creates file conflicts during version upgrade (bsc#1192195#c8). - Do not fail with rpm --excludedocs (bsc#1192195). - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Fix detection of encrypted disk's uuid in powerpc to cope with logical disks when signed image installation is specified (bsc#1216075) * 0003-grub-install-support-prep-environment-block.patch - grub2.spec: Add support to unlocking multiple encrypted disks in signed grub.elf image for logical disks - Fix fadump not working with 1GB/2GB/4GB LMB[P10] (bsc#1216253) * 0001-kern-ieee1275-init-ppc64-Restrict-high-memory-in-pre.patch - Fix failure to identify recent ext4 filesystem (bsc#1216010) * 0001-fs-ext2-Ignore-checksum-seed-incompat-feature.patch * 0001-fs-ext2-Ignore-the-large_dir-incompat-feature.patch - Add patch to fix reading files from btrfs with "implicit" holes * 0001-fs-btrfs-Zero-file-data-not-backed-by-extents.patch - Fix PowerPC grub loads 5 to 10 minutes slower on SLE-15-SP5 compared to SLE-15-SP2 (bsc#1217102) * add 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch * add 0002-ofdisk-add-early_log-support.patch - Fix grub.xen memdisk script doesn't look for /boot/grub/grub.cfg (bsc#1219248) (bsc#1181762) * grub2-xen-pv-firmware.cfg * 0001-disk-Optimize-disk-iteration-by-moving-memdisk-to-th.patch - Fix memdisk becomes the default boot entry, resolving no graphic display device error in guest vnc console (bsc#1221779) * grub2-xen-pv-firmware.cfg - Fix LPAR falls into grub shell after installation with lvm (bsc#1221866) * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch - Fix error in /etc/grub.d/20_linux_xen: file_is_not_sym not found, renamed to file_is_not_xen_garbage (bsc#1224226) * grub2-fix-menu-in-xen-host-server.patch - Fix input handling in ppc64le grub2 has high latency (bsc#1223535) * 0001-net-drivers-ieee1275-ofnet-Remove-200-ms-timeout-in-.patch - Fix error in grub-install when root is on tmpfs (bsc#1226100) * 0001-grub-install-bailout-root-device-probing.patch - Fix btrfs subvolume for platform modules not mounting at runtime when the default subvolume is the topmost root tree (bsc#1228124) * grub2-btrfs-06-subvol-mount.patch - Rediff * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch - grub2.spec: Add ofnet to signed grub.elf to support powerpc net boot installation when secure boot is enabled (bsc#1217761) (bsc#1228866) - Improved check for disk device when looking for PReP partition * 0004-Introduce-prep_load_env-command.patch - Fix OOM error in loading loopback file (bsc#1230840) * 0001-tpm-Skip-loopback-image-measurement.patch - Fix not a directory error from the minix filesystem, as leftover data on disk may contain its magic header so it gets misdetected (bsc#1231604) * grub2-install-fix-not-a-directory-error.patch - Fix xen package contains debug_info files with the .module suffix by moving them to a separate xen-debug subpackage (bsc#1232573) - Include loopback into signed grub2 image (jsc#PED-2150) - NVMeoFC support on grub (jsc#PED-996) * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0004-ofpath-controller-name-update.patch - TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265) * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch - Measure the kernel on POWER10 and extend TPM PCRs (PED-1990) * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Security fixes and hardenings * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch - Fix CVE-2022-2601 (bsc#1205178) * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch * 0004-font-Remove-grub_font_dup_glyph.patch * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch * 0006-font-Fix-integer-overflow-in-BMP-index.patch * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch * 0008-fbutil-Fix-integer-overflow.patch - Fix CVE-2022-3775 (bsc#1205182) * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch - Bump upstream SBAT generation to 3 - Support grub2-install on LUKS2 encrypted device * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch - Add tpm to signed grub.elf image (PED-1990) (bsc#1205912) - Increase initial heap size from 1/4 to 1/3 * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch - Setup multiple device paths for a nvmf boot device (bsc#1205666) * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch - Make grub.cfg invariant to efi and legacy platforms (bsc#1205200) - Removed patch linuxefi * grub2-secureboot-provide-linuxefi-config.patch * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch * grub2-secureboot-use-linuxefi-on-uefi.patch - Rediff * grub2-btrfs-05-grub2-mkconfig.patch * grub2-efi-xen-cmdline.patch * grub2-s390x-05-grub2-mkconfig.patch * grub2-suse-remove-linux-root-param.patch - Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064) * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch - Fix nvmf boot device setup (bsc#1207811) * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch - Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024) * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch - Fix lpar got hung at grub after inactive migration (bsc#1207684) * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch - Move unsupported zfs modules into 'extras' packages (bsc#1205554) (PED-2947) - Make grub more robust against storage race condition causing system boot failures (bsc#1189036) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix aarch64 kiwi image's file not found due to '/@' prepended to path in btrfs filesystem. (bsc#1209165) * grub2-btrfs-05-grub2-mkconfig.patch - Fix installation over serial console ends up in infinite boot loop (bsc#1187810) (bsc#1209667) (bsc#1209372) * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch - Resolve some issues with OS boot failure on PPC NVMe-oF disks and made enhancements to PPC secure boot's root device discovery config (bsc#1207230) - Ensure get_devargs and get_devname functions are consistent * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch - Fix regex for Open Firmware device specifier with encoded commas * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Fix regular expression in PPC secure boot config to prevent escaped commas from being treated as delimiters when retrieving partition substrings. - Use prep_load_env in PPC secure boot config to handle unset host-specific environment variables and ensure successful command execution. * 0004-Introduce-prep_load_env-command.patch - Refreshed * 0005-export-environment-at-start-up.patch - Fix no prep partition error on non-PReP architectures by making the prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489) * 0004-Introduce-prep_load_env-command.patch - Fix the issue of freeing an uninitialized pointer * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch - Rediff * 0005-export-environment-at-start-up.patch - Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581) * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch - grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563) - Fix a boot delay regression in PowerPC PXE boot (bsc#1201300) * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch - Fix CVE-2023-4692 (bsc#1215935) - Fix CVE-2023-4693 (bsc#1215936) * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch * 0006-fs-ntfs-Make-code-more-readable.patch - Bump upstream SBAT generation to 4 - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.3.6+git0.7851701ed: * [RELEASE] Released version 2.3.6 * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout * BUG/MINOR: mux-h2: Fix typo in scheme adjustment * DOC: spoe: Add a note about fragmentation support in HAProxy * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread > 1 * BUG/MINOR: connection: Use the client's dst family for adressless servers * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule * BUG/MINOR: http-ana: Only consider dst address to process originalto option * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf() * BUG/MINOR: stats: fix compare of no-maint url suffix * CLEANUP: muxes: Remove useless if condition in show_fd function * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup() * BUG/MEDIUM: resolvers: Reset address for unresolved servers * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records * BUG/MINOR: resolvers: new callback to properly handle SRV record errors * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl() * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe * BUG/MINOR: sample: secure convs that accept base64 string and var name as args * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert" * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line * BUG/MINOR: server: Init params before parsing a new server-state line * BUG/MINOR: http-rules: Always replace the response status on a return action * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ(). * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions * BUG/MINOR: sample: Always consider zero size string samples as unsafe * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust() * BUG/MINOR: checks: properly handle wrapping time in __health_adjust() * BUG/MINOR: session: atomically increment the tracked sessions counter * BUG/MINOR: server: Remove RMAINT from admin state when loading server state * CLEANUP: channel: fix comment in ci_putblk. * DOC: tune: explain the origin of block size for ssl.cachesize * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines * BUG/MINOR: stats: revert the change on ST_CONVDONE * BUG/MEDIUM: config: don't pick unset values from last defaults section * CLEANUP: deinit: release global and per-proxy server-state variables on deinit * BUG/MINOR: server: Fix server-state-file-name directive * BUG/MINOR: backend: hold correctly lock when killing idle conn * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints() * BUG/MINOR: server: re-align state file fields number * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors * BUG/MINOR: intops: fix mul32hi()'s off-by-one * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro * MINOR: check: do not ignore a connection header for http-check send - Update to version 2.3.7+git0.2d39ce334: * [RELEASE] Released version 2.3.7 * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames * MINOR: resolvers: Don't try to match immediatly renewed ADD items * MINOR: resolvers: Use milliseconds for cached items in resolver responses * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible * MINOR: resolvers: Add function to change the srv status based on SRV resolution * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error * MINOR: resolvers: Use a function to remove answers attached to a resolution * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item * MINOR: resolvers: new function find_srvrq_answer_record() * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item * BUG/MEDIUM: resolvers: Don't set an address-less server as UP * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution * BUG/MINOR: resolvers: Reset server address on DNS error only on status change * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record" * CLEANUP: tcp-rules: add missing actions in the tcp-request error message * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check * BUG/MINOR: session: Add some forgotten tests on session's listener * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw() * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc. * OPTIM: task: automatically adjust the default runqueue-depth to the threads * MINOR: task: give the scheduler a bit more flexibility in the runqueue size * MEDIUM: task: remove the tasks_run_queue counter and have one per thread * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1 * MINOR: task: add an application specific flag to the state: TASK_F_USR1 * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake * MINOR: ssl: mark the SSL handshake tasklet as heavy * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY * MEDIUM: backend: use a trylock when trying to grab an idle connection * MINOR: pools: double the local pool cache size to 1 MB * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS * MEDIUM: streams: do not use the streams lock anymore * MINOR: streams: use one list per stream instead of a global one * MINOR: cli/streams: make "show sess" dump all streams till the new epoch * MINOR: stream: add an "epoch" to figure which streams appeared when * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait * MINOR: dynbuf: make the buffer wait queue per thread * OPTIM: lb-leastconn: do not unlink the server if it did not change * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock * MINOR: server: move actconns to the per-thread structure * OPTIM: server: switch the actconn list to an mt-list * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4 * MINOR: tasks: refine the default run queue depth * BUG/MEDIUM: session: NULL dereference possible when accessing the listener * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs * MINOR: atomic: add armv8.1-a atomics variant for cas-dw * BUG/MINOR: mt-list: always perform a cpu_relax call on failure * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring() * BUG/MINOR: backend: fix condition for reuse on mode HTTP - Update to version 2.3.8+git0.e572195c7: * [RELEASE] Released version 2.3.8 * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters * MINOR: tools: make url2ipv4 return the exact number of bytes parsed * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available. * CLEANUP: fd: remove unused fd_set_running_excl() * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete() * MINOR: fd: remove the unneeded running bit from fd_insert() * MINOR: fd: make fd_clr_running() return the remaining running mask * BUG/MEDIUM: lua: Always init the lua stack before referencing the context * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback * MINOR: lua: Slightly improve function dumping the lua traceback * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list" * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket * BUG/MINOR: protocol: add missing support of dgram unix socket. * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable * MINOR: time: also provide a global, monotonic global_now_ms timer * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback * BUG/MINOR: freq_ctr/threads: make use of the last updated global time * MINOR: time: export the global_now variable - Update to version 2.3.9+git1.afb63bc04: * BUILD: backend: fix build breakage in idle conn locking fix * [RELEASE] Released version 2.3.9 * BUG/MEDIUM: time: make sure to always initialize the global tick * BUG/MINOR: stats: Apply proper styles in HTML status page. * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent - Update to version 2.3.10+git0.4764f0e4e: * [RELEASE] Released version 2.3.10 * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush * BUG/MEDIUM: peers: re-work connection to new process during reload. * BUG/MINOR: peers: remove useless table check if initial resync is finished * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data * BUG/MINOR: mworker: don't use oldpids[] anymore for reload * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases * BUG/MEDIUM: config: fix cpu-map notation with both process and threads * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers * BUG/MINOR: server: free srv.lb_nodes in free_server * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received * BUG/MINOR: logs: Report the true number of retries if there was no connection * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check * MINOR: connection: Make bc_http_major compatible with tcp-checks * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections * MINOR: logs: Add support of checks as session origin to format lf strings * BUG/MINOR: checks: Set missing id to the dummy checks frontend * BUG/MEDIUM: threads: Ignore current thread to end its harmless period * DOC: ssl: Certificate hot update only works on fronted certificates * BUG/MEDIUM: sample: Fix adjusting size in field converter * MINOR: No longer rely on deprecated sample fetches for predefined ACLs * DOC: clarify that compression works for HTTP/2 * BUG/MINOR: tools: fix parsing "us" unit for timers * CONTRIB: halog: fix issue with array of type char * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one * BUG/MINOR: ssl: Fix update of default certificate * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS * BUG/MINOR: tcp: fix silent-drop workaround for IPv6 - Update to version 2.4.0+git0.6cbbecf09: https://www.haproxy.com/blog/announcing-haproxy-2-4/ for all the details see /usr/share/doc/packages/haproxy/CHANGELOG - refreshed patches to apply cleanly again haproxy-1.6.0-makefile_lib.patch haproxy-1.6.0-sec-options.patch lua54.patch - Update to version 2.4.1+git0.1ce7d4925: * [RELEASE] Released version 2.4.1 * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace * MINOR: mux-h2: obey http-ignore-probes during the preface * BUG/MINOR: stats: make "show stat typed desc" work again * CLEANUP: mux-h2/traces: better align user messages * MINOR: mux-h2/trace: report a few connection-level info during h2_init() * MINOR: connection: add helper conn_append_debug_info() * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers * BUG/MINOR: mux-h1: do not skip the error response on bad requests * MINOR: backend: only skip LB when there are actual connections * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue * CLEANUP: global: remove unused definition of stopping_task[] * BUG/MINOR: mworker: fix typo in chroot error message * BUG/MINOR: ssl: use atomic ops to update global shctx stats * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server' * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id * DOC: lua: Add a warning about buffers modification in HTTP * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item * BUG/MINOR: resolvers: answser item list was randomly purged or errors * CLEANUP: l7-retries: do not test the buffer before calling b_alloc() * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded * CLEANUP: pools: remove now unused seq and pool_free_list * BUG/MAJOR: pools: fix possible race with free() in the lockless variant * MEDIUM: pools: use a single pool_gc() function for locked and lockless * MINOR: pools: call malloc_trim() under thread isolation * MINOR: pools: do not maintain the lock during pool_flush() * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush() * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data * BUG/MEDIUM: compression: Properly get the next block to iterate on payload * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode" * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future * BUILD: make tune.ssl.keylog available again * DOC: use the req.ssl_sni in examples * MINOR: errors: allow empty va_args for diag variadic macro * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry * DOC/MINOR: move uuid in the configuration to the right alphabetical order * BUG/MINOR: vars: Be sure to have a session to get checks variables * CLEANUP: http-ana: Remove useless if statement about L7 retries * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree * BUG/MINOR: http: Missing calloc return value check in make_arg_list * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine * BUG/MINOR: peers: Missing calloc return value check in peers_register_table * BUG/MINOR: server: Missing calloc return value check in srv_parse_source * DOC: intro: Fix typo in starter guide * MINOR: cfgparse: Fail when encountering extra arguments in macro * MINOR: http-ana: Perform L7 retries because of status codes in response analyser * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers" * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter * BUILD/MINOR: opentracing: fixed build when using clang * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server' * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry - Update to version 2.4.2+git0.553dee326: * [RELEASE] Released version 2.4.2 * REGTESTS: add http scheme-based normalization test * MEDIUM: h2: apply scheme-based normalization on h2 requests * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests * MEDIUM: http: implement scheme-based normalization * MINOR: http: implement http_get_scheme * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules" * BUG/MINOR: cli: fix server name output in "show fd" * BUG/MEDIUM: sock: make sure to never miss early connection failures * DOC: stick-table: add missing documentation about gpt0 stored type * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types * BUG/MINOR: stick-table: fix several printf sign errors dumping tables * DOC: config: use CREATE USER for mysql-check * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution * BUG/MINOR: mqtt: Support empty client ID in CONNECT message * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules * BUILD: Makefile: fix linkage for Haiku. * BUG/MINOR: checks: return correct error code for srv_parse_agent_check * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response() * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response * BUG/MINOR: resolvers: Always attach server on matching record on resolution * CLEANUP: dns: Remove a forgotten debug message * DOC: config: Add missing actions in "tcp-request session" documentation * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules * REGTESTS: fix maxconn update with agent-check * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header * BUG/MINOR: server/cli: Fix locking in function processing "set server" command * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task() * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled * BUG/MINOR: server-state: load SRV resolution only if params match the config - Update to version 2.4.3+git0.4dd5a5a6c: CVE-2021-39240 CVE-2021-39241 CVE-2021-39242 (boo#1189366 boo#1189548 boo#1189549) * [RELEASE] Released version 2.4.3 * REGTESTS: add a test to prevent h2 desync attacks * BUG/MEDIUM: h2: give :authority precedence over Host * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax * MINOR: http: add a new function http_validate_scheme() to validate a scheme * DOC/MINOR: fix typo in management document * CLEANUP: assorted typo fixes in the code and comments * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued * DOC: config: Fix 'http-response send-spoe-group' documentation * DOC: Improve the lua documentation * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer * BUG/MINOR: buffer: fix buffer_dump() formatting * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure * ADMIN: dyncookie: implement a simple dynamic cookie calculator * MINOR: server: unmark deprecated on enable health/agent cli * BUG/MINOR: server: update last_change on maint->ready transitions too * BUG/MINOR: server: remove srv from px list on CLI 'add server' error * BUILD: opentracing: fixed build when using pkg-config utility * DOC: internals: document the FD takeover process * BUG/MINOR: fd: protect fd state harder against a concurrent takeover * BUG/MINOR: pollers: always program an update for migrated FDs * BUG/MINOR: poll: fix abnormally high skip_fd counter * BUG/MINOR: select: fix excess number of dead/skip reported * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover * BUG/MINOR: connection: Add missing error labels to conn_err_code_str * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called * BUG/MINOR: mux-h2: Obey dontlognull option during the preface * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests * BUG/MINOR: systemd: must check the configuration using -Ws * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree * BUG/MINOR: check: fix the condition to validate a port-less server * BUG/MINOR: stats: Add missing agent stats on servers * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request * BUILD/MINOR: memprof fix macOs build. * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected * BUILD: lua: silence a build warning with TCC * BUILD: add detection of missing important CFLAGS * BUG/MINOR: ssl: Default-server configuration ignored by server * MINOR: mux_h2: define config to disable h2 websocket support * BUILD: http_htx: fix ci compilation error with isdigit for Windows - Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877) * [RELEASE] Released version 2.4.4 * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive" * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer * CLEANUP: htx: remove comments about "must be < 256 MB" * BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB * DOC: configuration: remove wrong tcp-request examples in tcp-response * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser * CLEANUP: Add missing include guard to signal.h * BUG/MINOR: tools: Fix loop condition in dump_text() * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long * MINOR: time: add report_idle() to report process-wide idle time * BUG/MINOR: time: fix idle time computation for long sleeps * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords * MINOR: compiler: implement an ONLY_ONCE() macro * BUG/MINOR: base64: base64urldec() ignores padding in output size check * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions * MINOR: hlua: take the global Lua lock inside a global function * REGTESTS: abortonclose: after retries, 503 is expected, not close * REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2 * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path - Update to version 2.4.5+git0.e74a1b34b: * [RELEASE] Released version 2.4.5 * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue() * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing * MINOR: arg: Be able to forbid unresolved args when building an argument list * BUG/MAJOR: lua: use task_wakeup() to properly run a task once * BUG/MEDIUM: lua: fix wakeup condition from sleep() * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options * DOC: peers: fix doc "enable" statement on "peers" sections * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers" * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary * MINOR: htx: Add a function to know if the free space wraps * MINOR: htx: Add an HTX flag to know when a message is fragmented * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv() * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer * BUG/MINOR: stats: use refcount to protect dynamic server on dump * MINOR: server: return the next srv instance on free_server * BUG/MINOR: server: do not use refcount in free_server in stopping mode * MINOR: global: define MODE_STOPPING * MINOR: server: implement a refcount for dynamic servers * BUG/MINOR: http-ana: increment internal_errors counter on response error * BUG/MINOR: h1-htx: Fix a typo when request parser is reset * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero * BUG/MINOR: server: allow 'enable health' only if check configured * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl * BUILD: halog: fix a -Wundef warning on non-glibc systems * BUILD: compiler: fixed a missing test on defined(__GNUC__) * BUILD: fix dragonfly build again on __read_mostly * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var * BUG/MINOR: vars: truncate the variable name in error reports about scope. * BUG/MINOR: vars: properly set the argument parsing context in the expression * MINOR: sample: add missing ARGC_ entries * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity * BUILD: tools: properly guard __GLIBC__ with defined() * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef * IMPORT: slz: silence a build warning with -Wundef * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING * MINOR: proc: setting the process to produce a core dump on FreeBSD. * MINOR: tools: add FreeBSD support to get_exec_path() * BUILD: tools: get the absolute path of the current binary on NetBSD. * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set * BUG/MINOR: cli/payload: do not search for args inside payload * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation * DOC: management: certificate files must be sanitized before injection * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported * MINOR: pools: use mallinfo2() when available instead of mallinfo() * MINOR: pools: automatically disable malloc_trim() with external allocators * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools() * BUG/MINOR: compat: make sure __WORDSIZE is always defined * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload * MINOR: htx: Skip headers with no value when adding a header list to a message * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload * BUG/MINOR: systemd: ExecStartPre must use -Ws * BUG/MINOR: filters: Set right FLT_END analyser depending on channel * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered * BUG/MINOR: lua: Don't yield in channel.append() and channel.set() * BUG/MINOR: lua: Yield in channel functions only if lua context can yield * MINOR: lua: Add a flag on lua context to know the yield capability at run time - Update to version 2.4.6+git0.d83fd76a1: * [RELEASE] Released version 2.4.6 * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release - Update to version 2.4.7+git0.b5e51a5e2: * [RELEASE] Released version 2.4.7 * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule - Update to version 2.4.8+git0.d1f8d41e0: * [RELEASE] Released version 2.4.8 * SCRIPTS: git-show-backports: re-enable file-based filtering * DOC/peers: some grammar fixes for peers 2.1 spec * MINOR: stream: Improve dump of bogus streams * BUILD/MINOR: cpuset freebsd build fix * DOC: config: Fix alphabetical order of fc_* samples * BUG/MINOR: sample: fix backend direction flags consecutive to last fix * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration * MINOR: halog: Add support for extracting captures using -hdr * BUG/MINOR: halog: Add missing newlines in die() messages * CLEANUP: halog: Use consistent indentation in help() * MINOR: halog: Rename -qry to -query * DOC: halog: Move the `-qry` parameter into the correct section in help text * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink * MEDIUM: resolvers: remove the last occurrences of the "safe" argument * MEDIUM: resolvers: use a kill list to preserve the list consistency * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters * CLEANUP: always initialize the answer_list * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records() * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed * BUILD: atomic: fix build on mac/arm64 * BUG/MINOR: backend: fix improper insert in avail tree for always reuse * BUILD: fix compilation on NetBSD * MINOR: memprof: add one pointer size to the size of allocations * MINOR: memprof: report the delta between alloc and free on realloc() * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame * BUG/MINOR: task: do not set TASK_F_USR1 for no reason * BUG/MAJOR: buf: fix varint API post- vs pre- increment * BUG/MEDIUM: resolvers: always check a valid item in query_list * BUILD: resolvers: avoid a possible warning on null-deref * BUG/MAJOR: resolvers: add other missing references during resolution removal * MINOR: resolvers: merge address and target into a union "data" * BUG/MEDIUM: resolvers: use correct storage for the target address * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records * BUG/MEDIUM: resolver: make sure to always use the correct hostname length * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier * BUG/MAJOR: dns: tcp session can remain attached to a list after a free * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors * Revert "CLEANUP: server: always include the storage for SSL settings" * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back * MINOR: initcall: Rename __GLOBL and __GLOBL1. * DOC: configuration: add clarification on escaping in keyword arguments * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames * BUG/MEDIUM: sample: properly verify that variables cast to sample * MINOR: sample: provide a generic var-to-sample conversion function * CLEANUP: sample: uninline sample_conv_var2smp_str() * CLEANUP: sample: rename sample_conv_var2smp() to *_sint * CLEANUP: server: always include the storage for SSL settings - (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header o Apply upstream patch: 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch - VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181) o Apply upstream patch: 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch - VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132) o Apply upstream patch: 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - The output buffer is not zero-initialized. If we don't clear reserved bytes, fcgi requests sent to backend will leak sensitive data. o Apply proposed patch: 0001-output-buffer-is-not-zero-initialized.path - ECO: Maint: Update haproxy to latest maintenance release for all SLE15 (jsc#PED-3821) - rebase and rename haproxy-1.6.0-sec-options.patch -> haproxy-2.4.22-sec-options.patch - remove patches covered by new release: lua54.patch 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch 0001-output-buffer-is-not-zero-initialized.path 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - Update to version 2.4.22+git0.f8e3218e2: * [RELEASE] Released version 2.4.22 * BUG/CRITICAL: http: properly reject empty http header field names * CI: github: don't warn on deprecated openssl functions on windows * BUG/MEDIUM: stconn: Schedule a shutw on shutr if data must be sent first * DOC: proxy-protocol: fix wrong byte in provided example * DOC: config: 'http-send-name-header' option may be used in default section * DOC: config: fix option spop-check proxy compatibility * BUG/MEDIUM: cache: use the correct time reference when comparing dates * BUG/MEDIUM: stick-table: do not leave entries in end of window during purge * BUG/MINOR: ssl/crt-list: warn when a line is malformated * BUG/MEDIUM: ssl: wrong eviction from the session cache tree * BUG/MINOR: fcgi-app: prevent 'use-fcgi-app' in default section * [RELEASE] Released version 2.4.21 * BUG/MINOR: sink: free the forwarding task on exit * BUILD: hpack: include global.h for the trash that is needed in debug mode * BUG/MINOR: mux-h2: add missing traces on failed headers decoding * BUG/MINOR: listener: close tiny race between resume_listener() and stopping * DOC: config: fix "Address formats" chapter syntax * BUG/MINOR: mux-fcgi: Correctly set pathinfo * DOC: config: fix aliases for protocol prefixes "udp4@" and "udp6@" * DOC: config: fix wrong section number for "protocol prefixes" * BUG/MINOR: listeners: fix suspend/resume of inherited FDs * BUG/MINOR: http-ana: make set-status also update txn->status * BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state * BUG/MINOR: http-ana: Report SF_FINST_R flag on error waiting the request body * BUG/MINOR: promex: Don't forget to consume the request on error * BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action * BUG/MINOR: h1-htx: Remove flags about protocol upgrade on non-101 responses * CLEANUP: htx: fix a typo in an error message of http_str_to_htx * BUG/MINOR: http: Memory leak of http redirect rules' format string * REGTEST: fix the race conditions in hmac.vtc * REGTEST: fix the race conditions in digest.vtc * REGTEST: fix the race conditions in json_query.vtc * BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned * BUG/MINOR: http-fetch: Only fill txn status during prefetch if not already set * BUILD: makefile: sort the features list * BUILD: makefile: build the features list dynamically * BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats * BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set * BUG/MINOR: ssl: Fix memory leak of find_chain in ssl_sock_load_cert_chain * LICENSE: wurfl: clarify the dummy library license. * BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout * REGTESTS: startup: check maxconn computation * REGTESTS: fix the race conditions in iff.vtc * BUG/MAJOR: fcgi: Fix uninitialized reserved bytes * DOC: promex: Add missing backend metrics * MINOR: promex: introduce haproxy_backend_agg_check_status * BUG/MINOR: promex: create haproxy_backend_agg_server_status * BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers * BUG/MINOR: ssl: Fix potential overflow * BUG/MEDIUM: ssl: Verify error codes can exceed 63 * BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure * BUILD: peers: peers-t.h depends on stick-table-t.h * CI: github: change "ubuntu-latest" to "ubuntu-20.04" * BUG/MEDIIM: stconn: Flush output data before forwarding close to write side * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * [RELEASE] Released version 2.4.20 * Revert "CI: determine actual OpenSSL version dynamically" * Revert "CI: switch to the "latest" LibreSSL" * SCRIPTS: announce-release: add a link to the data plane API * DOC: config: clarify the -m dir and -m dom pattern matching methods * DOC: config: clarify the fact that "retries" is not just for connections * DOC: config: explain how default matching method for ACL works * DOC: config: mention that a single monitor-uri rule is supported * DOC: config: clarify the fact that SNI should not be used in HTTP scenarios * DOC: config: provide some configuration hints for "http-reuse" * Revert "BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action" * BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out * BUILD: http-htx: Silent build error about a possible NULL start-line * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * BUG/MINOR: log: fix parse_log_message rfc5424 size check * BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance * BUILD: listener: fix build warning on global_listener_rwlock without threads * BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns * BUILD: peers: Remove unused variables * BUG/MEDIUM: peers: messages about unkown tables not correctly ignored * BUG/MINOR: ssl: don't initialize the keylog callback when not required * BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists * BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task * BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes * BUG/MEDIUM: ring: fix creation of server in uninitialized ring * DOC: config: fix alphabetical ordering of global section * REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses * BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers * BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once * BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy * BUG/MINOR: resolvers: Set port before IP address when processing SRV records * BUG/MINOR: http-htx: Fix error handling during parsing http replies * BUG/MEDIUM: wdt/clock: properly handle early task hangs * CI: emit the compiler's version in the build reports * CI: switch to the "latest" LibreSSL * BUG/MINOR: ssl: ocsp structure not freed properly in case of error * BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer * CI: add monthly gcc cross compile jobs * BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting * BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task * BUG/MAJOR: stick-table: don't process store-response rules for applets * DOC: management: add forgotten "show startup-logs" * BUG/MINOR: stick-table: Use server_id instead of std_t_sint in process_store_rules() * CI: SSL: temporarily stick to LibreSSL=3.5.3 * CI: SSL: use proper version generating when "latest" semantic is used * BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers * BUG/MINOR: sink: Only use backend capability for the sink proxies * BUG/MEDIUM: compression: handle rewrite errors when updating response headers * BUG/MINOR: ring: Properly parse connect timeout * BUG/MINOR: log: Preserve message facility when the log target is a ring buffer * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py * BUG/MINOR: server: make sure "show servers state" hides private bits * BUG/MAJOR: stick-tables: do not try to index a server name for applets * DOC: configuration: missing 'if' in tcp-request content example * BUG/MINOR: backend: only enforce turn-around state when not redispatching * BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction * MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands * BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error * BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os * BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth() * BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os * BUG/MEDIUM: lua: handle stick table implicit arguments right. * BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure * DOC: config: Fix pgsql-check documentation to make user param mandatory * BUG/MINOR: checks: update pgsql regex on auth packet * [RELEASE] Released version 2.4.19 * BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree * REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies * BUG/MINOR: log: improper behavior when escaping log data * SCRIPTS: announce-release: update some URLs to https * BUILD: fd: fix a build warning on the DWCAS * BUG/MEDIUM: captures: free() an error capture out of the proxy lock * DOC: fix TOC in starter guide for subsection 3.3.8. Statistics * REGTESTS: ssl/log: test the log-forward with SSL * BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring. * REGTESTS: log: test the log-forward feature * REGTESTS: healthcheckmail: Relax matching on the healthcheck log message * BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN' * MINOR: listener: small API change * BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK * CI: cirrus-ci: bump FreeBSD image to 13-1 * BUG/MINOR: signals/poller: ensure wakeup from signals * BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals * BUG/MINOR: task: always reset a new tasklet's call date * BUG/MINOR: h1: Support headers case adjustment for TCP proxies * BUILD: makefile: enable crypt(3) for NetBSD * BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support * BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber * BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools * REGTESTS: http_request_buffer: Add a barrier to not mix up log messages * BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input * BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule) * BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets * BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date * BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress * BUG/MEDIUM: peers: Add connect and server timeut to peers proxy * BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode * DOC: configuration: do-resolve doesn't work with a port in the string * REGTESTS: Fix prometheus script to perform HTTP health-checks * BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect * BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config() * BUG/MAJOR: mworker: fix infinite loop on master with no proxies. * BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized * BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle * BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names * BUILD: http: silence an uninitialized warning affecting gcc-5 * BUG/MEDIUM: ring: fix too lax 'size' parser * BUILD: debug: silence warning on gcc-5 * BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq() * BUG/MEDIUM: poller: use fd_delete() to release the poller pipes * BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h * BUG/MINOR: sink: fix a race condition between the writer and the reader * BUG/MINOR: ring/cli: fix a race condition between the writer and the reader * BUG/MEDIUM: proxy: Perform a custom copy for default server settings * REORG: server: Export srv_settings_cpy() function * MINOR: server: Constify source server to copy its settings * BUG/MEDIUM: dns: Properly initialize new DNS session * BUG/MINOR: peers: Use right channel flag to consider the peer as connected * BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload * MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer * BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions * MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups * MINOR: http-htx: Use new HTTP functions for the scheme based normalization * BUG/MEDIUM: h1: Improve authority validation for CONNCET request * MINOR: http: Add function to detect default port * MINOR: http: Add function to get port part of a host * BUG/MEDIUM: mworker: use default maxconn in wait mode * [RELEASE] Released version 2.4.18 * BUG/MINOR: sockpair: wrong return value for fd_send_uxst() * BUG/MINOR: backend: Fallback on RR algo if balance on source is impossible * BUILD: add detection for unsupported compiler models * BUG/MEDIUM: mworker: proc_self incorrectly set crashes upon reload * REGTESTS: Fix some scripts to be compatible with 2.4 and prior * BUG/MINOR: tools: fix statistical_prng_range()'s output range * BUG/MEDIUM: tools: avoid calling dlsym() in static builds (try 2) * BUILD: makefile: Fix install(1) handling for OpenBSD/NetBSD/Solaris/AIX * BUG/MEDIUM: tools: avoid calling dlsym() in static builds * MEDIUM: mworker: set the iocb of the socketpair without using fd_insert() * BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send * BUG/MEDIUM: http-ana: Don't wait to have an empty buf to switch in TUNNEL state * BUG/MINOR: mux-h1: Be sure to commit htx changes in the demux buffer * REGTEESTS: filters: Fix CONNECT request in random-forwarding script * BUG/MEDIUM: http-fetch: Don't fetch the method if there is no stream * BUG/MINOR: http-htx: Fix scheme based normalization for URIs wih userinfo * BUG/MINOR: peers: fix possible NULL dereferences at config parsing * BUG/MINOR: http-act: Properly generate 103 responses when several rules are used * BUG/MINOR: http-check: Preserve headers if not redefined by an implicit rule * BUG/MINOR: peers/config: always fill the bind_conf's argument * MINOR: fd: Add BUG_ON checks on fd_insert() * CI: re-enable gcc asan builds * BUILD: Makefile: Add Lua 5.4 autodetect * BUG/MEDIUM: ssl/fd: unexpected fd close using async engine * MINOR: fd: add a new FD_DISOWN flag to prevent from closing a deleted FD * BUG/MINOR: http-fetch: Use integer value when possible in "method" sample fetch * BUG/MINOR: http-ana: Set method to HTTP_METH_OTHER when an HTTP txn is created * BUG/MINOR: ssl: Do not look for key in extra files if already in pem * MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames * BUG/MEDIUM: ssl/cli: crash when crt inserted into a crt-list * BUG/MINOR: tcp-rules: Make action call final on read error and delay expiration * BUG/MINOR: cli/stats: add missing trailing LF after "show info json" * BUG/MINOR: server: do not enable DNS resolution on disabled proxies * BUG/MINOR: cli/stats: add missing trailing LF after JSON outputs * REGTESTS: healthcheckmail: Relax health-check failure condition * REGTESTS: healthcheckmail: Update the test to be functionnal again * BUG/MINOR: checks: Properly handle email alerts in trace messages * BUG/MINOR: trace: Test server existence for health-checks to get proxy * BUG/MEDIUM: mailers: Set the object type for check attached to an email alert * BUILD: compiler: implement unreachable for older compilers too * REGTESTS: restrict_req_hdr_names: Extend supported versions * REGTESTS: http_abortonclose: Extend supported versions * BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cert I/O handler * BUG/MINOR: ssl_ckch: Dump cert transaction only once if show command yield * REGTESTS: http_request_buffer: Increase client timeout to wait "slow" clients * REGTESTS: abortonclose: Add a barrier to not mix up log messages * MEDIUM: http-ana: Always report rewrite failures as PRXCOND in logs * BUG/MEDIUM: ssl/crt-list: Rework 'add ssl crt-list' to handle full buffer cases * BUG/MEDIUM: ssl_ckch: Rework 'commit ssl cert' to handle full buffer cases * BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a cert entry * BUG/MEDIUM: ssl_ckch: Don't delete a cert entry if it is being modified * BUG/MINOR: ssl_ckch: Free error msg if commit changes on a cert entry fails * DOC: intro: adjust the numbering of paragrams to keep the output ordered * DOC: peers: fix port number and addresses on new peers section format * DOC: peers: clarify when entry expiration date is renewed. * DOC: peers: indicate that some server settings are not usable * SCRIPTS: make publish-release try to launch make-releases-json * SCRIPTS: add make-releases-json to recreate a releases.json file in download dirs * REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (2) * BUG/MEDIUM: sample: Fix adjusting size in word converter * BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section * BUG/MEDIUM: peers: fix segfault using multiple bind on peers sections * BUG/MEDIUM: resolvers: Don't defer resolutions release in deinit function * BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols * BUG/MEDIUM: tools: Fix `inet_ntop` usage in sa2str * CI: determine actual OpenSSL version dynamically * BUILD/MINOR: cpuset fix build for FreeBSD 13.1 * BUG/MINOR: peers: fix error reporting of "bind" lines * BUG/MINOR: cfgparse: abort earlier in case of allocation error * BUG/MINOR: check: Reinit the buffer wait list at the end of a check * BUG/MEDIUM: config: Reset outline buffer size on realloc error in readcfgfile() * REGTESTS: abortonclose: Fix some race conditions * BUG/MINOR: ssl: Fix crash when no private key is found in pem * MINOR: tools: add get_exec_path implementation for solaris based systems. * BUILD: fix build warning on solaris based systems with __maybe_unused. * MEDIUM: http-ana: Add a proxy option to restrict chars in request header names * CI: determine actual LibreSSL version dynamically * [RELEASE] Released version 2.4.17 * CLEANUP: mux-h1: Fix comments and error messages for global options * BUG/MEDIUM: wdt: don't trigger the watchdog when p is unitialized * BUG/MINOR: conn_stream: do not confirm a connection from the frontend path * BUG/MINOR: server: Make SRV_STATE_LINE_MAXLEN value from 512 to 2kB (2000 bytes). * DOC: install: update gcc version requirements * BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-( * BUILD: listener: shut report of possible null-deref in listener_accept() * BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings * BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation * CI: dynamically determine actual version of h2spec * DOC: fix typo "ant" for "and" in INSTALL * BUG/MINOR: map/cli: make sure patterns don't vanish under "show map"'s init * BUG/MINOR: map/cli: protect the backref list during "show map" errors * BUG/MEDIUM: cli: make "show cli sockets" really yield * BUG/MEDIUM: resolvers: make "show resolvers" properly yield * BUG/MINOR: tcp/http: release the expr of set-{src,dst}[-port] * DOC: config: Update doc for PR/PH session states to warn about rewrite failures * MINOR: mux-h2: report a trace event when failing to create a new stream * BUG/MINOR: mux-h2: mark the stream as open before processing it not after * BUG/MAJOR: dns: multi-thread concurrency issue on UDP socket * BUG/MEDIUM: mux-h1: Be able to handle trailers when C-L header was specified * BUG/MEDIUM: mux-fcgi: Be sure to never set EOM flag on an empty HTX message * SCRIPTS: announce-release: add URL of dev packages * CI: github actions: update LibreSSL to 3.5.2 * [RELEASE] Released version 2.4.16 * BUILD: opentracing: Fix OT build due to misuse of var_clear() * BUILD: proto_uxst: do not set unused flag * BUILD: sockpair: do not set unused flag * BUILD: fd: remove unused variable totlen in fd_write_frag_line() * CLEANUP: acl: Remove unused variable when releasing an acl expression * BUG/MINOR: pools: make sure to also destroy shared pools in pool_destroy_all() * BUG/MINOR: resolvers: Fix memory leak in resolvers_deinit() * BUILD: compiler: properly distinguish weak and global symbols * REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc * MEDIUM: queue: use tasklet_instant_wakeup() to wake tasks * MINOR: task: add a new task_instant_wakeup() function * BUG/MINOR: rules: Fix check_capture() function to use the right rule arguments * DOC: remove my name from the config doc * BUG/MAJOR: connection: Never remove connection from idle lists outside the lock * BUG/MINOR: cache: Disable cache if applet creation fails * SCRIPTS: announce-release: add shortened links to pending issues * DOC: lua: update a few doc URLs * SCRIPTS: announce-release: update the doc's URL * BUG/MEDIUM: compression: Don't forget to update htx_sl and http_msg flags * BUG/MEDIUM: fcgi-app: Use http_msg flags to know if C-L header can be added * BUG/MEDIUM: stream: do not abort connection setup too early * BUILD: compiler: use a more portable set of asm(".weak") statements * BUILD: sched: workaround crazy and dangerous warning in Clang 14 * BUG/MEDIUM: mux-h1: Don't request more room on partial trailers * BUG/MINOR: mux-h2: use timeout http-request as a fallback for http-keep-alive * BUG/MINOR: mux-h2: do not use timeout http-keep-alive on backend side * BUILD: debug: mark the __start_mem_stats/__stop_mem_stats symbols as weak * BUG/MINOR: cache: do not display expired entries in "show cache" * BUG/MINOR: mux-h2: do not send GOAWAY if SETTINGS were not sent * CI: cirrus: switch to FreeBSD-13.0 * CI: Update to actions/cache@v3 * CI: Update to actions/checkout@v3 * DEBUG: opentracing: show return values of all functions in the debug output * CLEANUP: opentracing: added variable to store variable length * CLEANUP: opentracing: added flt_ot_smp_init() function * CLEANUP: opentracing: removed unused function flt_ot_var_get() * CLEANUP: opentracing: removed unused function flt_ot_var_unset() * DOC: opentracing: corrected comments in function descriptions * EXAMPLES: opentracing: refined shell scripts for testing filter performance * BUG/MINOR: opentracing: setting the return value in function flt_ot_var_set() * BUG/MEDIUM: http-act: Don't replace URI if path is not found or invalid * BUG/MEDIUM: http-conv: Fix url_enc() to not crush const samples * BUG/MEDIUM: mux-h1: Set outgoing message to DONE when payload length is reached * BUG/MEDIUM: promex: Be sure to never set EOM flag on an empty HTX message * BUG/MEDIUM: hlua: Don't set EOM flag on an empty HTX message in HTTP applet * BUG/MEDIUM: stats: Be sure to never set EOM flag on an empty HTX message * BUG/MINOR: fcgi-app: Don't add C-L header on response to HEAD requests * CI: github actions: update OpenSSL to 3.0.2 * BUG/MAJOR: mux_pt: always report the connection error to the conn_stream * BUG/MINOR: cli/stream: fix "shutdown session" to iterate over all threads * BUG/MINOR: samples: add missing context names for sample fetch functions * DOC: reflect H2 timeout changes * BUG/MEDIUM: mux-h2: make use of http-request and keep-alive timeouts * MEDIUM: mux-h2: slightly relax timeout management rules * BUG/MEDIUM: stream-int: do not rely on the connection error once established * BUG/MEDIUM: mux-h1: Properly detect full buffer cases during message parsing * BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing * BUG/MINOR: tools: url2sa reads too far when no port nor path * DOC: config: Explictly add supported MQTT versions * MEDIUM: mqtt: support mqtt_is_valid and mqtt_field_value converters for MQTTv3.1 * BUG/MEDIUM: trace: avoid race condition when retrieving session from conn->owner * BUG/MEDIUM: mux-h1: only turn CO_FL_ERROR to CS_FL_ERROR with empty ibuf * CI: github actions: switch to LibreSSL-3.5.1 * BUG/MINOR: server/ssl: free the SNI sample expression * BUG/MINOR: tools: fix url2sa return value with IPv4 * [RELEASE] Released version 2.4.15 * BUILD: tree-wide: mark a few numeric constants as explicitly long long * DOC: Fix usage/examples of deprecated ACLs * BUG/MINOR: stream: make the call_rate only count the no-progress calls * BUG/MINOR: session: fix theoretical risk of memleak in session_accept_fd() * BUG/MAJOR: mux-pt: Always destroy the backend connection on detach * DEBUG: stream: Fix stream trace message to print response buffer state * DEBUG: stream: Add the missing descriptions for stream trace events * BUG/MEDIUM: mcli: Properly handle errors and timeouts during reponse processing * DEBUG: cache: Update underlying buffer when loading HTX message in cache applet * BUG/MINOR: promex: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cache: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: stats: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: hlua: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cli: shows correct mode in "show sess" * BUG/MINOR: add missing modes in proxy_mode_str() * BUILD: pools: fix backport of no-memory-trimming on non-linux OS * MINOR: pools: add a new global option "no-memory-trimming" * BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed * BUG/MINOR: pool: always align pool_heads to 64 bytes * REGTESTS: fix the race conditions in secure_memcmp.vtc * REGTESTS: fix the race conditions in normalize_uri.vtc * BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks() * CI: github actions: use cache for SSL libs * CI: github actions: use cache for OpenTracing * CI: github actions: add OpenTracing builds * CI: github actions: add the output of $CC -dM -E- * [RELEASE] Released version 2.4.14 * BUG/MEDIUM: stream: Abort processing if response buffer allocation fails * CI: github: enable pool debugging by default * REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks * BUG/MINOR: proxy: preset the error message pointer to NULL in parse_new_proxy() * BUG/MAJOR: mux-h2: Be sure to always report HTX parsing error to the app layer * BUG/MEDIUM: mux-h1: Don't wake h1s if mux is blocked on lack of output buffer * BUG/MEDIUM: htx: Be sure to have a buffer to perform a raw copy of a message * BUG/MINOR: tools: url2sa reads ipv4 too far * BUG/MINOR: mailers: negotiate SMTP, not ESMTP * CI: github actions: update OpenSSL to 3.0.1 * CI: github: switch to OpenSSL 3.0.0 * CI: github actions: relax OpenSSL-3.0.0 version comparision * CI: github actions: -Wno-deprecated-declarations with OpenSSL 3.0.0 * CI: github actions: add OpenSSL-3.0.0 builds * BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2 * BUILD: fix compilation for OpenSSL-3.0.0-alpha17 * CI: ssl: keep the old method for ancient OpenSSL versions * CI: ssl: do not needlessly build the OpenSSL docs * CI: ssl: enable parallel builds for OpenSSL on Linux * BUG/MAJOR: compiler: relax alignment constraints on certain structures * BUG/MEDIUM: fd: always align fdtab[] to 64 bytes * BUG/MEDIUM: resolvers: Really ignore trailing dot in domain names * BUG/MINOR: sink: Use the right field in appctx context in release callback * BUG/MINOR: mworker: fix a FD leak of a sockpair upon a failed reload * BUG/MEDIUM: mworker: close unused transferred FDs on load failure * MINOR: sock: move the unused socket cleaning code into its own function * [RELEASE] Released version 2.4.13 * BUG/MINOR: mux-h2: update the session's idle delay before creating the stream * BUG/MEDIUM: h2/hpack: fix emission of HPACK DTSU after settings change * REGTESTS: peers: leave a bit more time to peers to synchronize * BUG/MAJOR: spoe: properly detach all agents when releasing the applet * BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies * BUG/MEDIUM: listener: read-lock the listener during accept() * MINOR: listener: replace the listener's spinlock with an rwlock * BUG/MINOR: mworker: does not erase the pidfile upon reload * BUG/MAJOR: sched: prevent rare concurrent wakeup of multi-threaded tasks * DEBUG: pools: replace the link pointer with the caller's address on pool_free() * DEBUG: pools: let's add reverse mapping from cache heads to thread and pool * DEBUG: pools: add extra sanity checks when picking objects from a local cache * BUG/MINOR: pools: always flush pools about to be destroyed * BUG/MEDIUM: mworker: don't lose the stats socket on failed reload * DEBUG: pools: add new build option DEBUG_POOL_INTEGRITY * BUILD: debug/cli: condition test of O_ASYNC to its existence * DEBUG: cli: add a new "debug dev fd" expert command * MEDIUM: h2/hpack: emit a Dynamic Table Size Update after settings change * BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them * BUG/MEDIUM: mcli: do not try to parse empty buffers * BUG/MEDIUM: cli: Never wait for more data on client shutdown * BUG/MINOR: cli: avoid O(bufsize) parsing cost on pipelined commands * MINOR: channel: add new function co_getdelim() to support multiple delimiters * MEDIUM: cli: yield between each pipelined command * BUG/MEDIUM: server: avoid changing healthcheck ctx with set server ssl * BUILD/MINOR: fix solaris build with clang. * BUG/MEDIUM: htx: Adjust length to add DATA block in an empty HTX buffer * BUG/MEDIUM: connection: properly leave stopping list on error * [RELEASE] Released version 2.4.12 * BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data * BUG/MEDIUM: mworker: don't use _getsocks in wait mode * [RELEASE] Released version 2.4.11 * BUG/MEDIUM: http-ana: Preserve response's FLT_END analyser on L7 retry * BUG/MINOR: cli: fix _getsocks with musl libc * BUILD/MINOR: tools: solaris build fix on dladdr. * BUILD/MINOR: cpuset FreeBSD 14 build fix. * BUG/MEDIUM: ssl: free the ckch instance linked to a server * BUG/MINOR: ssl: free the fields in srv->ssl_ctx * MINOR: debug: add support for -dL to dump library names at boot * MINOR: debug: add ability to dump loaded shared libraries * MINOR: compat: detect support for dl_iterate_phdr() * BUG/MINOR: mux-h1: Fix splicing for messages with unknown length * BUG/MEDIUM: mux-h1: Fix splicing by properly detecting end of message * BUILD: makefile: add -Wno-atomic-alignment to work around clang abusive warning * MINOR: proxy: add option idle-close-on-response * REGTESTS: ssl: fix ssl_default_server.vtc * BUG/MEDIUM: ssl: initialize correctly ssl w/ default-server * DOC: fix misspelled keyword "resolve_retries" in resolvers * BUILD: ssl: unbreak the build with newer libressl * BUILD: cli: clear a maybe-unused warning on some older compilers * BUG/MINOR: pools: don't mark ourselves as harmless in DEBUG_UAF mode * BUG/MEDIUM: backend: fix possible sockaddr leak on redispatch * [RELEASE] Released version 2.4.10 * BUG/MINOR: backend: restore the SF_SRV_REUSED flag original purpose * BUG/MINOR: backend: do not set sni on connection reuse * MINOR: pools: work around possibly slow malloc_trim() during gc * BUG/MEDIUM: mworker/cli: crash when trying to access an old PID in prompt mode * DOC: config: retry-on list is space-delimited * DOC: config: Specify %Ta is only available in HTTP mode * DOC: spoe: Clarify use of the event directive in spoe-message section * BUG/MINOR: cli/server: Don't crash when a server is added with a custom id * IMPORT: slz: use the correct CRC32 instruction when running in 32-bit mode * BUILD: tree-wide: avoid warnings caused by redundant checks of obj_types * MINOR: cli: "show version" displays the current process version * CI: Github Actions: temporarily disable BoringSSL builds * BUILD: bug: Fix error when compiling with -DDEBUG_STRICT_NOCRASH * MINOR: mux-h1: Improve H1 traces by adding info about http parsers * BUG/MAJOR: segfault using multiple log forward sections. * BUG/MEDIUM: resolvers: Detach query item on response error * BUG/MINOR: server: Don't rely on last default-server to init server SSL context * BUG/MEDIUM: cli: Properly set stream analyzers to process one command at a time * BUILD/MINOR: server: fix compilation without SSL * [RELEASE] Released version 2.4.9 * BUG/MINOR: cache: Fix loop on cache entries in "show cache" * MINOR: promex: backend aggregated server check status * MINOR: server: add ws keyword * MEDIUM: server/backend: implement websocket protocol selection * MINOR: connection: add alternative mux_ops param for conn_install_mux_be * MINOR: connection: implement function to update ALPN * MINOR: stream/mux: implement websocket stream flag * BUG/MINOR: ssl: make SSL counters atomic * MINOR: shctx: add a few BUG_ON() for consistency checks * BUG/MINOR: shctx: do not look for available blocks when the first one is enough * BUG/MEDIUM: shctx: leave the block allocator when enough blocks are found * BUG/MEDIUM: cache/cli: make "show cache" thread-safe * BUG/MEDIUM: mux-h2: always process a pending shut read * BUG/MEDIUM: ssl: abort with the correct SSL error when SNI not found * CLEANUP: ssl: fix wrong #else commentary * BUG/MINOR: ssl: free correctly the sni in the backend SSL cache * BUG/MEDIUM: ssl: backend TLS resumption with sni and TLSv1.3 * BUILD: makefile: simplify detection of libatomic * BUG/MEDIUM: mux-h1: Handle delayed silent shut in h1_process() to release H1C * BUG/MINOR: stick-table/cli: Check for invalid ipv6 key * BUG/MEDIUM: connection: make cs_shutr/cs_shutw//cs_close() idempotent * BUG/MINOR: mux-h2: Fix H2_CF_DEM_SHORT_READ value * BUG/MINOR: mworker: doesn't launch the program postparser * BUG/MEDIUM: conn-stream: Don't reset CS flags on close * MINOR: mux-h1: Slightly Improve H1 traces * DOC: lua: Be explicit with the Reply object limits * Revert "BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back" * BUG/MINOR: http-ana: Apply stop to the current section for http-response rules * DOC: config: Fix typo in ssl_fc_unique_id description * BUG/MINOR: cache: properly ignore unparsable max-age in quotes * BUG/MINOR: resolvers: throw log message if trash not large enough for query * BUG/MINOR: resolvers: fix sent messages were counted twice * BUG/MEDIUM: mux-h2: reject upgrade if no RFC8441 support * MINOR: mux-h2: add trace on extended connect usage * MINOR: mux-h2: perform a full cycle shutdown+drain on close * MINOR: connection: add a new CO_FL_WANT_DRAIN flag to force drain on close - VUL-0: CVE-2023-40225: haproxy: reject any empty content-length header value (bsc#1214102) Apply upstream patch adapted for 2.4.22 (patch h2_parse_cont_len_header() instead of http_parse_cont_len_header()) Add patch: 0001-BUG-MAJOR-http-reject-any-empty-content-length-heade.patch - VUL-0: CVE-2023-45539: haproxy: misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653) Apply upstream patch. Add patch: 0001-BUG-MINOR-h1-do-not-accept-as-part-of-the-URI-compon.patch - Update to version 2.3.6+git0.7851701ed: * [RELEASE] Released version 2.3.6 * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout * BUG/MINOR: mux-h2: Fix typo in scheme adjustment * DOC: spoe: Add a note about fragmentation support in HAProxy * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread > 1 * BUG/MINOR: connection: Use the client's dst family for adressless servers * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule * BUG/MINOR: http-ana: Only consider dst address to process originalto option * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf() * BUG/MINOR: stats: fix compare of no-maint url suffix * CLEANUP: muxes: Remove useless if condition in show_fd function * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup() * BUG/MEDIUM: resolvers: Reset address for unresolved servers * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records * BUG/MINOR: resolvers: new callback to properly handle SRV record errors * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl() * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe * BUG/MINOR: sample: secure convs that accept base64 string and var name as args * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert" * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line * BUG/MINOR: server: Init params before parsing a new server-state line * BUG/MINOR: http-rules: Always replace the response status on a return action * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ(). * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions * BUG/MINOR: sample: Always consider zero size string samples as unsafe * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust() * BUG/MINOR: checks: properly handle wrapping time in __health_adjust() * BUG/MINOR: session: atomically increment the tracked sessions counter * BUG/MINOR: server: Remove RMAINT from admin state when loading server state * CLEANUP: channel: fix comment in ci_putblk. * DOC: tune: explain the origin of block size for ssl.cachesize * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines * BUG/MINOR: stats: revert the change on ST_CONVDONE * BUG/MEDIUM: config: don't pick unset values from last defaults section * CLEANUP: deinit: release global and per-proxy server-state variables on deinit * BUG/MINOR: server: Fix server-state-file-name directive * BUG/MINOR: backend: hold correctly lock when killing idle conn * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints() * BUG/MINOR: server: re-align state file fields number * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors * BUG/MINOR: intops: fix mul32hi()'s off-by-one * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro * MINOR: check: do not ignore a connection header for http-check send - Update to version 2.3.7+git0.2d39ce334: * [RELEASE] Released version 2.3.7 * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames * MINOR: resolvers: Don't try to match immediatly renewed ADD items * MINOR: resolvers: Use milliseconds for cached items in resolver responses * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible * MINOR: resolvers: Add function to change the srv status based on SRV resolution * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error * MINOR: resolvers: Use a function to remove answers attached to a resolution * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item * MINOR: resolvers: new function find_srvrq_answer_record() * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item * BUG/MEDIUM: resolvers: Don't set an address-less server as UP * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution * BUG/MINOR: resolvers: Reset server address on DNS error only on status change * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record" * CLEANUP: tcp-rules: add missing actions in the tcp-request error message * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check * BUG/MINOR: session: Add some forgotten tests on session's listener * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw() * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc. * OPTIM: task: automatically adjust the default runqueue-depth to the threads * MINOR: task: give the scheduler a bit more flexibility in the runqueue size * MEDIUM: task: remove the tasks_run_queue counter and have one per thread * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1 * MINOR: task: add an application specific flag to the state: TASK_F_USR1 * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake * MINOR: ssl: mark the SSL handshake tasklet as heavy * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY * MEDIUM: backend: use a trylock when trying to grab an idle connection * MINOR: pools: double the local pool cache size to 1 MB * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS * MEDIUM: streams: do not use the streams lock anymore * MINOR: streams: use one list per stream instead of a global one * MINOR: cli/streams: make "show sess" dump all streams till the new epoch * MINOR: stream: add an "epoch" to figure which streams appeared when * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait * MINOR: dynbuf: make the buffer wait queue per thread * OPTIM: lb-leastconn: do not unlink the server if it did not change * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock * MINOR: server: move actconns to the per-thread structure * OPTIM: server: switch the actconn list to an mt-list * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4 * MINOR: tasks: refine the default run queue depth * BUG/MEDIUM: session: NULL dereference possible when accessing the listener * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs * MINOR: atomic: add armv8.1-a atomics variant for cas-dw * BUG/MINOR: mt-list: always perform a cpu_relax call on failure * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring() * BUG/MINOR: backend: fix condition for reuse on mode HTTP - Update to version 2.3.8+git0.e572195c7: * [RELEASE] Released version 2.3.8 * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters * MINOR: tools: make url2ipv4 return the exact number of bytes parsed * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available. * CLEANUP: fd: remove unused fd_set_running_excl() * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete() * MINOR: fd: remove the unneeded running bit from fd_insert() * MINOR: fd: make fd_clr_running() return the remaining running mask * BUG/MEDIUM: lua: Always init the lua stack before referencing the context * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback * MINOR: lua: Slightly improve function dumping the lua traceback * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list" * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket * BUG/MINOR: protocol: add missing support of dgram unix socket. * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable * MINOR: time: also provide a global, monotonic global_now_ms timer * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback * BUG/MINOR: freq_ctr/threads: make use of the last updated global time * MINOR: time: export the global_now variable - Update to version 2.3.9+git1.afb63bc04: * BUILD: backend: fix build breakage in idle conn locking fix * [RELEASE] Released version 2.3.9 * BUG/MEDIUM: time: make sure to always initialize the global tick * BUG/MINOR: stats: Apply proper styles in HTML status page. * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent - Update to version 2.3.10+git0.4764f0e4e: * [RELEASE] Released version 2.3.10 * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush * BUG/MEDIUM: peers: re-work connection to new process during reload. * BUG/MINOR: peers: remove useless table check if initial resync is finished * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data * BUG/MINOR: mworker: don't use oldpids[] anymore for reload * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases * BUG/MEDIUM: config: fix cpu-map notation with both process and threads * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers * BUG/MINOR: server: free srv.lb_nodes in free_server * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received * BUG/MINOR: logs: Report the true number of retries if there was no connection * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check * MINOR: connection: Make bc_http_major compatible with tcp-checks * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections * MINOR: logs: Add support of checks as session origin to format lf strings * BUG/MINOR: checks: Set missing id to the dummy checks frontend * BUG/MEDIUM: threads: Ignore current thread to end its harmless period * DOC: ssl: Certificate hot update only works on fronted certificates * BUG/MEDIUM: sample: Fix adjusting size in field converter * MINOR: No longer rely on deprecated sample fetches for predefined ACLs * DOC: clarify that compression works for HTTP/2 * BUG/MINOR: tools: fix parsing "us" unit for timers * CONTRIB: halog: fix issue with array of type char * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one * BUG/MINOR: ssl: Fix update of default certificate * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS * BUG/MINOR: tcp: fix silent-drop workaround for IPv6 - Update to version 2.4.0+git0.6cbbecf09: https://www.haproxy.com/blog/announcing-haproxy-2-4/ for all the details see /usr/share/doc/packages/haproxy/CHANGELOG - refreshed patches to apply cleanly again haproxy-1.6.0-makefile_lib.patch haproxy-1.6.0-sec-options.patch lua54.patch - Update to version 2.4.1+git0.1ce7d4925: * [RELEASE] Released version 2.4.1 * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace * MINOR: mux-h2: obey http-ignore-probes during the preface * BUG/MINOR: stats: make "show stat typed desc" work again * CLEANUP: mux-h2/traces: better align user messages * MINOR: mux-h2/trace: report a few connection-level info during h2_init() * MINOR: connection: add helper conn_append_debug_info() * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers * BUG/MINOR: mux-h1: do not skip the error response on bad requests * MINOR: backend: only skip LB when there are actual connections * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue * CLEANUP: global: remove unused definition of stopping_task[] * BUG/MINOR: mworker: fix typo in chroot error message * BUG/MINOR: ssl: use atomic ops to update global shctx stats * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server' * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id * DOC: lua: Add a warning about buffers modification in HTTP * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item * BUG/MINOR: resolvers: answser item list was randomly purged or errors * CLEANUP: l7-retries: do not test the buffer before calling b_alloc() * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded * CLEANUP: pools: remove now unused seq and pool_free_list * BUG/MAJOR: pools: fix possible race with free() in the lockless variant * MEDIUM: pools: use a single pool_gc() function for locked and lockless * MINOR: pools: call malloc_trim() under thread isolation * MINOR: pools: do not maintain the lock during pool_flush() * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush() * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data * BUG/MEDIUM: compression: Properly get the next block to iterate on payload * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode" * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future * BUILD: make tune.ssl.keylog available again * DOC: use the req.ssl_sni in examples * MINOR: errors: allow empty va_args for diag variadic macro * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry * DOC/MINOR: move uuid in the configuration to the right alphabetical order * BUG/MINOR: vars: Be sure to have a session to get checks variables * CLEANUP: http-ana: Remove useless if statement about L7 retries * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree * BUG/MINOR: http: Missing calloc return value check in make_arg_list * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine * BUG/MINOR: peers: Missing calloc return value check in peers_register_table * BUG/MINOR: server: Missing calloc return value check in srv_parse_source * DOC: intro: Fix typo in starter guide * MINOR: cfgparse: Fail when encountering extra arguments in macro * MINOR: http-ana: Perform L7 retries because of status codes in response analyser * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers" * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter * BUILD/MINOR: opentracing: fixed build when using clang * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server' * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry - Update to version 2.4.2+git0.553dee326: * [RELEASE] Released version 2.4.2 * REGTESTS: add http scheme-based normalization test * MEDIUM: h2: apply scheme-based normalization on h2 requests * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests * MEDIUM: http: implement scheme-based normalization * MINOR: http: implement http_get_scheme * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules" * BUG/MINOR: cli: fix server name output in "show fd" * BUG/MEDIUM: sock: make sure to never miss early connection failures * DOC: stick-table: add missing documentation about gpt0 stored type * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types * BUG/MINOR: stick-table: fix several printf sign errors dumping tables * DOC: config: use CREATE USER for mysql-check * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution * BUG/MINOR: mqtt: Support empty client ID in CONNECT message * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules * BUILD: Makefile: fix linkage for Haiku. * BUG/MINOR: checks: return correct error code for srv_parse_agent_check * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response() * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response * BUG/MINOR: resolvers: Always attach server on matching record on resolution * CLEANUP: dns: Remove a forgotten debug message * DOC: config: Add missing actions in "tcp-request session" documentation * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules * REGTESTS: fix maxconn update with agent-check * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header * BUG/MINOR: server/cli: Fix locking in function processing "set server" command * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task() * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled * BUG/MINOR: server-state: load SRV resolution only if params match the config - Update to version 2.4.3+git0.4dd5a5a6c: CVE-2021-39240 CVE-2021-39241 CVE-2021-39242 (boo#1189366 boo#1189548 boo#1189549) * [RELEASE] Released version 2.4.3 * REGTESTS: add a test to prevent h2 desync attacks * BUG/MEDIUM: h2: give :authority precedence over Host * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax * MINOR: http: add a new function http_validate_scheme() to validate a scheme * DOC/MINOR: fix typo in management document * CLEANUP: assorted typo fixes in the code and comments * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued * DOC: config: Fix 'http-response send-spoe-group' documentation * DOC: Improve the lua documentation * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer * BUG/MINOR: buffer: fix buffer_dump() formatting * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure * ADMIN: dyncookie: implement a simple dynamic cookie calculator * MINOR: server: unmark deprecated on enable health/agent cli * BUG/MINOR: server: update last_change on maint->ready transitions too * BUG/MINOR: server: remove srv from px list on CLI 'add server' error * BUILD: opentracing: fixed build when using pkg-config utility * DOC: internals: document the FD takeover process * BUG/MINOR: fd: protect fd state harder against a concurrent takeover * BUG/MINOR: pollers: always program an update for migrated FDs * BUG/MINOR: poll: fix abnormally high skip_fd counter * BUG/MINOR: select: fix excess number of dead/skip reported * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover * BUG/MINOR: connection: Add missing error labels to conn_err_code_str * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called * BUG/MINOR: mux-h2: Obey dontlognull option during the preface * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests * BUG/MINOR: systemd: must check the configuration using -Ws * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree * BUG/MINOR: check: fix the condition to validate a port-less server * BUG/MINOR: stats: Add missing agent stats on servers * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request * BUILD/MINOR: memprof fix macOs build. * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected * BUILD: lua: silence a build warning with TCC * BUILD: add detection of missing important CFLAGS * BUG/MINOR: ssl: Default-server configuration ignored by server * MINOR: mux_h2: define config to disable h2 websocket support * BUILD: http_htx: fix ci compilation error with isdigit for Windows - Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877) * [RELEASE] Released version 2.4.4 * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive" * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer * CLEANUP: htx: remove comments about "must be < 256 MB" * BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB * DOC: configuration: remove wrong tcp-request examples in tcp-response * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser * CLEANUP: Add missing include guard to signal.h * BUG/MINOR: tools: Fix loop condition in dump_text() * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long * MINOR: time: add report_idle() to report process-wide idle time * BUG/MINOR: time: fix idle time computation for long sleeps * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords * MINOR: compiler: implement an ONLY_ONCE() macro * BUG/MINOR: base64: base64urldec() ignores padding in output size check * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions * MINOR: hlua: take the global Lua lock inside a global function * REGTESTS: abortonclose: after retries, 503 is expected, not close * REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2 * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path - Update to version 2.4.5+git0.e74a1b34b: * [RELEASE] Released version 2.4.5 * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue() * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing * MINOR: arg: Be able to forbid unresolved args when building an argument list * BUG/MAJOR: lua: use task_wakeup() to properly run a task once * BUG/MEDIUM: lua: fix wakeup condition from sleep() * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options * DOC: peers: fix doc "enable" statement on "peers" sections * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers" * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary * MINOR: htx: Add a function to know if the free space wraps * MINOR: htx: Add an HTX flag to know when a message is fragmented * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv() * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer * BUG/MINOR: stats: use refcount to protect dynamic server on dump * MINOR: server: return the next srv instance on free_server * BUG/MINOR: server: do not use refcount in free_server in stopping mode * MINOR: global: define MODE_STOPPING * MINOR: server: implement a refcount for dynamic servers * BUG/MINOR: http-ana: increment internal_errors counter on response error * BUG/MINOR: h1-htx: Fix a typo when request parser is reset * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero * BUG/MINOR: server: allow 'enable health' only if check configured * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl * BUILD: halog: fix a -Wundef warning on non-glibc systems * BUILD: compiler: fixed a missing test on defined(__GNUC__) * BUILD: fix dragonfly build again on __read_mostly * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var * BUG/MINOR: vars: truncate the variable name in error reports about scope. * BUG/MINOR: vars: properly set the argument parsing context in the expression * MINOR: sample: add missing ARGC_ entries * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity * BUILD: tools: properly guard __GLIBC__ with defined() * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef * IMPORT: slz: silence a build warning with -Wundef * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING * MINOR: proc: setting the process to produce a core dump on FreeBSD. * MINOR: tools: add FreeBSD support to get_exec_path() * BUILD: tools: get the absolute path of the current binary on NetBSD. * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set * BUG/MINOR: cli/payload: do not search for args inside payload * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation * DOC: management: certificate files must be sanitized before injection * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported * MINOR: pools: use mallinfo2() when available instead of mallinfo() * MINOR: pools: automatically disable malloc_trim() with external allocators * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools() * BUG/MINOR: compat: make sure __WORDSIZE is always defined * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload * MINOR: htx: Skip headers with no value when adding a header list to a message * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload * BUG/MINOR: systemd: ExecStartPre must use -Ws * BUG/MINOR: filters: Set right FLT_END analyser depending on channel * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered * BUG/MINOR: lua: Don't yield in channel.append() and channel.set() * BUG/MINOR: lua: Yield in channel functions only if lua context can yield * MINOR: lua: Add a flag on lua context to know the yield capability at run time - Update to version 2.4.6+git0.d83fd76a1: * [RELEASE] Released version 2.4.6 * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release - Update to version 2.4.7+git0.b5e51a5e2: * [RELEASE] Released version 2.4.7 * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule - Update to version 2.4.8+git0.d1f8d41e0: * [RELEASE] Released version 2.4.8 * SCRIPTS: git-show-backports: re-enable file-based filtering * DOC/peers: some grammar fixes for peers 2.1 spec * MINOR: stream: Improve dump of bogus streams * BUILD/MINOR: cpuset freebsd build fix * DOC: config: Fix alphabetical order of fc_* samples * BUG/MINOR: sample: fix backend direction flags consecutive to last fix * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration * MINOR: halog: Add support for extracting captures using -hdr * BUG/MINOR: halog: Add missing newlines in die() messages * CLEANUP: halog: Use consistent indentation in help() * MINOR: halog: Rename -qry to -query * DOC: halog: Move the `-qry` parameter into the correct section in help text * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink * MEDIUM: resolvers: remove the last occurrences of the "safe" argument * MEDIUM: resolvers: use a kill list to preserve the list consistency * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters * CLEANUP: always initialize the answer_list * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records() * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed * BUILD: atomic: fix build on mac/arm64 * BUG/MINOR: backend: fix improper insert in avail tree for always reuse * BUILD: fix compilation on NetBSD * MINOR: memprof: add one pointer size to the size of allocations * MINOR: memprof: report the delta between alloc and free on realloc() * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame * BUG/MINOR: task: do not set TASK_F_USR1 for no reason * BUG/MAJOR: buf: fix varint API post- vs pre- increment * BUG/MEDIUM: resolvers: always check a valid item in query_list * BUILD: resolvers: avoid a possible warning on null-deref * BUG/MAJOR: resolvers: add other missing references during resolution removal * MINOR: resolvers: merge address and target into a union "data" * BUG/MEDIUM: resolvers: use correct storage for the target address * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records * BUG/MEDIUM: resolver: make sure to always use the correct hostname length * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier * BUG/MAJOR: dns: tcp session can remain attached to a list after a free * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors * Revert "CLEANUP: server: always include the storage for SSL settings" * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back * MINOR: initcall: Rename __GLOBL and __GLOBL1. * DOC: configuration: add clarification on escaping in keyword arguments * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames * BUG/MEDIUM: sample: properly verify that variables cast to sample * MINOR: sample: provide a generic var-to-sample conversion function * CLEANUP: sample: uninline sample_conv_var2smp_str() * CLEANUP: sample: rename sample_conv_var2smp() to *_sint * CLEANUP: server: always include the storage for SSL settings - (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header o Apply upstream patch: 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch - VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181) o Apply upstream patch: 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch - VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132) o Apply upstream patch: 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - The output buffer is not zero-initialized. If we don't clear reserved bytes, fcgi requests sent to backend will leak sensitive data. o Apply proposed patch: 0001-output-buffer-is-not-zero-initialized.path - ECO: Maint: Update haproxy to latest maintenance release for all SLE15 (jsc#PED-3821) - rebase and rename haproxy-1.6.0-sec-options.patch -> haproxy-2.4.22-sec-options.patch - remove patches covered by new release: lua54.patch 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch 0001-output-buffer-is-not-zero-initialized.path 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - Update to version 2.4.22+git0.f8e3218e2: * [RELEASE] Released version 2.4.22 * BUG/CRITICAL: http: properly reject empty http header field names * CI: github: don't warn on deprecated openssl functions on windows * BUG/MEDIUM: stconn: Schedule a shutw on shutr if data must be sent first * DOC: proxy-protocol: fix wrong byte in provided example * DOC: config: 'http-send-name-header' option may be used in default section * DOC: config: fix option spop-check proxy compatibility * BUG/MEDIUM: cache: use the correct time reference when comparing dates * BUG/MEDIUM: stick-table: do not leave entries in end of window during purge * BUG/MINOR: ssl/crt-list: warn when a line is malformated * BUG/MEDIUM: ssl: wrong eviction from the session cache tree * BUG/MINOR: fcgi-app: prevent 'use-fcgi-app' in default section * [RELEASE] Released version 2.4.21 * BUG/MINOR: sink: free the forwarding task on exit * BUILD: hpack: include global.h for the trash that is needed in debug mode * BUG/MINOR: mux-h2: add missing traces on failed headers decoding * BUG/MINOR: listener: close tiny race between resume_listener() and stopping * DOC: config: fix "Address formats" chapter syntax * BUG/MINOR: mux-fcgi: Correctly set pathinfo * DOC: config: fix aliases for protocol prefixes "udp4@" and "udp6@" * DOC: config: fix wrong section number for "protocol prefixes" * BUG/MINOR: listeners: fix suspend/resume of inherited FDs * BUG/MINOR: http-ana: make set-status also update txn->status * BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state * BUG/MINOR: http-ana: Report SF_FINST_R flag on error waiting the request body * BUG/MINOR: promex: Don't forget to consume the request on error * BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action * BUG/MINOR: h1-htx: Remove flags about protocol upgrade on non-101 responses * CLEANUP: htx: fix a typo in an error message of http_str_to_htx * BUG/MINOR: http: Memory leak of http redirect rules' format string * REGTEST: fix the race conditions in hmac.vtc * REGTEST: fix the race conditions in digest.vtc * REGTEST: fix the race conditions in json_query.vtc * BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned * BUG/MINOR: http-fetch: Only fill txn status during prefetch if not already set * BUILD: makefile: sort the features list * BUILD: makefile: build the features list dynamically * BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats * BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set * BUG/MINOR: ssl: Fix memory leak of find_chain in ssl_sock_load_cert_chain * LICENSE: wurfl: clarify the dummy library license. * BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout * REGTESTS: startup: check maxconn computation * REGTESTS: fix the race conditions in iff.vtc * BUG/MAJOR: fcgi: Fix uninitialized reserved bytes * DOC: promex: Add missing backend metrics * MINOR: promex: introduce haproxy_backend_agg_check_status * BUG/MINOR: promex: create haproxy_backend_agg_server_status * BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers * BUG/MINOR: ssl: Fix potential overflow * BUG/MEDIUM: ssl: Verify error codes can exceed 63 * BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure * BUILD: peers: peers-t.h depends on stick-table-t.h * CI: github: change "ubuntu-latest" to "ubuntu-20.04" * BUG/MEDIIM: stconn: Flush output data before forwarding close to write side * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * [RELEASE] Released version 2.4.20 * Revert "CI: determine actual OpenSSL version dynamically" * Revert "CI: switch to the "latest" LibreSSL" * SCRIPTS: announce-release: add a link to the data plane API * DOC: config: clarify the -m dir and -m dom pattern matching methods * DOC: config: clarify the fact that "retries" is not just for connections * DOC: config: explain how default matching method for ACL works * DOC: config: mention that a single monitor-uri rule is supported * DOC: config: clarify the fact that SNI should not be used in HTTP scenarios * DOC: config: provide some configuration hints for "http-reuse" * Revert "BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action" * BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out * BUILD: http-htx: Silent build error about a possible NULL start-line * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * BUG/MINOR: log: fix parse_log_message rfc5424 size check * BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance * BUILD: listener: fix build warning on global_listener_rwlock without threads * BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns * BUILD: peers: Remove unused variables * BUG/MEDIUM: peers: messages about unkown tables not correctly ignored * BUG/MINOR: ssl: don't initialize the keylog callback when not required * BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists * BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task * BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes * BUG/MEDIUM: ring: fix creation of server in uninitialized ring * DOC: config: fix alphabetical ordering of global section * REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses * BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers * BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once * BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy * BUG/MINOR: resolvers: Set port before IP address when processing SRV records * BUG/MINOR: http-htx: Fix error handling during parsing http replies * BUG/MEDIUM: wdt/clock: properly handle early task hangs * CI: emit the compiler's version in the build reports * CI: switch to the "latest" LibreSSL * BUG/MINOR: ssl: ocsp structure not freed properly in case of error * BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer * CI: add monthly gcc cross compile jobs * BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting * BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task * BUG/MAJOR: stick-table: don't process store-response rules for applets * DOC: management: add forgotten "show startup-logs" * BUG/MINOR: stick-table: Use server_id instead of std_t_sint in process_store_rules() * CI: SSL: temporarily stick to LibreSSL=3.5.3 * CI: SSL: use proper version generating when "latest" semantic is used * BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers * BUG/MINOR: sink: Only use backend capability for the sink proxies * BUG/MEDIUM: compression: handle rewrite errors when updating response headers * BUG/MINOR: ring: Properly parse connect timeout * BUG/MINOR: log: Preserve message facility when the log target is a ring buffer * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py * BUG/MINOR: server: make sure "show servers state" hides private bits * BUG/MAJOR: stick-tables: do not try to index a server name for applets * DOC: configuration: missing 'if' in tcp-request content example * BUG/MINOR: backend: only enforce turn-around state when not redispatching * BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction * MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands * BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error * BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os * BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth() * BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os * BUG/MEDIUM: lua: handle stick table implicit arguments right. * BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure * DOC: config: Fix pgsql-check documentation to make user param mandatory * BUG/MINOR: checks: update pgsql regex on auth packet * [RELEASE] Released version 2.4.19 * BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree * REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies * BUG/MINOR: log: improper behavior when escaping log data * SCRIPTS: announce-release: update some URLs to https * BUILD: fd: fix a build warning on the DWCAS * BUG/MEDIUM: captures: free() an error capture out of the proxy lock * DOC: fix TOC in starter guide for subsection 3.3.8. Statistics * REGTESTS: ssl/log: test the log-forward with SSL * BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring. * REGTESTS: log: test the log-forward feature * REGTESTS: healthcheckmail: Relax matching on the healthcheck log message * BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN' * MINOR: listener: small API change * BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK * CI: cirrus-ci: bump FreeBSD image to 13-1 * BUG/MINOR: signals/poller: ensure wakeup from signals * BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals * BUG/MINOR: task: always reset a new tasklet's call date * BUG/MINOR: h1: Support headers case adjustment for TCP proxies * BUILD: makefile: enable crypt(3) for NetBSD * BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support * BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber * BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools * REGTESTS: http_request_buffer: Add a barrier to not mix up log messages * BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input * BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule) * BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets * BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date * BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress * BUG/MEDIUM: peers: Add connect and server timeut to peers proxy * BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode * DOC: configuration: do-resolve doesn't work with a port in the string * REGTESTS: Fix prometheus script to perform HTTP health-checks * BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect * BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config() * BUG/MAJOR: mworker: fix infinite loop on master with no proxies. * BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized * BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle * BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names * BUILD: http: silence an uninitialized warning affecting gcc-5 * BUG/MEDIUM: ring: fix too lax 'size' parser * BUILD: debug: silence warning on gcc-5 * BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq() * BUG/MEDIUM: poller: use fd_delete() to release the poller pipes * BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h * BUG/MINOR: sink: fix a race condition between the writer and the reader * BUG/MINOR: ring/cli: fix a race condition between the writer and the reader * BUG/MEDIUM: proxy: Perform a custom copy for default server settings * REORG: server: Export srv_settings_cpy() function * MINOR: server: Constify source server to copy its settings * BUG/MEDIUM: dns: Properly initialize new DNS session * BUG/MINOR: peers: Use right channel flag to consider the peer as connected * BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload * MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer * BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions * MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups * MINOR: http-htx: Use new HTTP functions for the scheme based normalization * BUG/MEDIUM: h1: Improve authority validation for CONNCET request * MINOR: http: Add function to detect default port * MINOR: http: Add function to get port part of a host * BUG/MEDIUM: mworker: use default maxconn in wait mode * [RELEASE] Released version 2.4.18 * BUG/MINOR: sockpair: wrong return value for fd_send_uxst() * BUG/MINOR: backend: Fallback on RR algo if balance on source is impossible * BUILD: add detection for unsupported compiler models * BUG/MEDIUM: mworker: proc_self incorrectly set crashes upon reload * REGTESTS: Fix some scripts to be compatible with 2.4 and prior * BUG/MINOR: tools: fix statistical_prng_range()'s output range * BUG/MEDIUM: tools: avoid calling dlsym() in static builds (try 2) * BUILD: makefile: Fix install(1) handling for OpenBSD/NetBSD/Solaris/AIX * BUG/MEDIUM: tools: avoid calling dlsym() in static builds * MEDIUM: mworker: set the iocb of the socketpair without using fd_insert() * BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send * BUG/MEDIUM: http-ana: Don't wait to have an empty buf to switch in TUNNEL state * BUG/MINOR: mux-h1: Be sure to commit htx changes in the demux buffer * REGTEESTS: filters: Fix CONNECT request in random-forwarding script * BUG/MEDIUM: http-fetch: Don't fetch the method if there is no stream * BUG/MINOR: http-htx: Fix scheme based normalization for URIs wih userinfo * BUG/MINOR: peers: fix possible NULL dereferences at config parsing * BUG/MINOR: http-act: Properly generate 103 responses when several rules are used * BUG/MINOR: http-check: Preserve headers if not redefined by an implicit rule * BUG/MINOR: peers/config: always fill the bind_conf's argument * MINOR: fd: Add BUG_ON checks on fd_insert() * CI: re-enable gcc asan builds * BUILD: Makefile: Add Lua 5.4 autodetect * BUG/MEDIUM: ssl/fd: unexpected fd close using async engine * MINOR: fd: add a new FD_DISOWN flag to prevent from closing a deleted FD * BUG/MINOR: http-fetch: Use integer value when possible in "method" sample fetch * BUG/MINOR: http-ana: Set method to HTTP_METH_OTHER when an HTTP txn is created * BUG/MINOR: ssl: Do not look for key in extra files if already in pem * MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames * BUG/MEDIUM: ssl/cli: crash when crt inserted into a crt-list * BUG/MINOR: tcp-rules: Make action call final on read error and delay expiration * BUG/MINOR: cli/stats: add missing trailing LF after "show info json" * BUG/MINOR: server: do not enable DNS resolution on disabled proxies * BUG/MINOR: cli/stats: add missing trailing LF after JSON outputs * REGTESTS: healthcheckmail: Relax health-check failure condition * REGTESTS: healthcheckmail: Update the test to be functionnal again * BUG/MINOR: checks: Properly handle email alerts in trace messages * BUG/MINOR: trace: Test server existence for health-checks to get proxy * BUG/MEDIUM: mailers: Set the object type for check attached to an email alert * BUILD: compiler: implement unreachable for older compilers too * REGTESTS: restrict_req_hdr_names: Extend supported versions * REGTESTS: http_abortonclose: Extend supported versions * BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cert I/O handler * BUG/MINOR: ssl_ckch: Dump cert transaction only once if show command yield * REGTESTS: http_request_buffer: Increase client timeout to wait "slow" clients * REGTESTS: abortonclose: Add a barrier to not mix up log messages * MEDIUM: http-ana: Always report rewrite failures as PRXCOND in logs * BUG/MEDIUM: ssl/crt-list: Rework 'add ssl crt-list' to handle full buffer cases * BUG/MEDIUM: ssl_ckch: Rework 'commit ssl cert' to handle full buffer cases * BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a cert entry * BUG/MEDIUM: ssl_ckch: Don't delete a cert entry if it is being modified * BUG/MINOR: ssl_ckch: Free error msg if commit changes on a cert entry fails * DOC: intro: adjust the numbering of paragrams to keep the output ordered * DOC: peers: fix port number and addresses on new peers section format * DOC: peers: clarify when entry expiration date is renewed. * DOC: peers: indicate that some server settings are not usable * SCRIPTS: make publish-release try to launch make-releases-json * SCRIPTS: add make-releases-json to recreate a releases.json file in download dirs * REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (2) * BUG/MEDIUM: sample: Fix adjusting size in word converter * BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section * BUG/MEDIUM: peers: fix segfault using multiple bind on peers sections * BUG/MEDIUM: resolvers: Don't defer resolutions release in deinit function * BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols * BUG/MEDIUM: tools: Fix `inet_ntop` usage in sa2str * CI: determine actual OpenSSL version dynamically * BUILD/MINOR: cpuset fix build for FreeBSD 13.1 * BUG/MINOR: peers: fix error reporting of "bind" lines * BUG/MINOR: cfgparse: abort earlier in case of allocation error * BUG/MINOR: check: Reinit the buffer wait list at the end of a check * BUG/MEDIUM: config: Reset outline buffer size on realloc error in readcfgfile() * REGTESTS: abortonclose: Fix some race conditions * BUG/MINOR: ssl: Fix crash when no private key is found in pem * MINOR: tools: add get_exec_path implementation for solaris based systems. * BUILD: fix build warning on solaris based systems with __maybe_unused. * MEDIUM: http-ana: Add a proxy option to restrict chars in request header names * CI: determine actual LibreSSL version dynamically * [RELEASE] Released version 2.4.17 * CLEANUP: mux-h1: Fix comments and error messages for global options * BUG/MEDIUM: wdt: don't trigger the watchdog when p is unitialized * BUG/MINOR: conn_stream: do not confirm a connection from the frontend path * BUG/MINOR: server: Make SRV_STATE_LINE_MAXLEN value from 512 to 2kB (2000 bytes). * DOC: install: update gcc version requirements * BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-( * BUILD: listener: shut report of possible null-deref in listener_accept() * BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings * BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation * CI: dynamically determine actual version of h2spec * DOC: fix typo "ant" for "and" in INSTALL * BUG/MINOR: map/cli: make sure patterns don't vanish under "show map"'s init * BUG/MINOR: map/cli: protect the backref list during "show map" errors * BUG/MEDIUM: cli: make "show cli sockets" really yield * BUG/MEDIUM: resolvers: make "show resolvers" properly yield * BUG/MINOR: tcp/http: release the expr of set-{src,dst}[-port] * DOC: config: Update doc for PR/PH session states to warn about rewrite failures * MINOR: mux-h2: report a trace event when failing to create a new stream * BUG/MINOR: mux-h2: mark the stream as open before processing it not after * BUG/MAJOR: dns: multi-thread concurrency issue on UDP socket * BUG/MEDIUM: mux-h1: Be able to handle trailers when C-L header was specified * BUG/MEDIUM: mux-fcgi: Be sure to never set EOM flag on an empty HTX message * SCRIPTS: announce-release: add URL of dev packages * CI: github actions: update LibreSSL to 3.5.2 * [RELEASE] Released version 2.4.16 * BUILD: opentracing: Fix OT build due to misuse of var_clear() * BUILD: proto_uxst: do not set unused flag * BUILD: sockpair: do not set unused flag * BUILD: fd: remove unused variable totlen in fd_write_frag_line() * CLEANUP: acl: Remove unused variable when releasing an acl expression * BUG/MINOR: pools: make sure to also destroy shared pools in pool_destroy_all() * BUG/MINOR: resolvers: Fix memory leak in resolvers_deinit() * BUILD: compiler: properly distinguish weak and global symbols * REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc * MEDIUM: queue: use tasklet_instant_wakeup() to wake tasks * MINOR: task: add a new task_instant_wakeup() function * BUG/MINOR: rules: Fix check_capture() function to use the right rule arguments * DOC: remove my name from the config doc * BUG/MAJOR: connection: Never remove connection from idle lists outside the lock * BUG/MINOR: cache: Disable cache if applet creation fails * SCRIPTS: announce-release: add shortened links to pending issues * DOC: lua: update a few doc URLs * SCRIPTS: announce-release: update the doc's URL * BUG/MEDIUM: compression: Don't forget to update htx_sl and http_msg flags * BUG/MEDIUM: fcgi-app: Use http_msg flags to know if C-L header can be added * BUG/MEDIUM: stream: do not abort connection setup too early * BUILD: compiler: use a more portable set of asm(".weak") statements * BUILD: sched: workaround crazy and dangerous warning in Clang 14 * BUG/MEDIUM: mux-h1: Don't request more room on partial trailers * BUG/MINOR: mux-h2: use timeout http-request as a fallback for http-keep-alive * BUG/MINOR: mux-h2: do not use timeout http-keep-alive on backend side * BUILD: debug: mark the __start_mem_stats/__stop_mem_stats symbols as weak * BUG/MINOR: cache: do not display expired entries in "show cache" * BUG/MINOR: mux-h2: do not send GOAWAY if SETTINGS were not sent * CI: cirrus: switch to FreeBSD-13.0 * CI: Update to actions/cache@v3 * CI: Update to actions/checkout@v3 * DEBUG: opentracing: show return values of all functions in the debug output * CLEANUP: opentracing: added variable to store variable length * CLEANUP: opentracing: added flt_ot_smp_init() function * CLEANUP: opentracing: removed unused function flt_ot_var_get() * CLEANUP: opentracing: removed unused function flt_ot_var_unset() * DOC: opentracing: corrected comments in function descriptions * EXAMPLES: opentracing: refined shell scripts for testing filter performance * BUG/MINOR: opentracing: setting the return value in function flt_ot_var_set() * BUG/MEDIUM: http-act: Don't replace URI if path is not found or invalid * BUG/MEDIUM: http-conv: Fix url_enc() to not crush const samples * BUG/MEDIUM: mux-h1: Set outgoing message to DONE when payload length is reached * BUG/MEDIUM: promex: Be sure to never set EOM flag on an empty HTX message * BUG/MEDIUM: hlua: Don't set EOM flag on an empty HTX message in HTTP applet * BUG/MEDIUM: stats: Be sure to never set EOM flag on an empty HTX message * BUG/MINOR: fcgi-app: Don't add C-L header on response to HEAD requests * CI: github actions: update OpenSSL to 3.0.2 * BUG/MAJOR: mux_pt: always report the connection error to the conn_stream * BUG/MINOR: cli/stream: fix "shutdown session" to iterate over all threads * BUG/MINOR: samples: add missing context names for sample fetch functions * DOC: reflect H2 timeout changes * BUG/MEDIUM: mux-h2: make use of http-request and keep-alive timeouts * MEDIUM: mux-h2: slightly relax timeout management rules * BUG/MEDIUM: stream-int: do not rely on the connection error once established * BUG/MEDIUM: mux-h1: Properly detect full buffer cases during message parsing * BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing * BUG/MINOR: tools: url2sa reads too far when no port nor path * DOC: config: Explictly add supported MQTT versions * MEDIUM: mqtt: support mqtt_is_valid and mqtt_field_value converters for MQTTv3.1 * BUG/MEDIUM: trace: avoid race condition when retrieving session from conn->owner * BUG/MEDIUM: mux-h1: only turn CO_FL_ERROR to CS_FL_ERROR with empty ibuf * CI: github actions: switch to LibreSSL-3.5.1 * BUG/MINOR: server/ssl: free the SNI sample expression * BUG/MINOR: tools: fix url2sa return value with IPv4 * [RELEASE] Released version 2.4.15 * BUILD: tree-wide: mark a few numeric constants as explicitly long long * DOC: Fix usage/examples of deprecated ACLs * BUG/MINOR: stream: make the call_rate only count the no-progress calls * BUG/MINOR: session: fix theoretical risk of memleak in session_accept_fd() * BUG/MAJOR: mux-pt: Always destroy the backend connection on detach * DEBUG: stream: Fix stream trace message to print response buffer state * DEBUG: stream: Add the missing descriptions for stream trace events * BUG/MEDIUM: mcli: Properly handle errors and timeouts during reponse processing * DEBUG: cache: Update underlying buffer when loading HTX message in cache applet * BUG/MINOR: promex: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cache: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: stats: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: hlua: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cli: shows correct mode in "show sess" * BUG/MINOR: add missing modes in proxy_mode_str() * BUILD: pools: fix backport of no-memory-trimming on non-linux OS * MINOR: pools: add a new global option "no-memory-trimming" * BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed * BUG/MINOR: pool: always align pool_heads to 64 bytes * REGTESTS: fix the race conditions in secure_memcmp.vtc * REGTESTS: fix the race conditions in normalize_uri.vtc * BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks() * CI: github actions: use cache for SSL libs * CI: github actions: use cache for OpenTracing * CI: github actions: add OpenTracing builds * CI: github actions: add the output of $CC -dM -E- * [RELEASE] Released version 2.4.14 * BUG/MEDIUM: stream: Abort processing if response buffer allocation fails * CI: github: enable pool debugging by default * REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks * BUG/MINOR: proxy: preset the error message pointer to NULL in parse_new_proxy() * BUG/MAJOR: mux-h2: Be sure to always report HTX parsing error to the app layer * BUG/MEDIUM: mux-h1: Don't wake h1s if mux is blocked on lack of output buffer * BUG/MEDIUM: htx: Be sure to have a buffer to perform a raw copy of a message * BUG/MINOR: tools: url2sa reads ipv4 too far * BUG/MINOR: mailers: negotiate SMTP, not ESMTP * CI: github actions: update OpenSSL to 3.0.1 * CI: github: switch to OpenSSL 3.0.0 * CI: github actions: relax OpenSSL-3.0.0 version comparision * CI: github actions: -Wno-deprecated-declarations with OpenSSL 3.0.0 * CI: github actions: add OpenSSL-3.0.0 builds * BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2 * BUILD: fix compilation for OpenSSL-3.0.0-alpha17 * CI: ssl: keep the old method for ancient OpenSSL versions * CI: ssl: do not needlessly build the OpenSSL docs * CI: ssl: enable parallel builds for OpenSSL on Linux * BUG/MAJOR: compiler: relax alignment constraints on certain structures * BUG/MEDIUM: fd: always align fdtab[] to 64 bytes * BUG/MEDIUM: resolvers: Really ignore trailing dot in domain names * BUG/MINOR: sink: Use the right field in appctx context in release callback * BUG/MINOR: mworker: fix a FD leak of a sockpair upon a failed reload * BUG/MEDIUM: mworker: close unused transferred FDs on load failure * MINOR: sock: move the unused socket cleaning code into its own function * [RELEASE] Released version 2.4.13 * BUG/MINOR: mux-h2: update the session's idle delay before creating the stream * BUG/MEDIUM: h2/hpack: fix emission of HPACK DTSU after settings change * REGTESTS: peers: leave a bit more time to peers to synchronize * BUG/MAJOR: spoe: properly detach all agents when releasing the applet * BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies * BUG/MEDIUM: listener: read-lock the listener during accept() * MINOR: listener: replace the listener's spinlock with an rwlock * BUG/MINOR: mworker: does not erase the pidfile upon reload * BUG/MAJOR: sched: prevent rare concurrent wakeup of multi-threaded tasks * DEBUG: pools: replace the link pointer with the caller's address on pool_free() * DEBUG: pools: let's add reverse mapping from cache heads to thread and pool * DEBUG: pools: add extra sanity checks when picking objects from a local cache * BUG/MINOR: pools: always flush pools about to be destroyed * BUG/MEDIUM: mworker: don't lose the stats socket on failed reload * DEBUG: pools: add new build option DEBUG_POOL_INTEGRITY * BUILD: debug/cli: condition test of O_ASYNC to its existence * DEBUG: cli: add a new "debug dev fd" expert command * MEDIUM: h2/hpack: emit a Dynamic Table Size Update after settings change * BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them * BUG/MEDIUM: mcli: do not try to parse empty buffers * BUG/MEDIUM: cli: Never wait for more data on client shutdown * BUG/MINOR: cli: avoid O(bufsize) parsing cost on pipelined commands * MINOR: channel: add new function co_getdelim() to support multiple delimiters * MEDIUM: cli: yield between each pipelined command * BUG/MEDIUM: server: avoid changing healthcheck ctx with set server ssl * BUILD/MINOR: fix solaris build with clang. * BUG/MEDIUM: htx: Adjust length to add DATA block in an empty HTX buffer * BUG/MEDIUM: connection: properly leave stopping list on error * [RELEASE] Released version 2.4.12 * BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data * BUG/MEDIUM: mworker: don't use _getsocks in wait mode * [RELEASE] Released version 2.4.11 * BUG/MEDIUM: http-ana: Preserve response's FLT_END analyser on L7 retry * BUG/MINOR: cli: fix _getsocks with musl libc * BUILD/MINOR: tools: solaris build fix on dladdr. * BUILD/MINOR: cpuset FreeBSD 14 build fix. * BUG/MEDIUM: ssl: free the ckch instance linked to a server * BUG/MINOR: ssl: free the fields in srv->ssl_ctx * MINOR: debug: add support for -dL to dump library names at boot * MINOR: debug: add ability to dump loaded shared libraries * MINOR: compat: detect support for dl_iterate_phdr() * BUG/MINOR: mux-h1: Fix splicing for messages with unknown length * BUG/MEDIUM: mux-h1: Fix splicing by properly detecting end of message * BUILD: makefile: add -Wno-atomic-alignment to work around clang abusive warning * MINOR: proxy: add option idle-close-on-response * REGTESTS: ssl: fix ssl_default_server.vtc * BUG/MEDIUM: ssl: initialize correctly ssl w/ default-server * DOC: fix misspelled keyword "resolve_retries" in resolvers * BUILD: ssl: unbreak the build with newer libressl * BUILD: cli: clear a maybe-unused warning on some older compilers * BUG/MINOR: pools: don't mark ourselves as harmless in DEBUG_UAF mode * BUG/MEDIUM: backend: fix possible sockaddr leak on redispatch * [RELEASE] Released version 2.4.10 * BUG/MINOR: backend: restore the SF_SRV_REUSED flag original purpose * BUG/MINOR: backend: do not set sni on connection reuse * MINOR: pools: work around possibly slow malloc_trim() during gc * BUG/MEDIUM: mworker/cli: crash when trying to access an old PID in prompt mode * DOC: config: retry-on list is space-delimited * DOC: config: Specify %Ta is only available in HTTP mode * DOC: spoe: Clarify use of the event directive in spoe-message section * BUG/MINOR: cli/server: Don't crash when a server is added with a custom id * IMPORT: slz: use the correct CRC32 instruction when running in 32-bit mode * BUILD: tree-wide: avoid warnings caused by redundant checks of obj_types * MINOR: cli: "show version" displays the current process version * CI: Github Actions: temporarily disable BoringSSL builds * BUILD: bug: Fix error when compiling with -DDEBUG_STRICT_NOCRASH * MINOR: mux-h1: Improve H1 traces by adding info about http parsers * BUG/MAJOR: segfault using multiple log forward sections. * BUG/MEDIUM: resolvers: Detach query item on response error * BUG/MINOR: server: Don't rely on last default-server to init server SSL context * BUG/MEDIUM: cli: Properly set stream analyzers to process one command at a time * BUILD/MINOR: server: fix compilation without SSL * [RELEASE] Released version 2.4.9 * BUG/MINOR: cache: Fix loop on cache entries in "show cache" * MINOR: promex: backend aggregated server check status * MINOR: server: add ws keyword * MEDIUM: server/backend: implement websocket protocol selection * MINOR: connection: add alternative mux_ops param for conn_install_mux_be * MINOR: connection: implement function to update ALPN * MINOR: stream/mux: implement websocket stream flag * BUG/MINOR: ssl: make SSL counters atomic * MINOR: shctx: add a few BUG_ON() for consistency checks * BUG/MINOR: shctx: do not look for available blocks when the first one is enough * BUG/MEDIUM: shctx: leave the block allocator when enough blocks are found * BUG/MEDIUM: cache/cli: make "show cache" thread-safe * BUG/MEDIUM: mux-h2: always process a pending shut read * BUG/MEDIUM: ssl: abort with the correct SSL error when SNI not found * CLEANUP: ssl: fix wrong #else commentary * BUG/MINOR: ssl: free correctly the sni in the backend SSL cache * BUG/MEDIUM: ssl: backend TLS resumption with sni and TLSv1.3 * BUILD: makefile: simplify detection of libatomic * BUG/MEDIUM: mux-h1: Handle delayed silent shut in h1_process() to release H1C * BUG/MINOR: stick-table/cli: Check for invalid ipv6 key * BUG/MEDIUM: connection: make cs_shutr/cs_shutw//cs_close() idempotent * BUG/MINOR: mux-h2: Fix H2_CF_DEM_SHORT_READ value * BUG/MINOR: mworker: doesn't launch the program postparser * BUG/MEDIUM: conn-stream: Don't reset CS flags on close * MINOR: mux-h1: Slightly Improve H1 traces * DOC: lua: Be explicit with the Reply object limits * Revert "BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back" * BUG/MINOR: http-ana: Apply stop to the current section for http-response rules * DOC: config: Fix typo in ssl_fc_unique_id description * BUG/MINOR: cache: properly ignore unparsable max-age in quotes * BUG/MINOR: resolvers: throw log message if trash not large enough for query * BUG/MINOR: resolvers: fix sent messages were counted twice * BUG/MEDIUM: mux-h2: reject upgrade if no RFC8441 support * MINOR: mux-h2: add trace on extended connect usage * MINOR: mux-h2: perform a full cycle shutdown+drain on close * MINOR: connection: add a new CO_FL_WANT_DRAIN flag to force drain on close - VUL-0: CVE-2023-40225: haproxy: reject any empty content-length header value (bsc#1214102) Apply upstream patch adapted for 2.4.22 (patch h2_parse_cont_len_header() instead of http_parse_cont_len_header()) Add patch: 0001-BUG-MAJOR-http-reject-any-empty-content-length-heade.patch - VUL-0: CVE-2023-45539: haproxy: misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653) Apply upstream patch. Add patch: 0001-BUG-MINOR-h1-do-not-accept-as-part-of-the-URI-compon.patch - Update to version 2.3.6+git0.7851701ed: * [RELEASE] Released version 2.3.6 * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout * BUG/MINOR: mux-h2: Fix typo in scheme adjustment * DOC: spoe: Add a note about fragmentation support in HAProxy * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread > 1 * BUG/MINOR: connection: Use the client's dst family for adressless servers * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule * BUG/MINOR: http-ana: Only consider dst address to process originalto option * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf() * BUG/MINOR: stats: fix compare of no-maint url suffix * CLEANUP: muxes: Remove useless if condition in show_fd function * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup() * BUG/MEDIUM: resolvers: Reset address for unresolved servers * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records * BUG/MINOR: resolvers: new callback to properly handle SRV record errors * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl() * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe * BUG/MINOR: sample: secure convs that accept base64 string and var name as args * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert" * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line * BUG/MINOR: server: Init params before parsing a new server-state line * BUG/MINOR: http-rules: Always replace the response status on a return action * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ(). * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions * BUG/MINOR: sample: Always consider zero size string samples as unsafe * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust() * BUG/MINOR: checks: properly handle wrapping time in __health_adjust() * BUG/MINOR: session: atomically increment the tracked sessions counter * BUG/MINOR: server: Remove RMAINT from admin state when loading server state * CLEANUP: channel: fix comment in ci_putblk. * DOC: tune: explain the origin of block size for ssl.cachesize * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines * BUG/MINOR: stats: revert the change on ST_CONVDONE * BUG/MEDIUM: config: don't pick unset values from last defaults section * CLEANUP: deinit: release global and per-proxy server-state variables on deinit * BUG/MINOR: server: Fix server-state-file-name directive * BUG/MINOR: backend: hold correctly lock when killing idle conn * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints() * BUG/MINOR: server: re-align state file fields number * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors * BUG/MINOR: intops: fix mul32hi()'s off-by-one * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro * MINOR: check: do not ignore a connection header for http-check send - Update to version 2.3.7+git0.2d39ce334: * [RELEASE] Released version 2.3.7 * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames * MINOR: resolvers: Don't try to match immediatly renewed ADD items * MINOR: resolvers: Use milliseconds for cached items in resolver responses * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible * MINOR: resolvers: Add function to change the srv status based on SRV resolution * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error * MINOR: resolvers: Use a function to remove answers attached to a resolution * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item * MINOR: resolvers: new function find_srvrq_answer_record() * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item * BUG/MEDIUM: resolvers: Don't set an address-less server as UP * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution * BUG/MINOR: resolvers: Reset server address on DNS error only on status change * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record" * CLEANUP: tcp-rules: add missing actions in the tcp-request error message * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check * BUG/MINOR: session: Add some forgotten tests on session's listener * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw() * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc. * OPTIM: task: automatically adjust the default runqueue-depth to the threads * MINOR: task: give the scheduler a bit more flexibility in the runqueue size * MEDIUM: task: remove the tasks_run_queue counter and have one per thread * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1 * MINOR: task: add an application specific flag to the state: TASK_F_USR1 * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake * MINOR: ssl: mark the SSL handshake tasklet as heavy * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY * MEDIUM: backend: use a trylock when trying to grab an idle connection * MINOR: pools: double the local pool cache size to 1 MB * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS * MEDIUM: streams: do not use the streams lock anymore * MINOR: streams: use one list per stream instead of a global one * MINOR: cli/streams: make "show sess" dump all streams till the new epoch * MINOR: stream: add an "epoch" to figure which streams appeared when * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait * MINOR: dynbuf: make the buffer wait queue per thread * OPTIM: lb-leastconn: do not unlink the server if it did not change * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock * MINOR: server: move actconns to the per-thread structure * OPTIM: server: switch the actconn list to an mt-list * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4 * MINOR: tasks: refine the default run queue depth * BUG/MEDIUM: session: NULL dereference possible when accessing the listener * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs * MINOR: atomic: add armv8.1-a atomics variant for cas-dw * BUG/MINOR: mt-list: always perform a cpu_relax call on failure * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring() * BUG/MINOR: backend: fix condition for reuse on mode HTTP - Update to version 2.3.8+git0.e572195c7: * [RELEASE] Released version 2.3.8 * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters * MINOR: tools: make url2ipv4 return the exact number of bytes parsed * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available. * CLEANUP: fd: remove unused fd_set_running_excl() * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete() * MINOR: fd: remove the unneeded running bit from fd_insert() * MINOR: fd: make fd_clr_running() return the remaining running mask * BUG/MEDIUM: lua: Always init the lua stack before referencing the context * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback * MINOR: lua: Slightly improve function dumping the lua traceback * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list" * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket * BUG/MINOR: protocol: add missing support of dgram unix socket. * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable * MINOR: time: also provide a global, monotonic global_now_ms timer * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback * BUG/MINOR: freq_ctr/threads: make use of the last updated global time * MINOR: time: export the global_now variable - Update to version 2.3.9+git1.afb63bc04: * BUILD: backend: fix build breakage in idle conn locking fix * [RELEASE] Released version 2.3.9 * BUG/MEDIUM: time: make sure to always initialize the global tick * BUG/MINOR: stats: Apply proper styles in HTML status page. * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent - Update to version 2.3.10+git0.4764f0e4e: * [RELEASE] Released version 2.3.10 * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush * BUG/MEDIUM: peers: re-work connection to new process during reload. * BUG/MINOR: peers: remove useless table check if initial resync is finished * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data * BUG/MINOR: mworker: don't use oldpids[] anymore for reload * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases * BUG/MEDIUM: config: fix cpu-map notation with both process and threads * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers * BUG/MINOR: server: free srv.lb_nodes in free_server * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received * BUG/MINOR: logs: Report the true number of retries if there was no connection * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check * MINOR: connection: Make bc_http_major compatible with tcp-checks * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections * MINOR: logs: Add support of checks as session origin to format lf strings * BUG/MINOR: checks: Set missing id to the dummy checks frontend * BUG/MEDIUM: threads: Ignore current thread to end its harmless period * DOC: ssl: Certificate hot update only works on fronted certificates * BUG/MEDIUM: sample: Fix adjusting size in field converter * MINOR: No longer rely on deprecated sample fetches for predefined ACLs * DOC: clarify that compression works for HTTP/2 * BUG/MINOR: tools: fix parsing "us" unit for timers * CONTRIB: halog: fix issue with array of type char * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one * BUG/MINOR: ssl: Fix update of default certificate * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS * BUG/MINOR: tcp: fix silent-drop workaround for IPv6 - Update to version 2.4.0+git0.6cbbecf09: https://www.haproxy.com/blog/announcing-haproxy-2-4/ for all the details see /usr/share/doc/packages/haproxy/CHANGELOG - refreshed patches to apply cleanly again haproxy-1.6.0-makefile_lib.patch haproxy-1.6.0-sec-options.patch lua54.patch - Update to version 2.4.1+git0.1ce7d4925: * [RELEASE] Released version 2.4.1 * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace * MINOR: mux-h2: obey http-ignore-probes during the preface * BUG/MINOR: stats: make "show stat typed desc" work again * CLEANUP: mux-h2/traces: better align user messages * MINOR: mux-h2/trace: report a few connection-level info during h2_init() * MINOR: connection: add helper conn_append_debug_info() * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers * BUG/MINOR: mux-h1: do not skip the error response on bad requests * MINOR: backend: only skip LB when there are actual connections * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue * CLEANUP: global: remove unused definition of stopping_task[] * BUG/MINOR: mworker: fix typo in chroot error message * BUG/MINOR: ssl: use atomic ops to update global shctx stats * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server' * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id * DOC: lua: Add a warning about buffers modification in HTTP * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item * BUG/MINOR: resolvers: answser item list was randomly purged or errors * CLEANUP: l7-retries: do not test the buffer before calling b_alloc() * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded * CLEANUP: pools: remove now unused seq and pool_free_list * BUG/MAJOR: pools: fix possible race with free() in the lockless variant * MEDIUM: pools: use a single pool_gc() function for locked and lockless * MINOR: pools: call malloc_trim() under thread isolation * MINOR: pools: do not maintain the lock during pool_flush() * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush() * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data * BUG/MEDIUM: compression: Properly get the next block to iterate on payload * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode" * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future * BUILD: make tune.ssl.keylog available again * DOC: use the req.ssl_sni in examples * MINOR: errors: allow empty va_args for diag variadic macro * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry * DOC/MINOR: move uuid in the configuration to the right alphabetical order * BUG/MINOR: vars: Be sure to have a session to get checks variables * CLEANUP: http-ana: Remove useless if statement about L7 retries * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree * BUG/MINOR: http: Missing calloc return value check in make_arg_list * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine * BUG/MINOR: peers: Missing calloc return value check in peers_register_table * BUG/MINOR: server: Missing calloc return value check in srv_parse_source * DOC: intro: Fix typo in starter guide * MINOR: cfgparse: Fail when encountering extra arguments in macro * MINOR: http-ana: Perform L7 retries because of status codes in response analyser * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers" * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter * BUILD/MINOR: opentracing: fixed build when using clang * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server' * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry - Update to version 2.4.2+git0.553dee326: * [RELEASE] Released version 2.4.2 * REGTESTS: add http scheme-based normalization test * MEDIUM: h2: apply scheme-based normalization on h2 requests * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests * MEDIUM: http: implement scheme-based normalization * MINOR: http: implement http_get_scheme * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules" * BUG/MINOR: cli: fix server name output in "show fd" * BUG/MEDIUM: sock: make sure to never miss early connection failures * DOC: stick-table: add missing documentation about gpt0 stored type * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types * BUG/MINOR: stick-table: fix several printf sign errors dumping tables * DOC: config: use CREATE USER for mysql-check * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution * BUG/MINOR: mqtt: Support empty client ID in CONNECT message * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules * BUILD: Makefile: fix linkage for Haiku. * BUG/MINOR: checks: return correct error code for srv_parse_agent_check * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response() * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response * BUG/MINOR: resolvers: Always attach server on matching record on resolution * CLEANUP: dns: Remove a forgotten debug message * DOC: config: Add missing actions in "tcp-request session" documentation * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules * REGTESTS: fix maxconn update with agent-check * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header * BUG/MINOR: server/cli: Fix locking in function processing "set server" command * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task() * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled * BUG/MINOR: server-state: load SRV resolution only if params match the config - Update to version 2.4.3+git0.4dd5a5a6c: CVE-2021-39240 CVE-2021-39241 CVE-2021-39242 (boo#1189366 boo#1189548 boo#1189549) * [RELEASE] Released version 2.4.3 * REGTESTS: add a test to prevent h2 desync attacks * BUG/MEDIUM: h2: give :authority precedence over Host * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax * MINOR: http: add a new function http_validate_scheme() to validate a scheme * DOC/MINOR: fix typo in management document * CLEANUP: assorted typo fixes in the code and comments * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued * DOC: config: Fix 'http-response send-spoe-group' documentation * DOC: Improve the lua documentation * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer * BUG/MINOR: buffer: fix buffer_dump() formatting * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure * ADMIN: dyncookie: implement a simple dynamic cookie calculator * MINOR: server: unmark deprecated on enable health/agent cli * BUG/MINOR: server: update last_change on maint->ready transitions too * BUG/MINOR: server: remove srv from px list on CLI 'add server' error * BUILD: opentracing: fixed build when using pkg-config utility * DOC: internals: document the FD takeover process * BUG/MINOR: fd: protect fd state harder against a concurrent takeover * BUG/MINOR: pollers: always program an update for migrated FDs * BUG/MINOR: poll: fix abnormally high skip_fd counter * BUG/MINOR: select: fix excess number of dead/skip reported * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover * BUG/MINOR: connection: Add missing error labels to conn_err_code_str * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called * BUG/MINOR: mux-h2: Obey dontlognull option during the preface * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests * BUG/MINOR: systemd: must check the configuration using -Ws * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree * BUG/MINOR: check: fix the condition to validate a port-less server * BUG/MINOR: stats: Add missing agent stats on servers * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request * BUILD/MINOR: memprof fix macOs build. * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected * BUILD: lua: silence a build warning with TCC * BUILD: add detection of missing important CFLAGS * BUG/MINOR: ssl: Default-server configuration ignored by server * MINOR: mux_h2: define config to disable h2 websocket support * BUILD: http_htx: fix ci compilation error with isdigit for Windows - Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877) * [RELEASE] Released version 2.4.4 * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive" * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer * CLEANUP: htx: remove comments about "must be < 256 MB" * BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB * DOC: configuration: remove wrong tcp-request examples in tcp-response * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser * CLEANUP: Add missing include guard to signal.h * BUG/MINOR: tools: Fix loop condition in dump_text() * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long * MINOR: time: add report_idle() to report process-wide idle time * BUG/MINOR: time: fix idle time computation for long sleeps * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords * MINOR: compiler: implement an ONLY_ONCE() macro * BUG/MINOR: base64: base64urldec() ignores padding in output size check * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions * MINOR: hlua: take the global Lua lock inside a global function * REGTESTS: abortonclose: after retries, 503 is expected, not close * REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2 * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path - Update to version 2.4.5+git0.e74a1b34b: * [RELEASE] Released version 2.4.5 * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue() * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing * MINOR: arg: Be able to forbid unresolved args when building an argument list * BUG/MAJOR: lua: use task_wakeup() to properly run a task once * BUG/MEDIUM: lua: fix wakeup condition from sleep() * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options * DOC: peers: fix doc "enable" statement on "peers" sections * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers" * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary * MINOR: htx: Add a function to know if the free space wraps * MINOR: htx: Add an HTX flag to know when a message is fragmented * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv() * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer * BUG/MINOR: stats: use refcount to protect dynamic server on dump * MINOR: server: return the next srv instance on free_server * BUG/MINOR: server: do not use refcount in free_server in stopping mode * MINOR: global: define MODE_STOPPING * MINOR: server: implement a refcount for dynamic servers * BUG/MINOR: http-ana: increment internal_errors counter on response error * BUG/MINOR: h1-htx: Fix a typo when request parser is reset * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero * BUG/MINOR: server: allow 'enable health' only if check configured * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl * BUILD: halog: fix a -Wundef warning on non-glibc systems * BUILD: compiler: fixed a missing test on defined(__GNUC__) * BUILD: fix dragonfly build again on __read_mostly * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var * BUG/MINOR: vars: truncate the variable name in error reports about scope. * BUG/MINOR: vars: properly set the argument parsing context in the expression * MINOR: sample: add missing ARGC_ entries * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity * BUILD: tools: properly guard __GLIBC__ with defined() * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef * IMPORT: slz: silence a build warning with -Wundef * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING * MINOR: proc: setting the process to produce a core dump on FreeBSD. * MINOR: tools: add FreeBSD support to get_exec_path() * BUILD: tools: get the absolute path of the current binary on NetBSD. * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set * BUG/MINOR: cli/payload: do not search for args inside payload * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation * DOC: management: certificate files must be sanitized before injection * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported * MINOR: pools: use mallinfo2() when available instead of mallinfo() * MINOR: pools: automatically disable malloc_trim() with external allocators * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools() * BUG/MINOR: compat: make sure __WORDSIZE is always defined * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload * MINOR: htx: Skip headers with no value when adding a header list to a message * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload * BUG/MINOR: systemd: ExecStartPre must use -Ws * BUG/MINOR: filters: Set right FLT_END analyser depending on channel * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered * BUG/MINOR: lua: Don't yield in channel.append() and channel.set() * BUG/MINOR: lua: Yield in channel functions only if lua context can yield * MINOR: lua: Add a flag on lua context to know the yield capability at run time - Update to version 2.4.6+git0.d83fd76a1: * [RELEASE] Released version 2.4.6 * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release - Update to version 2.4.7+git0.b5e51a5e2: * [RELEASE] Released version 2.4.7 * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule - Update to version 2.4.8+git0.d1f8d41e0: * [RELEASE] Released version 2.4.8 * SCRIPTS: git-show-backports: re-enable file-based filtering * DOC/peers: some grammar fixes for peers 2.1 spec * MINOR: stream: Improve dump of bogus streams * BUILD/MINOR: cpuset freebsd build fix * DOC: config: Fix alphabetical order of fc_* samples * BUG/MINOR: sample: fix backend direction flags consecutive to last fix * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration * MINOR: halog: Add support for extracting captures using -hdr * BUG/MINOR: halog: Add missing newlines in die() messages * CLEANUP: halog: Use consistent indentation in help() * MINOR: halog: Rename -qry to -query * DOC: halog: Move the `-qry` parameter into the correct section in help text * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink * MEDIUM: resolvers: remove the last occurrences of the "safe" argument * MEDIUM: resolvers: use a kill list to preserve the list consistency * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters * CLEANUP: always initialize the answer_list * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records() * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed * BUILD: atomic: fix build on mac/arm64 * BUG/MINOR: backend: fix improper insert in avail tree for always reuse * BUILD: fix compilation on NetBSD * MINOR: memprof: add one pointer size to the size of allocations * MINOR: memprof: report the delta between alloc and free on realloc() * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame * BUG/MINOR: task: do not set TASK_F_USR1 for no reason * BUG/MAJOR: buf: fix varint API post- vs pre- increment * BUG/MEDIUM: resolvers: always check a valid item in query_list * BUILD: resolvers: avoid a possible warning on null-deref * BUG/MAJOR: resolvers: add other missing references during resolution removal * MINOR: resolvers: merge address and target into a union "data" * BUG/MEDIUM: resolvers: use correct storage for the target address * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records * BUG/MEDIUM: resolver: make sure to always use the correct hostname length * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier * BUG/MAJOR: dns: tcp session can remain attached to a list after a free * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors * Revert "CLEANUP: server: always include the storage for SSL settings" * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back * MINOR: initcall: Rename __GLOBL and __GLOBL1. * DOC: configuration: add clarification on escaping in keyword arguments * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames * BUG/MEDIUM: sample: properly verify that variables cast to sample * MINOR: sample: provide a generic var-to-sample conversion function * CLEANUP: sample: uninline sample_conv_var2smp_str() * CLEANUP: sample: rename sample_conv_var2smp() to *_sint * CLEANUP: server: always include the storage for SSL settings - (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header o Apply upstream patch: 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch - VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181) o Apply upstream patch: 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch - VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132) o Apply upstream patch: 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - The output buffer is not zero-initialized. If we don't clear reserved bytes, fcgi requests sent to backend will leak sensitive data. o Apply proposed patch: 0001-output-buffer-is-not-zero-initialized.path - ECO: Maint: Update haproxy to latest maintenance release for all SLE15 (jsc#PED-3821) - rebase and rename haproxy-1.6.0-sec-options.patch -> haproxy-2.4.22-sec-options.patch - remove patches covered by new release: lua54.patch 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch 0001-output-buffer-is-not-zero-initialized.path 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - Update to version 2.4.22+git0.f8e3218e2: * [RELEASE] Released version 2.4.22 * BUG/CRITICAL: http: properly reject empty http header field names * CI: github: don't warn on deprecated openssl functions on windows * BUG/MEDIUM: stconn: Schedule a shutw on shutr if data must be sent first * DOC: proxy-protocol: fix wrong byte in provided example * DOC: config: 'http-send-name-header' option may be used in default section * DOC: config: fix option spop-check proxy compatibility * BUG/MEDIUM: cache: use the correct time reference when comparing dates * BUG/MEDIUM: stick-table: do not leave entries in end of window during purge * BUG/MINOR: ssl/crt-list: warn when a line is malformated * BUG/MEDIUM: ssl: wrong eviction from the session cache tree * BUG/MINOR: fcgi-app: prevent 'use-fcgi-app' in default section * [RELEASE] Released version 2.4.21 * BUG/MINOR: sink: free the forwarding task on exit * BUILD: hpack: include global.h for the trash that is needed in debug mode * BUG/MINOR: mux-h2: add missing traces on failed headers decoding * BUG/MINOR: listener: close tiny race between resume_listener() and stopping * DOC: config: fix "Address formats" chapter syntax * BUG/MINOR: mux-fcgi: Correctly set pathinfo * DOC: config: fix aliases for protocol prefixes "udp4@" and "udp6@" * DOC: config: fix wrong section number for "protocol prefixes" * BUG/MINOR: listeners: fix suspend/resume of inherited FDs * BUG/MINOR: http-ana: make set-status also update txn->status * BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state * BUG/MINOR: http-ana: Report SF_FINST_R flag on error waiting the request body * BUG/MINOR: promex: Don't forget to consume the request on error * BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action * BUG/MINOR: h1-htx: Remove flags about protocol upgrade on non-101 responses * CLEANUP: htx: fix a typo in an error message of http_str_to_htx * BUG/MINOR: http: Memory leak of http redirect rules' format string * REGTEST: fix the race conditions in hmac.vtc * REGTEST: fix the race conditions in digest.vtc * REGTEST: fix the race conditions in json_query.vtc * BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned * BUG/MINOR: http-fetch: Only fill txn status during prefetch if not already set * BUILD: makefile: sort the features list * BUILD: makefile: build the features list dynamically * BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats * BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set * BUG/MINOR: ssl: Fix memory leak of find_chain in ssl_sock_load_cert_chain * LICENSE: wurfl: clarify the dummy library license. * BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout * REGTESTS: startup: check maxconn computation * REGTESTS: fix the race conditions in iff.vtc * BUG/MAJOR: fcgi: Fix uninitialized reserved bytes * DOC: promex: Add missing backend metrics * MINOR: promex: introduce haproxy_backend_agg_check_status * BUG/MINOR: promex: create haproxy_backend_agg_server_status * BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers * BUG/MINOR: ssl: Fix potential overflow * BUG/MEDIUM: ssl: Verify error codes can exceed 63 * BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure * BUILD: peers: peers-t.h depends on stick-table-t.h * CI: github: change "ubuntu-latest" to "ubuntu-20.04" * BUG/MEDIIM: stconn: Flush output data before forwarding close to write side * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * [RELEASE] Released version 2.4.20 * Revert "CI: determine actual OpenSSL version dynamically" * Revert "CI: switch to the "latest" LibreSSL" * SCRIPTS: announce-release: add a link to the data plane API * DOC: config: clarify the -m dir and -m dom pattern matching methods * DOC: config: clarify the fact that "retries" is not just for connections * DOC: config: explain how default matching method for ACL works * DOC: config: mention that a single monitor-uri rule is supported * DOC: config: clarify the fact that SNI should not be used in HTTP scenarios * DOC: config: provide some configuration hints for "http-reuse" * Revert "BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action" * BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out * BUILD: http-htx: Silent build error about a possible NULL start-line * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * BUG/MINOR: log: fix parse_log_message rfc5424 size check * BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance * BUILD: listener: fix build warning on global_listener_rwlock without threads * BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns * BUILD: peers: Remove unused variables * BUG/MEDIUM: peers: messages about unkown tables not correctly ignored * BUG/MINOR: ssl: don't initialize the keylog callback when not required * BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists * BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task * BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes * BUG/MEDIUM: ring: fix creation of server in uninitialized ring * DOC: config: fix alphabetical ordering of global section * REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses * BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers * BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once * BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy * BUG/MINOR: resolvers: Set port before IP address when processing SRV records * BUG/MINOR: http-htx: Fix error handling during parsing http replies * BUG/MEDIUM: wdt/clock: properly handle early task hangs * CI: emit the compiler's version in the build reports * CI: switch to the "latest" LibreSSL * BUG/MINOR: ssl: ocsp structure not freed properly in case of error * BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer * CI: add monthly gcc cross compile jobs * BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting * BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task * BUG/MAJOR: stick-table: don't process store-response rules for applets * DOC: management: add forgotten "show startup-logs" * BUG/MINOR: stick-table: Use server_id instead of std_t_sint in process_store_rules() * CI: SSL: temporarily stick to LibreSSL=3.5.3 * CI: SSL: use proper version generating when "latest" semantic is used * BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers * BUG/MINOR: sink: Only use backend capability for the sink proxies * BUG/MEDIUM: compression: handle rewrite errors when updating response headers * BUG/MINOR: ring: Properly parse connect timeout * BUG/MINOR: log: Preserve message facility when the log target is a ring buffer * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py * BUG/MINOR: server: make sure "show servers state" hides private bits * BUG/MAJOR: stick-tables: do not try to index a server name for applets * DOC: configuration: missing 'if' in tcp-request content example * BUG/MINOR: backend: only enforce turn-around state when not redispatching * BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction * MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands * BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error * BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os * BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth() * BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os * BUG/MEDIUM: lua: handle stick table implicit arguments right. * BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure * DOC: config: Fix pgsql-check documentation to make user param mandatory * BUG/MINOR: checks: update pgsql regex on auth packet * [RELEASE] Released version 2.4.19 * BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree * REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies * BUG/MINOR: log: improper behavior when escaping log data * SCRIPTS: announce-release: update some URLs to https * BUILD: fd: fix a build warning on the DWCAS * BUG/MEDIUM: captures: free() an error capture out of the proxy lock * DOC: fix TOC in starter guide for subsection 3.3.8. Statistics * REGTESTS: ssl/log: test the log-forward with SSL * BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring. * REGTESTS: log: test the log-forward feature * REGTESTS: healthcheckmail: Relax matching on the healthcheck log message * BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN' * MINOR: listener: small API change * BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK * CI: cirrus-ci: bump FreeBSD image to 13-1 * BUG/MINOR: signals/poller: ensure wakeup from signals * BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals * BUG/MINOR: task: always reset a new tasklet's call date * BUG/MINOR: h1: Support headers case adjustment for TCP proxies * BUILD: makefile: enable crypt(3) for NetBSD * BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support * BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber * BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools * REGTESTS: http_request_buffer: Add a barrier to not mix up log messages * BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input * BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule) * BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets * BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date * BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress * BUG/MEDIUM: peers: Add connect and server timeut to peers proxy * BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode * DOC: configuration: do-resolve doesn't work with a port in the string * REGTESTS: Fix prometheus script to perform HTTP health-checks * BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect * BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config() * BUG/MAJOR: mworker: fix infinite loop on master with no proxies. * BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized * BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle * BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names * BUILD: http: silence an uninitialized warning affecting gcc-5 * BUG/MEDIUM: ring: fix too lax 'size' parser * BUILD: debug: silence warning on gcc-5 * BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq() * BUG/MEDIUM: poller: use fd_delete() to release the poller pipes * BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h * BUG/MINOR: sink: fix a race condition between the writer and the reader * BUG/MINOR: ring/cli: fix a race condition between the writer and the reader * BUG/MEDIUM: proxy: Perform a custom copy for default server settings * REORG: server: Export srv_settings_cpy() function * MINOR: server: Constify source server to copy its settings * BUG/MEDIUM: dns: Properly initialize new DNS session * BUG/MINOR: peers: Use right channel flag to consider the peer as connected * BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload * MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer * BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions * MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups * MINOR: http-htx: Use new HTTP functions for the scheme based normalization * BUG/MEDIUM: h1: Improve authority validation for CONNCET request * MINOR: http: Add function to detect default port * MINOR: http: Add function to get port part of a host * BUG/MEDIUM: mworker: use default maxconn in wait mode * [RELEASE] Released version 2.4.18 * BUG/MINOR: sockpair: wrong return value for fd_send_uxst() * BUG/MINOR: backend: Fallback on RR algo if balance on source is impossible * BUILD: add detection for unsupported compiler models * BUG/MEDIUM: mworker: proc_self incorrectly set crashes upon reload * REGTESTS: Fix some scripts to be compatible with 2.4 and prior * BUG/MINOR: tools: fix statistical_prng_range()'s output range * BUG/MEDIUM: tools: avoid calling dlsym() in static builds (try 2) * BUILD: makefile: Fix install(1) handling for OpenBSD/NetBSD/Solaris/AIX * BUG/MEDIUM: tools: avoid calling dlsym() in static builds * MEDIUM: mworker: set the iocb of the socketpair without using fd_insert() * BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send * BUG/MEDIUM: http-ana: Don't wait to have an empty buf to switch in TUNNEL state * BUG/MINOR: mux-h1: Be sure to commit htx changes in the demux buffer * REGTEESTS: filters: Fix CONNECT request in random-forwarding script * BUG/MEDIUM: http-fetch: Don't fetch the method if there is no stream * BUG/MINOR: http-htx: Fix scheme based normalization for URIs wih userinfo * BUG/MINOR: peers: fix possible NULL dereferences at config parsing * BUG/MINOR: http-act: Properly generate 103 responses when several rules are used * BUG/MINOR: http-check: Preserve headers if not redefined by an implicit rule * BUG/MINOR: peers/config: always fill the bind_conf's argument * MINOR: fd: Add BUG_ON checks on fd_insert() * CI: re-enable gcc asan builds * BUILD: Makefile: Add Lua 5.4 autodetect * BUG/MEDIUM: ssl/fd: unexpected fd close using async engine * MINOR: fd: add a new FD_DISOWN flag to prevent from closing a deleted FD * BUG/MINOR: http-fetch: Use integer value when possible in "method" sample fetch * BUG/MINOR: http-ana: Set method to HTTP_METH_OTHER when an HTTP txn is created * BUG/MINOR: ssl: Do not look for key in extra files if already in pem * MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames * BUG/MEDIUM: ssl/cli: crash when crt inserted into a crt-list * BUG/MINOR: tcp-rules: Make action call final on read error and delay expiration * BUG/MINOR: cli/stats: add missing trailing LF after "show info json" * BUG/MINOR: server: do not enable DNS resolution on disabled proxies * BUG/MINOR: cli/stats: add missing trailing LF after JSON outputs * REGTESTS: healthcheckmail: Relax health-check failure condition * REGTESTS: healthcheckmail: Update the test to be functionnal again * BUG/MINOR: checks: Properly handle email alerts in trace messages * BUG/MINOR: trace: Test server existence for health-checks to get proxy * BUG/MEDIUM: mailers: Set the object type for check attached to an email alert * BUILD: compiler: implement unreachable for older compilers too * REGTESTS: restrict_req_hdr_names: Extend supported versions * REGTESTS: http_abortonclose: Extend supported versions * BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cert I/O handler * BUG/MINOR: ssl_ckch: Dump cert transaction only once if show command yield * REGTESTS: http_request_buffer: Increase client timeout to wait "slow" clients * REGTESTS: abortonclose: Add a barrier to not mix up log messages * MEDIUM: http-ana: Always report rewrite failures as PRXCOND in logs * BUG/MEDIUM: ssl/crt-list: Rework 'add ssl crt-list' to handle full buffer cases * BUG/MEDIUM: ssl_ckch: Rework 'commit ssl cert' to handle full buffer cases * BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a cert entry * BUG/MEDIUM: ssl_ckch: Don't delete a cert entry if it is being modified * BUG/MINOR: ssl_ckch: Free error msg if commit changes on a cert entry fails * DOC: intro: adjust the numbering of paragrams to keep the output ordered * DOC: peers: fix port number and addresses on new peers section format * DOC: peers: clarify when entry expiration date is renewed. * DOC: peers: indicate that some server settings are not usable * SCRIPTS: make publish-release try to launch make-releases-json * SCRIPTS: add make-releases-json to recreate a releases.json file in download dirs * REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (2) * BUG/MEDIUM: sample: Fix adjusting size in word converter * BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section * BUG/MEDIUM: peers: fix segfault using multiple bind on peers sections * BUG/MEDIUM: resolvers: Don't defer resolutions release in deinit function * BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols * BUG/MEDIUM: tools: Fix `inet_ntop` usage in sa2str * CI: determine actual OpenSSL version dynamically * BUILD/MINOR: cpuset fix build for FreeBSD 13.1 * BUG/MINOR: peers: fix error reporting of "bind" lines * BUG/MINOR: cfgparse: abort earlier in case of allocation error * BUG/MINOR: check: Reinit the buffer wait list at the end of a check * BUG/MEDIUM: config: Reset outline buffer size on realloc error in readcfgfile() * REGTESTS: abortonclose: Fix some race conditions * BUG/MINOR: ssl: Fix crash when no private key is found in pem * MINOR: tools: add get_exec_path implementation for solaris based systems. * BUILD: fix build warning on solaris based systems with __maybe_unused. * MEDIUM: http-ana: Add a proxy option to restrict chars in request header names * CI: determine actual LibreSSL version dynamically * [RELEASE] Released version 2.4.17 * CLEANUP: mux-h1: Fix comments and error messages for global options * BUG/MEDIUM: wdt: don't trigger the watchdog when p is unitialized * BUG/MINOR: conn_stream: do not confirm a connection from the frontend path * BUG/MINOR: server: Make SRV_STATE_LINE_MAXLEN value from 512 to 2kB (2000 bytes). * DOC: install: update gcc version requirements * BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-( * BUILD: listener: shut report of possible null-deref in listener_accept() * BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings * BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation * CI: dynamically determine actual version of h2spec * DOC: fix typo "ant" for "and" in INSTALL * BUG/MINOR: map/cli: make sure patterns don't vanish under "show map"'s init * BUG/MINOR: map/cli: protect the backref list during "show map" errors * BUG/MEDIUM: cli: make "show cli sockets" really yield * BUG/MEDIUM: resolvers: make "show resolvers" properly yield * BUG/MINOR: tcp/http: release the expr of set-{src,dst}[-port] * DOC: config: Update doc for PR/PH session states to warn about rewrite failures * MINOR: mux-h2: report a trace event when failing to create a new stream * BUG/MINOR: mux-h2: mark the stream as open before processing it not after * BUG/MAJOR: dns: multi-thread concurrency issue on UDP socket * BUG/MEDIUM: mux-h1: Be able to handle trailers when C-L header was specified * BUG/MEDIUM: mux-fcgi: Be sure to never set EOM flag on an empty HTX message * SCRIPTS: announce-release: add URL of dev packages * CI: github actions: update LibreSSL to 3.5.2 * [RELEASE] Released version 2.4.16 * BUILD: opentracing: Fix OT build due to misuse of var_clear() * BUILD: proto_uxst: do not set unused flag * BUILD: sockpair: do not set unused flag * BUILD: fd: remove unused variable totlen in fd_write_frag_line() * CLEANUP: acl: Remove unused variable when releasing an acl expression * BUG/MINOR: pools: make sure to also destroy shared pools in pool_destroy_all() * BUG/MINOR: resolvers: Fix memory leak in resolvers_deinit() * BUILD: compiler: properly distinguish weak and global symbols * REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc * MEDIUM: queue: use tasklet_instant_wakeup() to wake tasks * MINOR: task: add a new task_instant_wakeup() function * BUG/MINOR: rules: Fix check_capture() function to use the right rule arguments * DOC: remove my name from the config doc * BUG/MAJOR: connection: Never remove connection from idle lists outside the lock * BUG/MINOR: cache: Disable cache if applet creation fails * SCRIPTS: announce-release: add shortened links to pending issues * DOC: lua: update a few doc URLs * SCRIPTS: announce-release: update the doc's URL * BUG/MEDIUM: compression: Don't forget to update htx_sl and http_msg flags * BUG/MEDIUM: fcgi-app: Use http_msg flags to know if C-L header can be added * BUG/MEDIUM: stream: do not abort connection setup too early * BUILD: compiler: use a more portable set of asm(".weak") statements * BUILD: sched: workaround crazy and dangerous warning in Clang 14 * BUG/MEDIUM: mux-h1: Don't request more room on partial trailers * BUG/MINOR: mux-h2: use timeout http-request as a fallback for http-keep-alive * BUG/MINOR: mux-h2: do not use timeout http-keep-alive on backend side * BUILD: debug: mark the __start_mem_stats/__stop_mem_stats symbols as weak * BUG/MINOR: cache: do not display expired entries in "show cache" * BUG/MINOR: mux-h2: do not send GOAWAY if SETTINGS were not sent * CI: cirrus: switch to FreeBSD-13.0 * CI: Update to actions/cache@v3 * CI: Update to actions/checkout@v3 * DEBUG: opentracing: show return values of all functions in the debug output * CLEANUP: opentracing: added variable to store variable length * CLEANUP: opentracing: added flt_ot_smp_init() function * CLEANUP: opentracing: removed unused function flt_ot_var_get() * CLEANUP: opentracing: removed unused function flt_ot_var_unset() * DOC: opentracing: corrected comments in function descriptions * EXAMPLES: opentracing: refined shell scripts for testing filter performance * BUG/MINOR: opentracing: setting the return value in function flt_ot_var_set() * BUG/MEDIUM: http-act: Don't replace URI if path is not found or invalid * BUG/MEDIUM: http-conv: Fix url_enc() to not crush const samples * BUG/MEDIUM: mux-h1: Set outgoing message to DONE when payload length is reached * BUG/MEDIUM: promex: Be sure to never set EOM flag on an empty HTX message * BUG/MEDIUM: hlua: Don't set EOM flag on an empty HTX message in HTTP applet * BUG/MEDIUM: stats: Be sure to never set EOM flag on an empty HTX message * BUG/MINOR: fcgi-app: Don't add C-L header on response to HEAD requests * CI: github actions: update OpenSSL to 3.0.2 * BUG/MAJOR: mux_pt: always report the connection error to the conn_stream * BUG/MINOR: cli/stream: fix "shutdown session" to iterate over all threads * BUG/MINOR: samples: add missing context names for sample fetch functions * DOC: reflect H2 timeout changes * BUG/MEDIUM: mux-h2: make use of http-request and keep-alive timeouts * MEDIUM: mux-h2: slightly relax timeout management rules * BUG/MEDIUM: stream-int: do not rely on the connection error once established * BUG/MEDIUM: mux-h1: Properly detect full buffer cases during message parsing * BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing * BUG/MINOR: tools: url2sa reads too far when no port nor path * DOC: config: Explictly add supported MQTT versions * MEDIUM: mqtt: support mqtt_is_valid and mqtt_field_value converters for MQTTv3.1 * BUG/MEDIUM: trace: avoid race condition when retrieving session from conn->owner * BUG/MEDIUM: mux-h1: only turn CO_FL_ERROR to CS_FL_ERROR with empty ibuf * CI: github actions: switch to LibreSSL-3.5.1 * BUG/MINOR: server/ssl: free the SNI sample expression * BUG/MINOR: tools: fix url2sa return value with IPv4 * [RELEASE] Released version 2.4.15 * BUILD: tree-wide: mark a few numeric constants as explicitly long long * DOC: Fix usage/examples of deprecated ACLs * BUG/MINOR: stream: make the call_rate only count the no-progress calls * BUG/MINOR: session: fix theoretical risk of memleak in session_accept_fd() * BUG/MAJOR: mux-pt: Always destroy the backend connection on detach * DEBUG: stream: Fix stream trace message to print response buffer state * DEBUG: stream: Add the missing descriptions for stream trace events * BUG/MEDIUM: mcli: Properly handle errors and timeouts during reponse processing * DEBUG: cache: Update underlying buffer when loading HTX message in cache applet * BUG/MINOR: promex: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cache: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: stats: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: hlua: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cli: shows correct mode in "show sess" * BUG/MINOR: add missing modes in proxy_mode_str() * BUILD: pools: fix backport of no-memory-trimming on non-linux OS * MINOR: pools: add a new global option "no-memory-trimming" * BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed * BUG/MINOR: pool: always align pool_heads to 64 bytes * REGTESTS: fix the race conditions in secure_memcmp.vtc * REGTESTS: fix the race conditions in normalize_uri.vtc * BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks() * CI: github actions: use cache for SSL libs * CI: github actions: use cache for OpenTracing * CI: github actions: add OpenTracing builds * CI: github actions: add the output of $CC -dM -E- * [RELEASE] Released version 2.4.14 * BUG/MEDIUM: stream: Abort processing if response buffer allocation fails * CI: github: enable pool debugging by default * REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks * BUG/MINOR: proxy: preset the error message pointer to NULL in parse_new_proxy() * BUG/MAJOR: mux-h2: Be sure to always report HTX parsing error to the app layer * BUG/MEDIUM: mux-h1: Don't wake h1s if mux is blocked on lack of output buffer * BUG/MEDIUM: htx: Be sure to have a buffer to perform a raw copy of a message * BUG/MINOR: tools: url2sa reads ipv4 too far * BUG/MINOR: mailers: negotiate SMTP, not ESMTP * CI: github actions: update OpenSSL to 3.0.1 * CI: github: switch to OpenSSL 3.0.0 * CI: github actions: relax OpenSSL-3.0.0 version comparision * CI: github actions: -Wno-deprecated-declarations with OpenSSL 3.0.0 * CI: github actions: add OpenSSL-3.0.0 builds * BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2 * BUILD: fix compilation for OpenSSL-3.0.0-alpha17 * CI: ssl: keep the old method for ancient OpenSSL versions * CI: ssl: do not needlessly build the OpenSSL docs * CI: ssl: enable parallel builds for OpenSSL on Linux * BUG/MAJOR: compiler: relax alignment constraints on certain structures * BUG/MEDIUM: fd: always align fdtab[] to 64 bytes * BUG/MEDIUM: resolvers: Really ignore trailing dot in domain names * BUG/MINOR: sink: Use the right field in appctx context in release callback * BUG/MINOR: mworker: fix a FD leak of a sockpair upon a failed reload * BUG/MEDIUM: mworker: close unused transferred FDs on load failure * MINOR: sock: move the unused socket cleaning code into its own function * [RELEASE] Released version 2.4.13 * BUG/MINOR: mux-h2: update the session's idle delay before creating the stream * BUG/MEDIUM: h2/hpack: fix emission of HPACK DTSU after settings change * REGTESTS: peers: leave a bit more time to peers to synchronize * BUG/MAJOR: spoe: properly detach all agents when releasing the applet * BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies * BUG/MEDIUM: listener: read-lock the listener during accept() * MINOR: listener: replace the listener's spinlock with an rwlock * BUG/MINOR: mworker: does not erase the pidfile upon reload * BUG/MAJOR: sched: prevent rare concurrent wakeup of multi-threaded tasks * DEBUG: pools: replace the link pointer with the caller's address on pool_free() * DEBUG: pools: let's add reverse mapping from cache heads to thread and pool * DEBUG: pools: add extra sanity checks when picking objects from a local cache * BUG/MINOR: pools: always flush pools about to be destroyed * BUG/MEDIUM: mworker: don't lose the stats socket on failed reload * DEBUG: pools: add new build option DEBUG_POOL_INTEGRITY * BUILD: debug/cli: condition test of O_ASYNC to its existence * DEBUG: cli: add a new "debug dev fd" expert command * MEDIUM: h2/hpack: emit a Dynamic Table Size Update after settings change * BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them * BUG/MEDIUM: mcli: do not try to parse empty buffers * BUG/MEDIUM: cli: Never wait for more data on client shutdown * BUG/MINOR: cli: avoid O(bufsize) parsing cost on pipelined commands * MINOR: channel: add new function co_getdelim() to support multiple delimiters * MEDIUM: cli: yield between each pipelined command * BUG/MEDIUM: server: avoid changing healthcheck ctx with set server ssl * BUILD/MINOR: fix solaris build with clang. * BUG/MEDIUM: htx: Adjust length to add DATA block in an empty HTX buffer * BUG/MEDIUM: connection: properly leave stopping list on error * [RELEASE] Released version 2.4.12 * BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data * BUG/MEDIUM: mworker: don't use _getsocks in wait mode * [RELEASE] Released version 2.4.11 * BUG/MEDIUM: http-ana: Preserve response's FLT_END analyser on L7 retry * BUG/MINOR: cli: fix _getsocks with musl libc * BUILD/MINOR: tools: solaris build fix on dladdr. * BUILD/MINOR: cpuset FreeBSD 14 build fix. * BUG/MEDIUM: ssl: free the ckch instance linked to a server * BUG/MINOR: ssl: free the fields in srv->ssl_ctx * MINOR: debug: add support for -dL to dump library names at boot * MINOR: debug: add ability to dump loaded shared libraries * MINOR: compat: detect support for dl_iterate_phdr() * BUG/MINOR: mux-h1: Fix splicing for messages with unknown length * BUG/MEDIUM: mux-h1: Fix splicing by properly detecting end of message * BUILD: makefile: add -Wno-atomic-alignment to work around clang abusive warning * MINOR: proxy: add option idle-close-on-response * REGTESTS: ssl: fix ssl_default_server.vtc * BUG/MEDIUM: ssl: initialize correctly ssl w/ default-server * DOC: fix misspelled keyword "resolve_retries" in resolvers * BUILD: ssl: unbreak the build with newer libressl * BUILD: cli: clear a maybe-unused warning on some older compilers * BUG/MINOR: pools: don't mark ourselves as harmless in DEBUG_UAF mode * BUG/MEDIUM: backend: fix possible sockaddr leak on redispatch * [RELEASE] Released version 2.4.10 * BUG/MINOR: backend: restore the SF_SRV_REUSED flag original purpose * BUG/MINOR: backend: do not set sni on connection reuse * MINOR: pools: work around possibly slow malloc_trim() during gc * BUG/MEDIUM: mworker/cli: crash when trying to access an old PID in prompt mode * DOC: config: retry-on list is space-delimited * DOC: config: Specify %Ta is only available in HTTP mode * DOC: spoe: Clarify use of the event directive in spoe-message section * BUG/MINOR: cli/server: Don't crash when a server is added with a custom id * IMPORT: slz: use the correct CRC32 instruction when running in 32-bit mode * BUILD: tree-wide: avoid warnings caused by redundant checks of obj_types * MINOR: cli: "show version" displays the current process version * CI: Github Actions: temporarily disable BoringSSL builds * BUILD: bug: Fix error when compiling with -DDEBUG_STRICT_NOCRASH * MINOR: mux-h1: Improve H1 traces by adding info about http parsers * BUG/MAJOR: segfault using multiple log forward sections. * BUG/MEDIUM: resolvers: Detach query item on response error * BUG/MINOR: server: Don't rely on last default-server to init server SSL context * BUG/MEDIUM: cli: Properly set stream analyzers to process one command at a time * BUILD/MINOR: server: fix compilation without SSL * [RELEASE] Released version 2.4.9 * BUG/MINOR: cache: Fix loop on cache entries in "show cache" * MINOR: promex: backend aggregated server check status * MINOR: server: add ws keyword * MEDIUM: server/backend: implement websocket protocol selection * MINOR: connection: add alternative mux_ops param for conn_install_mux_be * MINOR: connection: implement function to update ALPN * MINOR: stream/mux: implement websocket stream flag * BUG/MINOR: ssl: make SSL counters atomic * MINOR: shctx: add a few BUG_ON() for consistency checks * BUG/MINOR: shctx: do not look for available blocks when the first one is enough * BUG/MEDIUM: shctx: leave the block allocator when enough blocks are found * BUG/MEDIUM: cache/cli: make "show cache" thread-safe * BUG/MEDIUM: mux-h2: always process a pending shut read * BUG/MEDIUM: ssl: abort with the correct SSL error when SNI not found * CLEANUP: ssl: fix wrong #else commentary * BUG/MINOR: ssl: free correctly the sni in the backend SSL cache * BUG/MEDIUM: ssl: backend TLS resumption with sni and TLSv1.3 * BUILD: makefile: simplify detection of libatomic * BUG/MEDIUM: mux-h1: Handle delayed silent shut in h1_process() to release H1C * BUG/MINOR: stick-table/cli: Check for invalid ipv6 key * BUG/MEDIUM: connection: make cs_shutr/cs_shutw//cs_close() idempotent * BUG/MINOR: mux-h2: Fix H2_CF_DEM_SHORT_READ value * BUG/MINOR: mworker: doesn't launch the program postparser * BUG/MEDIUM: conn-stream: Don't reset CS flags on close * MINOR: mux-h1: Slightly Improve H1 traces * DOC: lua: Be explicit with the Reply object limits * Revert "BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back" * BUG/MINOR: http-ana: Apply stop to the current section for http-response rules * DOC: config: Fix typo in ssl_fc_unique_id description * BUG/MINOR: cache: properly ignore unparsable max-age in quotes * BUG/MINOR: resolvers: throw log message if trash not large enough for query * BUG/MINOR: resolvers: fix sent messages were counted twice * BUG/MEDIUM: mux-h2: reject upgrade if no RFC8441 support * MINOR: mux-h2: add trace on extended connect usage * MINOR: mux-h2: perform a full cycle shutdown+drain on close * MINOR: connection: add a new CO_FL_WANT_DRAIN flag to force drain on close - VUL-0: CVE-2023-40225: haproxy: reject any empty content-length header value (bsc#1214102) Apply upstream patch adapted for 2.4.22 (patch h2_parse_cont_len_header() instead of http_parse_cont_len_header()) Add patch: 0001-BUG-MAJOR-http-reject-any-empty-content-length-heade.patch - VUL-0: CVE-2023-45539: haproxy: misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653) Apply upstream patch. Add patch: 0001-BUG-MINOR-h1-do-not-accept-as-part-of-the-URI-compon.patch - Update to version 2.3.6+git0.7851701ed: * [RELEASE] Released version 2.3.6 * BUG/MINOR: http-ana: Don't increment HTTP error counter on read error/timeout * BUG/MINOR: mux-h2: Fix typo in scheme adjustment * DOC: spoe: Add a note about fragmentation support in HAProxy * BUG/MEDIUM: spoe: Kill applets if there are pending connections and nbthread > 1 * BUG/MINOR: connection: Use the client's dst family for adressless servers * BUG/MINOR: tcp-act: Don't forget to set the original port for IPv4 set-dst rule * BUG/MINOR: http-ana: Only consider dst address to process originalto option * BUG/MINOR: mux-h1: Immediately report H1C errors from h1_snd_buf() * BUG/MINOR: stats: fix compare of no-maint url suffix * CLEANUP: muxes: Remove useless if condition in show_fd function * BUG/MINOR: ssl: potential null pointer dereference in ckchs_dup() * BUG/MEDIUM: resolvers: Reset address for unresolved servers * BUG/MEDIUM: resolvers: Reset server address and port for obselete SRV records * BUG/MINOR: resolvers: new callback to properly handle SRV record errors * BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record * BUG/MINOR: resolvers: Fix condition to release received ARs if not assigned * BUG/MINOR: fd: properly wait for !running_mask in fd_set_running_excl() * BUG/MINOR: proxy: wake up all threads when sending the hard-stop signal * BUG/MEDIUM: cli/shutdown sessions: make it thread-safe * BUG/MEDIUM: proxy: use thread-safe stream killing on hard-stop * BUG/MEDIUM: vars: make functions vars_get_by_{name,desc} thread-safe * BUG/MINOR: sample: secure convs that accept base64 string and var name as args * MINOR: Configure the `cpp` userdiff driver for *.[ch] in .gitattributes * BUG/MINOR: ssl/cli: potential null pointer dereference in "set ssl cert" * BUG/MEDIUM: mux-h1: Fix handling of responses to CONNECT other than 200-ok * BUG/MINOR: server: Be sure to cut the last parsed field of a server-state line * BUG/MINOR: server: Init params before parsing a new server-state line * BUG/MINOR: http-rules: Always replace the response status on a return action * BUG/MEDIUM: spoe: Resolve the sink if a SPOE logs in a ring buffer * BUG/MEDIUM: lists: Avoid an infinite loop in MT_LIST_TRY_ADDQ(). * DOC: explain the relation between pool-low-conn and tune.idle-pool.shared * BUILD: ssl: introduce fine guard for OpenSSL specific SCTL functions * BUG/MINOR: sample: Always consider zero size string samples as unsafe * BUG/MEDIUM: checks: don't needlessly take the server lock in health_adjust() * BUG/MINOR: checks: properly handle wrapping time in __health_adjust() * BUG/MINOR: session: atomically increment the tracked sessions counter * BUG/MINOR: server: Remove RMAINT from admin state when loading server state * CLEANUP: channel: fix comment in ci_putblk. * DOC: tune: explain the origin of block size for ssl.cachesize * BUG/MINOR: server: Don't call fopen() with server-state filepath set to NULL * BUG/MINOR: cfgparse: do not mention "addr:port" as supported on proxy lines * BUG/MINOR: stats: revert the change on ST_CONVDONE * BUG/MEDIUM: config: don't pick unset values from last defaults section * CLEANUP: deinit: release global and per-proxy server-state variables on deinit * BUG/MINOR: server: Fix server-state-file-name directive * BUG/MINOR: backend: hold correctly lock when killing idle conn * BUG/MINOR: tools: Fix a memory leak on error path in parse_dotted_uints() * BUG/MINOR: server: re-align state file fields number * BUG/MEDIUM: mux-h1: Always set CS_FL_EOI for response in MSG_DONE state * BUG/MINOR: http-ana: Don't increment HTTP error counter on internal errors * BUG/MINOR: intops: fix mul32hi()'s off-by-one * BUILD: ssl: guard SSL_CTX_set_msg_callback with SSL_CTRL_SET_MSG_CALLBACK macro * BUILD: ssl: guard SSL_CTX_add_server_custom_ext with special macro * BUILD: ssl: fix typo in HAVE_SSL_CTX_ADD_SERVER_CUSTOM_EXT macro * MINOR: check: do not ignore a connection header for http-check send - Update to version 2.3.7+git0.2d39ce334: * [RELEASE] Released version 2.3.7 * BUG/MINOR: resolvers: Add missing case-insensitive comparisons of DNS hostnames * MINOR: resolvers: Don't try to match immediatly renewed ADD items * MINOR: resolvers: Use milliseconds for cached items in resolver responses * BUG/MEDIUM: resolvers: Skip DNS resolution at startup if SRV resolution is set * BUG/MEDIUM: resolvers: Don't release resolution from a requester callbacks * MINOR: resolvers: Directly call srvrq_update_srv_state() when possible * MINOR: resolvers: Add function to change the srv status based on SRV resolution * MINOR: resolvers: Purge answer items when a SRV resolution triggers an error * MINOR: resolvers: Use a function to remove answers attached to a resolution * BUG/MEDIUM: resolvers: Trigger a DNS resolution if an ADD item is obsolete * BUG/MINOR; resolvers: Ignore DNS resolution for expired SRV item * MINOR: resolvers: new function find_srvrq_answer_record() * BUG/MEDIUM: resolvers: Fix the loop looking for an existing ADD item * BUG/MEDIUM: resolvers: Don't set an address-less server as UP * BUG/MINOR: resolvers: Unlink DNS resolution to set RMAINT on SRV resolution * BUG/MINOR: resolvers: Reset server address on DNS error only on status change * BUG/MINOR: resolvers: Consider server to have no IP on DNS resolution error * Revert "BUG/MINOR: resolvers: Only renew TTL for SRV records with an additional record" * CLEANUP: tcp-rules: add missing actions in the tcp-request error message * BUG/MINOR: tcpcheck: Fix double free on error path when parsing tcp/http-check * BUG/MINOR: session: Add some forgotten tests on session's listener * BUG/MINOR: proxy/session: Be sure to have a listener to increment its counters * BUG/MINOR: tcpcheck: Update .health threshold of agent inside an agent-check * BUG/MEDIUM: filters: Set CF_FL_ANALYZE on channels when filters are attached * BUILD: atomic/arm64: force the register pairs to use in __ha_cas_dw() * BUG/MEDIUM: stick-tables: fix ref counter in table entry using multiple http tracksc. * OPTIM: task: automatically adjust the default runqueue-depth to the threads * MINOR: task: give the scheduler a bit more flexibility in the runqueue size * MEDIUM: task: remove the tasks_run_queue counter and have one per thread * MEDIUM: ssl: implement xprt_set_used and xprt_set_idle to relax context checks * MINOR: xprt: add new xprt_set_idle and xprt_set_used methods * MEDIUM: muxes: mark idle conns tasklets with TASK_F_USR1 * MINOR: task: add an application specific flag to the state: TASK_F_USR1 * BUG/MEDIUM: ssl: properly remove the TASK_HEAVY flag at end of handshake * MINOR: ssl: mark the SSL handshake tasklet as heavy * MINOR: task: limit the number of subsequent heavy tasks with flag TASK_HEAVY * MEDIUM: backend: use a trylock when trying to grab an idle connection * MINOR: pools: double the local pool cache size to 1 MB * MEDIUM: pools: add CONFIG_HAP_NO_GLOBAL_POOLS and CONFIG_HAP_GLOBAL_POOLS * MEDIUM: streams: do not use the streams lock anymore * MINOR: streams: use one list per stream instead of a global one * MINOR: cli/streams: make "show sess" dump all streams till the new epoch * MINOR: stream: add an "epoch" to figure which streams appeared when * MINOR: dynbuf: pass offer_buffers() the number of buffers instead of a threshold * MINOR: dynbuf: use regular lists instead of mt_lists for buffer_wait * MINOR: dynbuf: make the buffer wait queue per thread * OPTIM: lb-leastconn: do not unlink the server if it did not change * OPTIM: lb-leastconn: do not take the server lock on take_conn/drop_conn * OPTIM: lb-first: do not take the server lock on take_conn/drop_conn * MINOR: lb/api: let callers of take_conn/drop_conn tell if they have the lock * MINOR: server: move actconns to the per-thread structure * OPTIM: server: switch the actconn list to an mt-list * MINOR: listener: refine the default MAX_ACCEPT from 64 to 4 * MINOR: tasks: refine the default run queue depth * BUG/MEDIUM: session: NULL dereference possible when accessing the listener * MINOR: atomic: implement a more efficient arm64 __ha_cas_dw() using pairs * MINOR: atomic: add armv8.1-a atomics variant for cas-dw * BUG/MINOR: mt-list: always perform a cpu_relax call on failure * REORG: atomic: reimplement pl_cpu_relax() from atomic-ops.h * BUG/MINOR: ssl: don't truncate the file descriptor to 16 bits in debug mode * BUG/MINOR: hlua: Don't strip last non-LWS char in hlua_pushstrippedstring() * BUG/MINOR: backend: fix condition for reuse on mode HTTP - Update to version 2.3.8+git0.e572195c7: * [RELEASE] Released version 2.3.8 * BUG/MINOR: http_fetch: make hdr_ip() reject trailing characters * MINOR: tools: make url2ipv4 return the exact number of bytes parsed * BUG/MEDIUM: thread: Fix a deadlock if an isolated thread is marked as harmless * BUG/MEDIUM: fd: Take the fd_mig_lock when closing if no DWCAS is available. * CLEANUP: fd: remove unused fd_set_running_excl() * BUG/MEDIUM: fd: do not wait on FD removal in fd_delete() * MINOR: fd: remove the unneeded running bit from fd_insert() * MINOR: fd: make fd_clr_running() return the remaining running mask * BUG/MEDIUM: lua: Always init the lua stack before referencing the context * BUG/MEDIUM: debug/lua: Use internal hlua function to dump the lua traceback * MINOR: lua: Slightly improve function dumping the lua traceback * BUILD: ssl: guard ecdh functions with SSL_CTX_set_tmp_ecdh macro * BUG/MINOR: ssl: Prevent disk access when using "add ssl crt-list" * BUG/MEDIUM: debug/lua: Don't dump the lua stack if not dumpable * MEDIUM: lua: Use a per-thread counter to track some non-reentrant parts of lua * MINOR/BUG: mworker/cli: do not use the unix_bind prefix for the master CLI socket * BUG/MINOR: protocol: add missing support of dgram unix socket. * BUG/MEDIUM: freq_ctr/threads: use the global_now_ms variable * MINOR: time: also provide a global, monotonic global_now_ms timer * BUG/MEDIUM: mux-fcgi: Fix locking of idle_conns lock in the FCGI I/O callback * BUG/MINOR: freq_ctr/threads: make use of the last updated global time * MINOR: time: export the global_now variable - Update to version 2.3.9+git1.afb63bc04: * BUILD: backend: fix build breakage in idle conn locking fix * [RELEASE] Released version 2.3.9 * BUG/MEDIUM: time: make sure to always initialize the global tick * BUG/MINOR: stats: Apply proper styles in HTML status page. * BUG/MINOR: payload: Wait for more data if buffer is empty in payload/payload_lv * MEDIUM: backend: use a trylock to grab a connection on high FD counts as well * BUG/MEDIUM: mux-h1: make h1_shutw_conn() idempotent - Update to version 2.3.10+git0.4764f0e4e: * [RELEASE] Released version 2.3.10 * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush * BUG/MEDIUM: peers: re-work connection to new process during reload. * BUG/MINOR: peers: remove useless table check if initial resync is finished * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data * BUG/MINOR: mworker: don't use oldpids[] anymore for reload * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases * BUG/MEDIUM: config: fix cpu-map notation with both process and threads * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers * BUG/MINOR: server: free srv.lb_nodes in free_server * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received * BUG/MINOR: logs: Report the true number of retries if there was no connection * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check * MINOR: connection: Make bc_http_major compatible with tcp-checks * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections * MINOR: logs: Add support of checks as session origin to format lf strings * BUG/MINOR: checks: Set missing id to the dummy checks frontend * BUG/MEDIUM: threads: Ignore current thread to end its harmless period * DOC: ssl: Certificate hot update only works on fronted certificates * BUG/MEDIUM: sample: Fix adjusting size in field converter * MINOR: No longer rely on deprecated sample fetches for predefined ACLs * DOC: clarify that compression works for HTTP/2 * BUG/MINOR: tools: fix parsing "us" unit for timers * CONTRIB: halog: fix issue with array of type char * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one * BUG/MINOR: ssl: Fix update of default certificate * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS * BUG/MINOR: tcp: fix silent-drop workaround for IPv6 - Update to version 2.4.0+git0.6cbbecf09: https://www.haproxy.com/blog/announcing-haproxy-2-4/ for all the details see /usr/share/doc/packages/haproxy/CHANGELOG - refreshed patches to apply cleanly again haproxy-1.6.0-makefile_lib.patch haproxy-1.6.0-sec-options.patch lua54.patch - Update to version 2.4.1+git0.1ce7d4925: * [RELEASE] Released version 2.4.1 * BUG/MINOR: mux-h2/traces: bring back the lost "sent H2 REQ/RES" traces * BUG/MINOR: mux-h2/traces: bring back the lost "rcvd H2 REQ" trace * MINOR: mux-h2: obey http-ignore-probes during the preface * BUG/MINOR: stats: make "show stat typed desc" work again * CLEANUP: mux-h2/traces: better align user messages * MINOR: mux-h2/trace: report a few connection-level info during h2_init() * MINOR: connection: add helper conn_append_debug_info() * BUG/MINOR: server: explicitly set "none" init-addr for dynamic servers * BUG/MINOR: mux-h1: do not skip the error response on bad requests * MINOR: backend: only skip LB when there are actual connections * BUG/MAJOR: queue: set SF_ASSIGNED when setting strm->target on dequeue * CLEANUP: global: remove unused definition of stopping_task[] * BUG/MINOR: mworker: fix typo in chroot error message * BUG/MINOR: ssl: use atomic ops to update global shctx stats * BUG/MEDIUM: shctx: use at least thread-based locking on USE_PRIVATE_CACHE * BUG/MEDIUM: server: do not auto insert a dynamic server in px addr_node * BUG/MINOR: server: do not keep an invalid dynamic server in px ids tree * BUG/MEDIUM: server: do not forget to generate the dynamic servers ids * BUG/MEDIUM: server: clear dynamic srv on delete from proxy id/name trees * BUG/MEDIUM: server: extend thread-isolate over much of CLI 'add server' * BUG/MINOR: stick-table: insert srv in used_name tree even with fixed id * DOC: lua: Add a warning about buffers modification in HTTP * BUG/MAJOR: resolvers: segfault using server template without SRV RECORDs * MEDIUM: resolvers: add a ref between servers and srv request or used SRV record * MEDIUM: resolvers: add a ref on server to the used A/AAAA answer item * BUG/MINOR: resolvers: answser item list was randomly purged or errors * CLEANUP: l7-retries: do not test the buffer before calling b_alloc() * BUG/MINOR: mux-fcgi: Expose SERVER_SOFTWARE parameter by default * BUG/MAJOR: htx: Fix htx_defrag() when an HTX block is expanded * CLEANUP: pools: remove now unused seq and pool_free_list * BUG/MAJOR: pools: fix possible race with free() in the lockless variant * MEDIUM: pools: use a single pool_gc() function for locked and lockless * MINOR: pools: call malloc_trim() under thread isolation * MINOR: pools: do not maintain the lock during pool_flush() * BUG/MINOR: pools: make DEBUG_UAF always write to the to-be-freed location * BUG/MINOR: pools: fix a possible memory leak in the lockless pool_flush() * BUG/MEDIUM: compression: Add a flag to know the filter is still processing data * BUG/MEDIUM: compression: Properly get the next block to iterate on payload * BUG/MEDIUM: compression: Fix loop skipping unused blocks to get the next block * BUG/MEDIUM: opentracing: initialization before establishing daemon and/or chroot mode * Revert "BUG/MINOR: opentracing: initialization after establishing daemon mode" * BUG/MINOR: ssl: OCSP stapling does not work if expire too far in the future * BUILD: make tune.ssl.keylog available again * DOC: use the req.ssl_sni in examples * MINOR: errors: allow empty va_args for diag variadic macro * BUG/MAJOR: stream-int: Release SI endpoint on server side ASAP on retry * DOC/MINOR: move uuid in the configuration to the right alphabetical order * BUG/MINOR: vars: Be sure to have a session to get checks variables * CLEANUP: http-ana: Remove useless if statement about L7 retries * BUG/MINOR: proxy: Missing calloc return value check in chash_init_server_tree * BUG/MINOR: http: Missing calloc return value check in make_arg_list * BUG/MINOR: http: Missing calloc return value check while parsing redirect rule * BUG/MINOR: worker: Missing calloc return value check in mworker_env_to_proc_list * BUG/MINOR: compression: Missing calloc return value check in comp_append_type/algo * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request rule * BUG/MINOR: http: Missing calloc return value check while parsing tcp-request/tcp-response * BUG/MINOR: proxy: Missing calloc return value check in proxy_defproxy_cpy * BUG/MINOR: proxy: Missing calloc return value check in proxy_parse_declare * BUG/MINOR: http: Missing calloc return value check in parse_http_req_capture * BUG/MINOR: ssl: Missing calloc return value check in ssl_init_single_engine * BUG/MINOR: peers: Missing calloc return value check in peers_register_table * BUG/MINOR: server: Missing calloc return value check in srv_parse_source * DOC: intro: Fix typo in starter guide * MINOR: cfgparse: Fail when encountering extra arguments in macro * MINOR: http-ana: Perform L7 retries because of status codes in response analyser * BUG/MINOR: http-ana: Handle L7 retries on refused early data before K/A aborts * BUG/MINOR: http-ana: Send the right error if max retries is reached on L7 retry * Revert "MEDIUM: http-ana: Deal with L7 retries in HTTP analysers" * BUG/MINOR: http-comp: Preserve HTTP_MSGF_COMPRESSIONG flag on the response * BUG/MEDIUM: filters: Exec pre/post analysers only one time per filter * BUILD/MINOR: opentracing: fixed build when using clang * BUG/MAJOR: server: prevent deadlock when using 'set maxconn server' * BUG/MEDIUM: ebtree: Invalid read when looking for dup entry - Update to version 2.4.2+git0.553dee326: * [RELEASE] Released version 2.4.2 * REGTESTS: add http scheme-based normalization test * MEDIUM: h2: apply scheme-based normalization on h2 requests * MEDIUM: h1-htx: apply scheme-based normalization on h1 requests * MEDIUM: http: implement scheme-based normalization * MINOR: http: implement http_get_scheme * Revert "MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules" * BUG/MINOR: cli: fix server name output in "show fd" * BUG/MEDIUM: sock: make sure to never miss early connection failures * DOC: stick-table: add missing documentation about gpt0 stored type * BUG/MINOR: peers: fix data_type bit computation more than 32 data_types * BUG/MINOR: stick-table: fix several printf sign errors dumping tables * DOC: config: use CREATE USER for mysql-check * BUG/MEDIUM: resolvers: Make 1st server of a template take part to SRV resolution * BUG/MINOR: mqtt: Support empty client ID in CONNECT message * BUG/MINOR: mqtt: Fix parser for string with more than 127 characters * BUG/MINOR: tcpcheck: Fix numbering of implicit HTTP send/expect rules * BUILD: Makefile: fix linkage for Haiku. * BUG/MINOR: checks: return correct error code for srv_parse_agent_check * MINOR: resolvers: Reset server IP on error in resolv_get_ip_from_response() * BUG/MINOR: resolvers: Reset server IP when no ip is found in the response * BUG/MINOR: resolvers: Always attach server on matching record on resolution * CLEANUP: dns: Remove a forgotten debug message * DOC: config: Add missing actions in "tcp-request session" documentation * MINOR: tcp-act: Add set-src/set-src-port for "tcp-request content" rules * REGTESTS: fix maxconn update with agent-check * BUG/MAJOR: server: fix deadlock when changing maxconn via agent-check * BUG/MINOR: cache: Correctly handle existing-but-empty 'accept-encoding' header * BUG/MINOR: server/cli: Fix locking in function processing "set server" command * BUG/MINOR: resolvers: Use resolver's lock in resolv_srvrq_expire_task() * BUG/MEDIUM: resolvers: Add a task on servers to check SRV resolution status * MINOR: resolvers: Remove server from named_servers tree when removing a SRV item * MINOR: resolvers: Clean server in a dedicated function when removing a SRV item * BUG/MEDIUM: server/cli: Fix ABBA deadlock when fqdn is set from the CLI * BUG/MINOR: server: Forbid to set fqdn on the CLI if SRV resolution is enabled * BUG/MINOR: server-state: load SRV resolution only if params match the config - Update to version 2.4.3+git0.4dd5a5a6c: CVE-2021-39240 CVE-2021-39241 CVE-2021-39242 (boo#1189366 boo#1189548 boo#1189549) * [RELEASE] Released version 2.4.3 * REGTESTS: add a test to prevent h2 desync attacks * BUG/MEDIUM: h2: give :authority precedence over Host * BUG/MAJOR: h2: enforce stricter syntax checks on the :method pseudo-header * BUG/MAJOR: h2: verify that :path starts with a '/' before concatenating it * BUG/MAJOR: h2: verify early that non-http/https schemes match the valid syntax * MINOR: http: add a new function http_validate_scheme() to validate a scheme * DOC/MINOR: fix typo in management document * CLEANUP: assorted typo fixes in the code and comments * BUG/MEDIUM: cfgcheck: verify existing log-forward listeners during config check * BUG/MEDIUM: spoe: Fix policy to close applets when SPOE connections are queued * DOC: config: Fix 'http-response send-spoe-group' documentation * DOC: Improve the lua documentation * BUG/MINOR: tcpcheck: Properly detect pending HTTP data in output buffer * BUG/MINOR: buffer: fix buffer_dump() formatting * BUG/MEDIUM: spoe: Create a SPOE applet if necessary when the last one is released * MINOR: spoe: Add a pointer on the filter config in the spoe_agent structure * ADMIN: dyncookie: implement a simple dynamic cookie calculator * MINOR: server: unmark deprecated on enable health/agent cli * BUG/MINOR: server: update last_change on maint->ready transitions too * BUG/MINOR: server: remove srv from px list on CLI 'add server' error * BUILD: opentracing: fixed build when using pkg-config utility * DOC: internals: document the FD takeover process * BUG/MINOR: fd: protect fd state harder against a concurrent takeover * BUG/MINOR: pollers: always program an update for migrated FDs * BUG/MINOR: poll: fix abnormally high skip_fd counter * BUG/MINOR: select: fix excess number of dead/skip reported * BUG/MEDIUM: pollers: clear the sleeping bit after waking up, not before * BUG/MEDIUM: connection: close a rare race between idle conn close and takeover * BUG/MINOR: connection: Add missing error labels to conn_err_code_str * BUG/MEDIUM: mux-h2: Handle remaining read0 cases on partial frames * BUG/MINOR: mux-h1: Be sure to swap H1C to splice mode when rcv_pipe() is called * BUG/MINOR: mux-h2: Obey dontlognull option during the preface * BUG/MINOR: mux-h1: Obey dontlognull option for empty requests * BUG/MINOR: systemd: must check the configuration using -Ws * BUG/MINOR: resolvers: Use a null-terminated string to lookup in servers tree * BUG/MINOR: check: fix the condition to validate a port-less server * BUG/MINOR: stats: Add missing agent stats on servers * BUG/MEDIUM: ssl_sample: fix segfault for srv samples on invalid request * BUILD/MINOR: memprof fix macOs build. * BUG/MINOR: mworker: do not export HAPROXY_MWORKER_REEXEC across programs * BUG/MEDIUM: mworker: do not register an exit handler if exit is expected * BUILD: lua: silence a build warning with TCC * BUILD: add detection of missing important CFLAGS * BUG/MINOR: ssl: Default-server configuration ignored by server * MINOR: mux_h2: define config to disable h2 websocket support * BUILD: http_htx: fix ci compilation error with isdigit for Windows - Update to version 2.4.4+git0.acb1d0bea: CVE-2021-40346 (boo#1189877) * [RELEASE] Released version 2.4.4 * Revert "BUG/MINOR: stream-int: Don't block reads in si_update_rx() if chn may receive" * BUG/MAJOR: htx: fix missing header name length check in htx_add_header/trailer * CLEANUP: htx: remove comments about "must be < 256 MB" * BUG/MINOR: config: reject configs using HTTP with bufsize >= 256 MB * DOC: configuration: remove wrong tcp-request examples in tcp-response * BUG/MINOR: vars: fix set-var/unset-var exclusivity in the keyword parser * CLEANUP: Add missing include guard to signal.h * BUG/MINOR: tools: Fix loop condition in dump_text() * BUG/MINOR threads: Use get_(local|gm)time instead of (local|gm)time * BUG/MINOR: ebtree: remove dependency on incorrect macro for bits per long * MINOR: time: add report_idle() to report process-wide idle time * BUG/MINOR: time: fix idle time computation for long sleeps * BUG/MINOR: lua: use strlcpy2() not strncpy() to copy sample keywords * MINOR: compiler: implement an ONLY_ONCE() macro * BUG/MINOR: base64: base64urldec() ignores padding in output size check * BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} * BUG/MINOR: stick-table: fix the sc-set-gpt* parser when using expressions * MINOR: hlua: take the global Lua lock inside a global function * REGTESTS: abortonclose: after retries, 503 is expected, not close * REGTESTS: http_upgrade: fix incorrect expectation on TCP->H1->H2 * BUG/MEDIUM: h2: match absolute-path not path-absolute for :path - Update to version 2.4.5+git0.e74a1b34b: * [RELEASE] Released version 2.4.5 * MINOR: tasks: catch TICK_ETERNITY with BUG_ON() in __task_queue() * BUG/MINOR: tcp-rules: Stop content rules eval on read error and end-of-input * BUG/MINOR: tcpcheck: Don't use arg list for default proxies during parsing * MINOR: arg: Be able to forbid unresolved args when building an argument list * BUG/MAJOR: lua: use task_wakeup() to properly run a task once * BUG/MEDIUM: lua: fix wakeup condition from sleep() * MINOR: Makefile: add MEMORY_POOLS to the list of DEBUG_xxx options * DOC: peers: fix doc "enable" statement on "peers" sections * BUG/MINOR: mux-h1/mux-fcgi: Sanitize TE header to only send "trailers" * MINOR: stream-int: Notify mux when the buffer is not stuck when calling rcv_buf * BUG/MEDIUM: stream-int: Defrag HTX message in si_cs_recv() if necessary * MINOR: htx: Add a function to know if the free space wraps * MINOR: htx: Add an HTX flag to know when a message is fragmented * MINOR: stream-int: Set CO_RFL transient/persistent flags apart in si_cs_rcv() * BUG/MEDIUM: stream: Stop waiting for more data if SI is blocked on RXBLK_ROOM * BUG/MEDIUM: stream-int: Notify stream that the mux wants more room to xfer data * BUG/MEDIUM: mux-h1: Adjust conditions to ask more space in the channel buffer * BUG/MINOR: stats: use refcount to protect dynamic server on dump * MINOR: server: return the next srv instance on free_server * BUG/MINOR: server: do not use refcount in free_server in stopping mode * MINOR: global: define MODE_STOPPING * MINOR: server: implement a refcount for dynamic servers * BUG/MINOR: http-ana: increment internal_errors counter on response error * BUG/MINOR: h1-htx: Fix a typo when request parser is reset * BUG/MEDIUM: leastconn: fix rare possibility of divide by zero * BUG/MINOR: server: allow 'enable health' only if check configured * BUILD: threads: fix -Wundef for _POSIX_PRIORITY_SCHEDULING on libmusl * BUILD: halog: fix a -Wundef warning on non-glibc systems * BUILD: compiler: fixed a missing test on defined(__GNUC__) * BUILD: fix dragonfly build again on __read_mostly * BUG/MINOR: vars: do not talk about global section in CLI errors for set-var * BUG/MINOR: vars: truncate the variable name in error reports about scope. * BUG/MINOR: vars: properly set the argument parsing context in the expression * MINOR: sample: add missing ARGC_ entries * BUG/MINOR: vars: improve accuracy of the rules used to check expression validity * BUILD: tools: properly guard __GLIBC__ with defined() * BUILD: ssl: fix two remaining occurrences of #if USE_OPENSSL * BUILD: ssl: next round of build warnings on LIBRESSL_VERSION_NUMBER * BUILD/MINOR: regex: avoid a build warning on USE_PCRE2 with -Wundef * IMPORT: slz: silence a build warning with -Wundef * BUILD/MINOR: ssl: avoid a build warning on LIBRESSL_VERSION with -Wundef * BUILD/MINOR: defaults: eliminate warning on MAXHOSTNAMELEN with -Wundef * BUILD: activity: use #ifdef not #if on USE_MEMORY_PROFILING * MINOR: proc: setting the process to produce a core dump on FreeBSD. * MINOR: tools: add FreeBSD support to get_exec_path() * BUILD: tools: get the absolute path of the current binary on NetBSD. * BUG/MINOR: flt-trace: fix an infinite loop when random-parsing is set * BUG/MINOR: cli/payload: do not search for args inside payload * BUILD: ist: prevent gcc11 maybe-uninitialized warning on istalloc * BUG/MINOR: connection: prevent null deref on mux cleanup task allocation * DOC: management: certificate files must be sanitized before injection * BUG/MINOR: tcpcheck: Improve LDAP response parsing to fix LDAP check * BUG/MAJOR: mux-h1: Don't eval input data if an error was reported * MINOR: pools: use mallinfo2() when available instead of mallinfo() * MINOR: pools: automatically disable malloc_trim() with external allocators * CLEANUP: pools: factor all malloc_trim() calls into trim_all_pools() * BUG/MINOR: compat: make sure __WORDSIZE is always defined * BUG/MEDIUM: stream-int: Don't block SI on a channel policy if EOI is reached * CLEANUP: mux-h1: Remove condition rejecting upgrade requests with payload * MINOR: htx: Skip headers with no value when adding a header list to a message * BUG/MEDIUM: mux-h1: Remove "Upgrade:" header for requests with payload * BUG/MINOR: systemd: ExecStartPre must use -Ws * BUG/MINOR: filters: Set right FLT_END analyser depending on channel * BUG/MINOR: filters: Always set FLT_END analyser when CF_FLT_ANALYZE flag is set * BUG/MEDIUM: http-ana: Reset channels analysers when returning an error * BUG/MINOR: stream: Don't release a stream if FLT_END is still registered * BUG/MINOR: lua: Don't yield in channel.append() and channel.set() * BUG/MINOR: lua: Yield in channel functions only if lua context can yield * MINOR: lua: Add a flag on lua context to know the yield capability at run time - Update to version 2.4.6+git0.d83fd76a1: * [RELEASE] Released version 2.4.6 * BUG/MEDIUM: filters: Fix a typo when a filter is attached blocking the release - Update to version 2.4.7+git0.b5e51a5e2: * [RELEASE] Released version 2.4.7 * BUG/MEDIUM: http-ana: Clear request analyzers when applying redirect rule - Update to version 2.4.8+git0.d1f8d41e0: * [RELEASE] Released version 2.4.8 * SCRIPTS: git-show-backports: re-enable file-based filtering * DOC/peers: some grammar fixes for peers 2.1 spec * MINOR: stream: Improve dump of bogus streams * BUILD/MINOR: cpuset freebsd build fix * DOC: config: Fix alphabetical order of fc_* samples * BUG/MINOR: sample: fix backend direction flags consecutive to last fix * BUG/MEDIUM: sample: Cumulate frontend and backend sample validity flags * BUG/MEDIUM: stream-int: Block reads if channel cannot receive more data * BUG/MINOR: http: Authorization value can have multiple spaces after the scheme * BUG/MEDIUM: http-ana: Drain request data waiting the tarpit timeout expiration * MINOR: halog: Add support for extracting captures using -hdr * BUG/MINOR: halog: Add missing newlines in die() messages * CLEANUP: halog: Use consistent indentation in help() * MINOR: halog: Rename -qry to -query * DOC: halog: Move the `-qry` parameter into the correct section in help text * MINOR: halog: Add -qry parameter allowing to preserve the query string in -uX * BUG/MEDIUM: resolvers: Track api calls with a counter to free resolutions * BUG/MEDIUM: resolvers: Don't recursively perform requester unlink * MEDIUM: resolvers: remove the last occurrences of the "safe" argument * MEDIUM: resolvers: use a kill list to preserve the list consistency * CLEANUP: resolvers: replace all LIST_DELETE with LIST_DEL_INIT * CLEANUP: resolvers: simplify resolv_link_resolution() regarding requesters * CLEANUP: always initialize the answer_list * CLEANUP: resolvers: do not export resolv_purge_resolution_answer_records() * BUG/MEDIUM: mux-h1: Perform a connection shutdown when the h1c is released * BUG/MINOR: mux-h1: Save shutdown mode if the shutdown is delayed * BUILD: atomic: fix build on mac/arm64 * BUG/MINOR: backend: fix improper insert in avail tree for always reuse * BUILD: fix compilation on NetBSD * MINOR: memprof: add one pointer size to the size of allocations * MINOR: memprof: report the delta between alloc and free on realloc() * BUG/MEDIUM: lua: fix memory leaks with realloc() on non-glibc systems * BUG/MINOR: mux-h2: do not prevent from sending a final GOAWAY frame * BUG/MINOR: task: do not set TASK_F_USR1 for no reason * BUG/MAJOR: buf: fix varint API post- vs pre- increment * BUG/MEDIUM: resolvers: always check a valid item in query_list * BUILD: resolvers: avoid a possible warning on null-deref * BUG/MAJOR: resolvers: add other missing references during resolution removal * MINOR: resolvers: merge address and target into a union "data" * BUG/MEDIUM: resolvers: use correct storage for the target address * BUG/MEDIUM: resolvers: fix truncated TLD consecutive to the API fix * MINOR: resolvers: fix the resolv_dn_label_to_str() API about trailing zero * BUG/MINOR: resolvers: do not reject host names of length 255 in SRV records * BUG/MEDIUM: resolver: make sure to always use the correct hostname length * MINOR: resolvers: fix the resolv_str_to_dn_label() API about trailing zero * BUG/MAJOR: dns: attempt to lock globaly for msg waiter list instead of use barrier * BUG/MAJOR: dns: tcp session can remain attached to a list after a free * BUG/MEDIUM: tcpcheck: Properly catch early HTTP parsing errors * Revert "CLEANUP: server: always include the storage for SSL settings" * BUG/MEDIUM: stream: Keep FLT_END analyzers if a stream detects a channel error * BUG/MEDIUM: cpuset: fix cpuset size for FreeBSD * BUG/MINOR: sample: Fix 'fix_tag_value' sample when waiting for more data * BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back * MINOR: initcall: Rename __GLOBL and __GLOBL1. * DOC: configuration: add clarification on escaping in keyword arguments * BUG/MEDIUM: mux_h2: Handle others remaining read0 cases on partial frames * BUG/MEDIUM: sample: properly verify that variables cast to sample * MINOR: sample: provide a generic var-to-sample conversion function * CLEANUP: sample: uninline sample_conv_var2smp_str() * CLEANUP: sample: rename sample_conv_var2smp() to *_sint * CLEANUP: server: always include the storage for SSL settings - (bsc#1196408) VUL-0: CVE-2022-0711: haproxy: Denial of service via set-cookie2 header o Apply upstream patch: 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch - VUL-0: CVE-2023-0056: haproxy: segfault DoS (bsc#1207181) o Apply upstream patch: 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch - VUL-0: serious vulnerability in the HTTP/1 parser (bsc#1208132) o Apply upstream patch: 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - The output buffer is not zero-initialized. If we don't clear reserved bytes, fcgi requests sent to backend will leak sensitive data. o Apply proposed patch: 0001-output-buffer-is-not-zero-initialized.path - ECO: Maint: Update haproxy to latest maintenance release for all SLE15 (jsc#PED-3821) - rebase and rename haproxy-1.6.0-sec-options.patch -> haproxy-2.4.22-sec-options.patch - remove patches covered by new release: lua54.patch 0001-BUG-MAJOR-http-htx-prevent-unbounded-loop-in-http_ma.patch 0001-BUG-MEDIUM-mux-h2-Refuse-interim-responses-with-end-.patch 0001-output-buffer-is-not-zero-initialized.path 2.0-2.5-BUG-CRITICAL-http-properly-reject-empty-http-header-.patch - Update to version 2.4.22+git0.f8e3218e2: * [RELEASE] Released version 2.4.22 * BUG/CRITICAL: http: properly reject empty http header field names * CI: github: don't warn on deprecated openssl functions on windows * BUG/MEDIUM: stconn: Schedule a shutw on shutr if data must be sent first * DOC: proxy-protocol: fix wrong byte in provided example * DOC: config: 'http-send-name-header' option may be used in default section * DOC: config: fix option spop-check proxy compatibility * BUG/MEDIUM: cache: use the correct time reference when comparing dates * BUG/MEDIUM: stick-table: do not leave entries in end of window during purge * BUG/MINOR: ssl/crt-list: warn when a line is malformated * BUG/MEDIUM: ssl: wrong eviction from the session cache tree * BUG/MINOR: fcgi-app: prevent 'use-fcgi-app' in default section * [RELEASE] Released version 2.4.21 * BUG/MINOR: sink: free the forwarding task on exit * BUILD: hpack: include global.h for the trash that is needed in debug mode * BUG/MINOR: mux-h2: add missing traces on failed headers decoding * BUG/MINOR: listener: close tiny race between resume_listener() and stopping * DOC: config: fix "Address formats" chapter syntax * BUG/MINOR: mux-fcgi: Correctly set pathinfo * DOC: config: fix aliases for protocol prefixes "udp4@" and "udp6@" * DOC: config: fix wrong section number for "protocol prefixes" * BUG/MINOR: listeners: fix suspend/resume of inherited FDs * BUG/MINOR: http-ana: make set-status also update txn->status * BUG/MINOR: http-fetch: Don't block HTTP sample fetch eval in HTTP_MSG_ERROR state * BUG/MINOR: http-ana: Report SF_FINST_R flag on error waiting the request body * BUG/MINOR: promex: Don't forget to consume the request on error * BUG/MINOR: resolvers: Wait the resolution execution for a do_resolv action * BUG/MINOR: h1-htx: Remove flags about protocol upgrade on non-101 responses * CLEANUP: htx: fix a typo in an error message of http_str_to_htx * BUG/MINOR: http: Memory leak of http redirect rules' format string * REGTEST: fix the race conditions in hmac.vtc * REGTEST: fix the race conditions in digest.vtc * REGTEST: fix the race conditions in json_query.vtc * BUG/MAJOR: buf: Fix copy of wrapping output data when a buffer is realigned * BUG/MINOR: http-fetch: Only fill txn status during prefetch if not already set * BUILD: makefile: sort the features list * BUILD: makefile: build the features list dynamically * BUG/MINOR: pool/stats: Use ullong to report total pool usage in bytes in stats * BUG/MEDIUM: mux-h2: Refuse interim responses with end-stream flag set * BUG/MINOR: ssl: Fix memory leak of find_chain in ssl_sock_load_cert_chain * LICENSE: wurfl: clarify the dummy library license. * BUG/MEDIUM: resolvers: Use tick_first() to update the resolvers task timeout * REGTESTS: startup: check maxconn computation * REGTESTS: fix the race conditions in iff.vtc * BUG/MAJOR: fcgi: Fix uninitialized reserved bytes * DOC: promex: Add missing backend metrics * MINOR: promex: introduce haproxy_backend_agg_check_status * BUG/MINOR: promex: create haproxy_backend_agg_server_status * BUG/MEDIUM: mworker: fix segv in early failure of mworker mode with peers * BUG/MINOR: ssl: Fix potential overflow * BUG/MEDIUM: ssl: Verify error codes can exceed 63 * BUG/MINOR: resolvers: Don't wait periodic resolution on healthcheck failure * BUILD: peers: peers-t.h depends on stick-table-t.h * CI: github: change "ubuntu-latest" to "ubuntu-20.04" * BUG/MEDIIM: stconn: Flush output data before forwarding close to write side * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * [RELEASE] Released version 2.4.20 * Revert "CI: determine actual OpenSSL version dynamically" * Revert "CI: switch to the "latest" LibreSSL" * SCRIPTS: announce-release: add a link to the data plane API * DOC: config: clarify the -m dir and -m dom pattern matching methods * DOC: config: clarify the fact that "retries" is not just for connections * DOC: config: explain how default matching method for ACL works * DOC: config: mention that a single monitor-uri rule is supported * DOC: config: clarify the fact that SNI should not be used in HTTP scenarios * DOC: config: provide some configuration hints for "http-reuse" * Revert "BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action" * BUG/MINOR: mux-h1: Fix handling of 408-Request-Time-Out * BUILD: http-htx: Silent build error about a possible NULL start-line * BUG/MINOR: http-htx: Don't consider an URI as normalized after a set-uri action * BUG/MINOR: log: fix parse_log_message rfc5424 size check * BUG/MINOR: cfgparse-listen: fix ebpt_next_dup pointer dereference on proxy "from" inheritance * BUILD: listener: fix build warning on global_listener_rwlock without threads * BUG/MINOR: server/idle: at least use atomic stores when updating max_used_conns * BUILD: peers: Remove unused variables * BUG/MEDIUM: peers: messages about unkown tables not correctly ignored * BUG/MINOR: ssl: don't initialize the keylog callback when not required * BUG/MINOR: http_ana/txn: don't re-initialize txn and req var lists * BUG/MEDIUM: listener: Fix race condition when updating the global mngmt task * BUG/MINOR: pool/cli: use ullong to report total pool usage in bytes * BUG/MEDIUM: ring: fix creation of server in uninitialized ring * DOC: config: fix alphabetical ordering of global section * REG-TESTS: cache: Remove T-E header for 304-Not-Modified responses * BUG/MINOR: mux-h1: Do not send a last null chunk on body-less answers * BUG/MEDIUM: mux-fcgi: Avoid value length overflow when it doesn't fit at once * BUG/MINOR: mux-fcgi: Be sure to send empty STDING record in case of zero-copy * BUG/MINOR: resolvers: Set port before IP address when processing SRV records * BUG/MINOR: http-htx: Fix error handling during parsing http replies * BUG/MEDIUM: wdt/clock: properly handle early task hangs * CI: emit the compiler's version in the build reports * CI: switch to the "latest" LibreSSL * BUG/MINOR: ssl: ocsp structure not freed properly in case of error * BUG/MINOR: ssl: Memory leak of AUTHORITY_KEYID struct when loading issuer * CI: add monthly gcc cross compile jobs * BUG/MINOR: log: fixing bug in tcp syslog_io_handler Octet-Counting * BUG/MEDIUM: stick-table: fix a race condition when updating the expiration task * BUG/MAJOR: stick-table: don't process store-response rules for applets * DOC: management: add forgotten "show startup-logs" * BUG/MINOR: stick-table: Use server_id instead of std_t_sint in process_store_rules() * CI: SSL: temporarily stick to LibreSSL=3.5.3 * CI: SSL: use proper version generating when "latest" semantic is used * BUG/MINOR: sink: Set default connect/server timeout for implicit ring buffers * BUG/MINOR: sink: Only use backend capability for the sink proxies * BUG/MEDIUM: compression: handle rewrite errors when updating response headers * BUG/MINOR: ring: Properly parse connect timeout * BUG/MINOR: log: Preserve message facility when the log target is a ring buffer * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in workflow definition * CI: Replace the deprecated `::set-output` command by writing to $GITHUB_OUTPUT in matrix.py * BUG/MINOR: server: make sure "show servers state" hides private bits * BUG/MAJOR: stick-tables: do not try to index a server name for applets * DOC: configuration: missing 'if' in tcp-request content example * BUG/MINOR: backend: only enforce turn-around state when not redispatching * BUG/MINOR: smtpchk: SMTP Service check should gracefully close SMTP transaction * MINOR: smtpchk: Update expect rule to fully match replies to EHLO commands * BUG/MINOR: mux-h1: Account consumed output data on synchronous connection error * BUILD: http_fetch: silence an uninitiialized warning with gcc-4/5/6 at -Os * BUG/MINOR: http-fetch: Update method after a prefetch in smp_fetch_meth() * BUILD: h1: silence an initiialized warning with gcc-4.7 and -Os * BUG/MEDIUM: lua: handle stick table implicit arguments right. * BUG/MEDIUM: lua: Don't crash in hlua_lua2arg_check on failure * DOC: config: Fix pgsql-check documentation to make user param mandatory * BUG/MINOR: checks: update pgsql regex on auth packet * [RELEASE] Released version 2.4.19 * BUG/MEDIUM: resolvers: Remove aborted resolutions from query_ids tree * REGTESTS: 4be_1srv_smtpchk_httpchk_layer47errors: Return valid SMTP replies * BUG/MINOR: log: improper behavior when escaping log data * SCRIPTS: announce-release: update some URLs to https * BUILD: fd: fix a build warning on the DWCAS * BUG/MEDIUM: captures: free() an error capture out of the proxy lock * DOC: fix TOC in starter guide for subsection 3.3.8. Statistics * REGTESTS: ssl/log: test the log-forward with SSL * BUG/MEDIUM: sink: bad init sequence on tcp sink from a ring. * REGTESTS: log: test the log-forward feature * REGTESTS: healthcheckmail: Relax matching on the healthcheck log message * BUG/MINOR: stats: fixing stat shows disabled frontend status as 'OPEN' * MINOR: listener: small API change * BUG/MEDIUM: proxy: ensure pause_proxy() and resume_proxy() own PROXY_LOCK * CI: cirrus-ci: bump FreeBSD image to 13-1 * BUG/MINOR: signals/poller: ensure wakeup from signals * BUG/MINOR: signals/poller: set the poller timeout to 0 when there are signals * BUG/MINOR: task: always reset a new tasklet's call date * BUG/MINOR: h1: Support headers case adjustment for TCP proxies * BUILD: makefile: enable crypt(3) for NetBSD * BUG/MINOR: regex: Properly handle PCRE2 lib compiled without JIT support * BUG/MINOR: mux-fcgi: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h1: fix the "show fd" dest buffer for the subscriber * BUG/MINOR: mux-h2: fix the "show fd" dest buffer for the subscriber * BUG/MEDIUM: mux-h1: always use RST to kill idle connections in pools * REGTESTS: http_request_buffer: Add a barrier to not mix up log messages * BUG/MEDIUM: mux-h1: do not refrain from signaling errors after end of input * BUG/MINOR: tcpcheck: Disable QUICKACK for default tcp-check (with no rule) * BUG/MINOR: hlua: Rely on CF_EOI to detect end of message in HTTP applets * BUG/MEDIUM: peers: Don't start resync on reload if local peer is not up-to-date * BUG/MEDIUM: peers: Don't use resync timer when local resync is in progress * BUG/MEDIUM: peers: Add connect and server timeut to peers proxy * BUG/MEDIUM: spoe: Properly update streams waiting for a ACK in async mode * DOC: configuration: do-resolve doesn't work with a port in the string * REGTESTS: Fix prometheus script to perform HTTP health-checks * BUG/MINOR: tcpcheck: Disable QUICKACK only if data should be sent after connect * BUG/MINOR: resolvers: return the correct value in resolvers_finalize_config() * BUG/MAJOR: mworker: fix infinite loop on master with no proxies. * BUG/MAJOR: log-forward: Fix log-forward proxies not fully initialized * BUG/MEDIUM: mux-h2: do not fiddle with ->dsi to indicate demux is idle * BUG/MEDIUM: http-ana: fix crash or wrong header deletion by http-restrict-req-hdr-names * BUILD: http: silence an uninitialized warning affecting gcc-5 * BUG/MEDIUM: ring: fix too lax 'size' parser * BUILD: debug: silence warning on gcc-5 * BUG/MEDIUM: task: relax one thread consistency check in task_unlink_wq() * BUG/MEDIUM: poller: use fd_delete() to release the poller pipes * BUILD: cfgparse: always defined _GNU_SOURCE for sched.h and crypt.h * BUG/MINOR: sink: fix a race condition between the writer and the reader * BUG/MINOR: ring/cli: fix a race condition between the writer and the reader * BUG/MEDIUM: proxy: Perform a custom copy for default server settings * REORG: server: Export srv_settings_cpy() function * MINOR: server: Constify source server to copy its settings * BUG/MEDIUM: dns: Properly initialize new DNS session * BUG/MINOR: peers: Use right channel flag to consider the peer as connected * BUG/MEDIUM: peers: limit reconnect attempts of the old process on reload * MINOR: peers: Use a dedicated reconnect timeout when stopping the local peer * BUG/MEDIUM: pattern: only visit equivalent nodes when skipping versions * MINOR: ebtree: add ebmb_lookup_shorter() to pursue lookups * MINOR: http-htx: Use new HTTP functions for the scheme based normalization * BUG/MEDIUM: h1: Improve authority validation for CONNCET request * MINOR: http: Add function to detect default port * MINOR: http: Add function to get port part of a host * BUG/MEDIUM: mworker: use default maxconn in wait mode * [RELEASE] Released version 2.4.18 * BUG/MINOR: sockpair: wrong return value for fd_send_uxst() * BUG/MINOR: backend: Fallback on RR algo if balance on source is impossible * BUILD: add detection for unsupported compiler models * BUG/MEDIUM: mworker: proc_self incorrectly set crashes upon reload * REGTESTS: Fix some scripts to be compatible with 2.4 and prior * BUG/MINOR: tools: fix statistical_prng_range()'s output range * BUG/MEDIUM: tools: avoid calling dlsym() in static builds (try 2) * BUILD: makefile: Fix install(1) handling for OpenBSD/NetBSD/Solaris/AIX * BUG/MEDIUM: tools: avoid calling dlsym() in static builds * MEDIUM: mworker: set the iocb of the socketpair without using fd_insert() * BUG/MEDIUM: mux-h1: Handle connection error after a synchronous send * BUG/MEDIUM: http-ana: Don't wait to have an empty buf to switch in TUNNEL state * BUG/MINOR: mux-h1: Be sure to commit htx changes in the demux buffer * REGTEESTS: filters: Fix CONNECT request in random-forwarding script * BUG/MEDIUM: http-fetch: Don't fetch the method if there is no stream * BUG/MINOR: http-htx: Fix scheme based normalization for URIs wih userinfo * BUG/MINOR: peers: fix possible NULL dereferences at config parsing * BUG/MINOR: http-act: Properly generate 103 responses when several rules are used * BUG/MINOR: http-check: Preserve headers if not redefined by an implicit rule * BUG/MINOR: peers/config: always fill the bind_conf's argument * MINOR: fd: Add BUG_ON checks on fd_insert() * CI: re-enable gcc asan builds * BUILD: Makefile: Add Lua 5.4 autodetect * BUG/MEDIUM: ssl/fd: unexpected fd close using async engine * MINOR: fd: add a new FD_DISOWN flag to prevent from closing a deleted FD * BUG/MINOR: http-fetch: Use integer value when possible in "method" sample fetch * BUG/MINOR: http-ana: Set method to HTTP_METH_OTHER when an HTTP txn is created * BUG/MINOR: ssl: Do not look for key in extra files if already in pem * MEDIUM: mux-h2: try to coalesce outgoing WINDOW_UPDATE frames * BUG/MEDIUM: ssl/cli: crash when crt inserted into a crt-list * BUG/MINOR: tcp-rules: Make action call final on read error and delay expiration * BUG/MINOR: cli/stats: add missing trailing LF after "show info json" * BUG/MINOR: server: do not enable DNS resolution on disabled proxies * BUG/MINOR: cli/stats: add missing trailing LF after JSON outputs * REGTESTS: healthcheckmail: Relax health-check failure condition * REGTESTS: healthcheckmail: Update the test to be functionnal again * BUG/MINOR: checks: Properly handle email alerts in trace messages * BUG/MINOR: trace: Test server existence for health-checks to get proxy * BUG/MEDIUM: mailers: Set the object type for check attached to an email alert * BUILD: compiler: implement unreachable for older compilers too * REGTESTS: restrict_req_hdr_names: Extend supported versions * REGTESTS: http_abortonclose: Extend supported versions * BUG/MINOR: ssl_ckch: Fix possible uninitialized value in show_cert I/O handler * BUG/MINOR: ssl_ckch: Dump cert transaction only once if show command yield * REGTESTS: http_request_buffer: Increase client timeout to wait "slow" clients * REGTESTS: abortonclose: Add a barrier to not mix up log messages * MEDIUM: http-ana: Always report rewrite failures as PRXCOND in logs * BUG/MEDIUM: ssl/crt-list: Rework 'add ssl crt-list' to handle full buffer cases * BUG/MEDIUM: ssl_ckch: Rework 'commit ssl cert' to handle full buffer cases * BUG/MINOR: ssl_ckch: Don't duplicate path when replacing a cert entry * BUG/MEDIUM: ssl_ckch: Don't delete a cert entry if it is being modified * BUG/MINOR: ssl_ckch: Free error msg if commit changes on a cert entry fails * DOC: intro: adjust the numbering of paragrams to keep the output ordered * DOC: peers: fix port number and addresses on new peers section format * DOC: peers: clarify when entry expiration date is renewed. * DOC: peers: indicate that some server settings are not usable * SCRIPTS: make publish-release try to launch make-releases-json * SCRIPTS: add make-releases-json to recreate a releases.json file in download dirs * REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ (2) * BUG/MEDIUM: sample: Fix adjusting size in word converter * BUG/MEDIUM: peers: prevent unitialized multiple listeners on peers section * BUG/MEDIUM: peers: fix segfault using multiple bind on peers sections * BUG/MEDIUM: resolvers: Don't defer resolutions release in deinit function * BUG/MEDIUM: http: Properly reject non-HTTP/1.x protocols * BUG/MEDIUM: tools: Fix `inet_ntop` usage in sa2str * CI: determine actual OpenSSL version dynamically * BUILD/MINOR: cpuset fix build for FreeBSD 13.1 * BUG/MINOR: peers: fix error reporting of "bind" lines * BUG/MINOR: cfgparse: abort earlier in case of allocation error * BUG/MINOR: check: Reinit the buffer wait list at the end of a check * BUG/MEDIUM: config: Reset outline buffer size on realloc error in readcfgfile() * REGTESTS: abortonclose: Fix some race conditions * BUG/MINOR: ssl: Fix crash when no private key is found in pem * MINOR: tools: add get_exec_path implementation for solaris based systems. * BUILD: fix build warning on solaris based systems with __maybe_unused. * MEDIUM: http-ana: Add a proxy option to restrict chars in request header names * CI: determine actual LibreSSL version dynamically * [RELEASE] Released version 2.4.17 * CLEANUP: mux-h1: Fix comments and error messages for global options * BUG/MEDIUM: wdt: don't trigger the watchdog when p is unitialized * BUG/MINOR: conn_stream: do not confirm a connection from the frontend path * BUG/MINOR: server: Make SRV_STATE_LINE_MAXLEN value from 512 to 2kB (2000 bytes). * DOC: install: update gcc version requirements * BUG/MEDIUM: ssl: fix the gcc-12 broken fix :-( * BUILD: listener: shut report of possible null-deref in listener_accept() * BUILD: debug: work around gcc-12 excessive -Warray-bounds warnings * BUILD: ssl: work around bogus warning in gcc 12's -Wformat-truncation * CI: dynamically determine actual version of h2spec * DOC: fix typo "ant" for "and" in INSTALL * BUG/MINOR: map/cli: make sure patterns don't vanish under "show map"'s init * BUG/MINOR: map/cli: protect the backref list during "show map" errors * BUG/MEDIUM: cli: make "show cli sockets" really yield * BUG/MEDIUM: resolvers: make "show resolvers" properly yield * BUG/MINOR: tcp/http: release the expr of set-{src,dst}[-port] * DOC: config: Update doc for PR/PH session states to warn about rewrite failures * MINOR: mux-h2: report a trace event when failing to create a new stream * BUG/MINOR: mux-h2: mark the stream as open before processing it not after * BUG/MAJOR: dns: multi-thread concurrency issue on UDP socket * BUG/MEDIUM: mux-h1: Be able to handle trailers when C-L header was specified * BUG/MEDIUM: mux-fcgi: Be sure to never set EOM flag on an empty HTX message * SCRIPTS: announce-release: add URL of dev packages * CI: github actions: update LibreSSL to 3.5.2 * [RELEASE] Released version 2.4.16 * BUILD: opentracing: Fix OT build due to misuse of var_clear() * BUILD: proto_uxst: do not set unused flag * BUILD: sockpair: do not set unused flag * BUILD: fd: remove unused variable totlen in fd_write_frag_line() * CLEANUP: acl: Remove unused variable when releasing an acl expression * BUG/MINOR: pools: make sure to also destroy shared pools in pool_destroy_all() * BUG/MINOR: resolvers: Fix memory leak in resolvers_deinit() * BUILD: compiler: properly distinguish weak and global symbols * REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc * MEDIUM: queue: use tasklet_instant_wakeup() to wake tasks * MINOR: task: add a new task_instant_wakeup() function * BUG/MINOR: rules: Fix check_capture() function to use the right rule arguments * DOC: remove my name from the config doc * BUG/MAJOR: connection: Never remove connection from idle lists outside the lock * BUG/MINOR: cache: Disable cache if applet creation fails * SCRIPTS: announce-release: add shortened links to pending issues * DOC: lua: update a few doc URLs * SCRIPTS: announce-release: update the doc's URL * BUG/MEDIUM: compression: Don't forget to update htx_sl and http_msg flags * BUG/MEDIUM: fcgi-app: Use http_msg flags to know if C-L header can be added * BUG/MEDIUM: stream: do not abort connection setup too early * BUILD: compiler: use a more portable set of asm(".weak") statements * BUILD: sched: workaround crazy and dangerous warning in Clang 14 * BUG/MEDIUM: mux-h1: Don't request more room on partial trailers * BUG/MINOR: mux-h2: use timeout http-request as a fallback for http-keep-alive * BUG/MINOR: mux-h2: do not use timeout http-keep-alive on backend side * BUILD: debug: mark the __start_mem_stats/__stop_mem_stats symbols as weak * BUG/MINOR: cache: do not display expired entries in "show cache" * BUG/MINOR: mux-h2: do not send GOAWAY if SETTINGS were not sent * CI: cirrus: switch to FreeBSD-13.0 * CI: Update to actions/cache@v3 * CI: Update to actions/checkout@v3 * DEBUG: opentracing: show return values of all functions in the debug output * CLEANUP: opentracing: added variable to store variable length * CLEANUP: opentracing: added flt_ot_smp_init() function * CLEANUP: opentracing: removed unused function flt_ot_var_get() * CLEANUP: opentracing: removed unused function flt_ot_var_unset() * DOC: opentracing: corrected comments in function descriptions * EXAMPLES: opentracing: refined shell scripts for testing filter performance * BUG/MINOR: opentracing: setting the return value in function flt_ot_var_set() * BUG/MEDIUM: http-act: Don't replace URI if path is not found or invalid * BUG/MEDIUM: http-conv: Fix url_enc() to not crush const samples * BUG/MEDIUM: mux-h1: Set outgoing message to DONE when payload length is reached * BUG/MEDIUM: promex: Be sure to never set EOM flag on an empty HTX message * BUG/MEDIUM: hlua: Don't set EOM flag on an empty HTX message in HTTP applet * BUG/MEDIUM: stats: Be sure to never set EOM flag on an empty HTX message * BUG/MINOR: fcgi-app: Don't add C-L header on response to HEAD requests * CI: github actions: update OpenSSL to 3.0.2 * BUG/MAJOR: mux_pt: always report the connection error to the conn_stream * BUG/MINOR: cli/stream: fix "shutdown session" to iterate over all threads * BUG/MINOR: samples: add missing context names for sample fetch functions * DOC: reflect H2 timeout changes * BUG/MEDIUM: mux-h2: make use of http-request and keep-alive timeouts * MEDIUM: mux-h2: slightly relax timeout management rules * BUG/MEDIUM: stream-int: do not rely on the connection error once established * BUG/MEDIUM: mux-h1: Properly detect full buffer cases during message parsing * BUG/MEDIUM: mux-fcgi: Properly handle return value of headers/trailers parsing * BUG/MINOR: tools: url2sa reads too far when no port nor path * DOC: config: Explictly add supported MQTT versions * MEDIUM: mqtt: support mqtt_is_valid and mqtt_field_value converters for MQTTv3.1 * BUG/MEDIUM: trace: avoid race condition when retrieving session from conn->owner * BUG/MEDIUM: mux-h1: only turn CO_FL_ERROR to CS_FL_ERROR with empty ibuf * CI: github actions: switch to LibreSSL-3.5.1 * BUG/MINOR: server/ssl: free the SNI sample expression * BUG/MINOR: tools: fix url2sa return value with IPv4 * [RELEASE] Released version 2.4.15 * BUILD: tree-wide: mark a few numeric constants as explicitly long long * DOC: Fix usage/examples of deprecated ACLs * BUG/MINOR: stream: make the call_rate only count the no-progress calls * BUG/MINOR: session: fix theoretical risk of memleak in session_accept_fd() * BUG/MAJOR: mux-pt: Always destroy the backend connection on detach * DEBUG: stream: Fix stream trace message to print response buffer state * DEBUG: stream: Add the missing descriptions for stream trace events * BUG/MEDIUM: mcli: Properly handle errors and timeouts during reponse processing * DEBUG: cache: Update underlying buffer when loading HTX message in cache applet * BUG/MINOR: promex: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cache: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: stats: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: hlua: Set conn-stream/channel EOI flags at the end of request * BUG/MINOR: cli: shows correct mode in "show sess" * BUG/MINOR: add missing modes in proxy_mode_str() * BUILD: pools: fix backport of no-memory-trimming on non-linux OS * MINOR: pools: add a new global option "no-memory-trimming" * BUG/MEDIUM: pools: fix ha_free() on area in the process of being freed * BUG/MINOR: pool: always align pool_heads to 64 bytes * REGTESTS: fix the race conditions in secure_memcmp.vtc * REGTESTS: fix the race conditions in normalize_uri.vtc * BUG/MEDIUM: htx: Fix a possible null derefs in htx_xfer_blks() * CI: github actions: use cache for SSL libs * CI: github actions: use cache for OpenTracing * CI: github actions: add OpenTracing builds * CI: github actions: add the output of $CC -dM -E- * [RELEASE] Released version 2.4.14 * BUG/MEDIUM: stream: Abort processing if response buffer allocation fails * CI: github: enable pool debugging by default * REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks * BUG/MINOR: proxy: preset the error message pointer to NULL in parse_new_proxy() * BUG/MAJOR: mux-h2: Be sure to always report HTX parsing error to the app layer * BUG/MEDIUM: mux-h1: Don't wake h1s if mux is blocked on lack of output buffer * BUG/MEDIUM: htx: Be sure to have a buffer to perform a raw copy of a message * BUG/MINOR: tools: url2sa reads ipv4 too far * BUG/MINOR: mailers: negotiate SMTP, not ESMTP * CI: github actions: update OpenSSL to 3.0.1 * CI: github: switch to OpenSSL 3.0.0 * CI: github actions: relax OpenSSL-3.0.0 version comparision * CI: github actions: -Wno-deprecated-declarations with OpenSSL 3.0.0 * CI: github actions: add OpenSSL-3.0.0 builds * BUILD: adopt script/build-ssl.sh for OpenSSL-3.0.0beta2 * BUILD: fix compilation for OpenSSL-3.0.0-alpha17 * CI: ssl: keep the old method for ancient OpenSSL versions * CI: ssl: do not needlessly build the OpenSSL docs * CI: ssl: enable parallel builds for OpenSSL on Linux * BUG/MAJOR: compiler: relax alignment constraints on certain structures * BUG/MEDIUM: fd: always align fdtab[] to 64 bytes * BUG/MEDIUM: resolvers: Really ignore trailing dot in domain names * BUG/MINOR: sink: Use the right field in appctx context in release callback * BUG/MINOR: mworker: fix a FD leak of a sockpair upon a failed reload * BUG/MEDIUM: mworker: close unused transferred FDs on load failure * MINOR: sock: move the unused socket cleaning code into its own function * [RELEASE] Released version 2.4.13 * BUG/MINOR: mux-h2: update the session's idle delay before creating the stream * BUG/MEDIUM: h2/hpack: fix emission of HPACK DTSU after settings change * REGTESTS: peers: leave a bit more time to peers to synchronize * BUG/MAJOR: spoe: properly detach all agents when releasing the applet * BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies * BUG/MEDIUM: listener: read-lock the listener during accept() * MINOR: listener: replace the listener's spinlock with an rwlock * BUG/MINOR: mworker: does not erase the pidfile upon reload * BUG/MAJOR: sched: prevent rare concurrent wakeup of multi-threaded tasks * DEBUG: pools: replace the link pointer with the caller's address on pool_free() * DEBUG: pools: let's add reverse mapping from cache heads to thread and pool * DEBUG: pools: add extra sanity checks when picking objects from a local cache * BUG/MINOR: pools: always flush pools about to be destroyed * BUG/MEDIUM: mworker: don't lose the stats socket on failed reload * DEBUG: pools: add new build option DEBUG_POOL_INTEGRITY * BUILD: debug/cli: condition test of O_ASYNC to its existence * DEBUG: cli: add a new "debug dev fd" expert command * MEDIUM: h2/hpack: emit a Dynamic Table Size Update after settings change * BUG/MEDIUM: mcli: always realign wrapping buffers before parsing them * BUG/MEDIUM: mcli: do not try to parse empty buffers * BUG/MEDIUM: cli: Never wait for more data on client shutdown * BUG/MINOR: cli: avoid O(bufsize) parsing cost on pipelined commands * MINOR: channel: add new function co_getdelim() to support multiple delimiters * MEDIUM: cli: yield between each pipelined command * BUG/MEDIUM: server: avoid changing healthcheck ctx with set server ssl * BUILD/MINOR: fix solaris build with clang. * BUG/MEDIUM: htx: Adjust length to add DATA block in an empty HTX buffer * BUG/MEDIUM: connection: properly leave stopping list on error * [RELEASE] Released version 2.4.12 * BUG/MAJOR: mux-h1: Don't decrement .curr_len for unsent data * BUG/MEDIUM: mworker: don't use _getsocks in wait mode * [RELEASE] Released version 2.4.11 * BUG/MEDIUM: http-ana: Preserve response's FLT_END analyser on L7 retry * BUG/MINOR: cli: fix _getsocks with musl libc * BUILD/MINOR: tools: solaris build fix on dladdr. * BUILD/MINOR: cpuset FreeBSD 14 build fix. * BUG/MEDIUM: ssl: free the ckch instance linked to a server * BUG/MINOR: ssl: free the fields in srv->ssl_ctx * MINOR: debug: add support for -dL to dump library names at boot * MINOR: debug: add ability to dump loaded shared libraries * MINOR: compat: detect support for dl_iterate_phdr() * BUG/MINOR: mux-h1: Fix splicing for messages with unknown length * BUG/MEDIUM: mux-h1: Fix splicing by properly detecting end of message * BUILD: makefile: add -Wno-atomic-alignment to work around clang abusive warning * MINOR: proxy: add option idle-close-on-response * REGTESTS: ssl: fix ssl_default_server.vtc * BUG/MEDIUM: ssl: initialize correctly ssl w/ default-server * DOC: fix misspelled keyword "resolve_retries" in resolvers * BUILD: ssl: unbreak the build with newer libressl * BUILD: cli: clear a maybe-unused warning on some older compilers * BUG/MINOR: pools: don't mark ourselves as harmless in DEBUG_UAF mode * BUG/MEDIUM: backend: fix possible sockaddr leak on redispatch * [RELEASE] Released version 2.4.10 * BUG/MINOR: backend: restore the SF_SRV_REUSED flag original purpose * BUG/MINOR: backend: do not set sni on connection reuse * MINOR: pools: work around possibly slow malloc_trim() during gc * BUG/MEDIUM: mworker/cli: crash when trying to access an old PID in prompt mode * DOC: config: retry-on list is space-delimited * DOC: config: Specify %Ta is only available in HTTP mode * DOC: spoe: Clarify use of the event directive in spoe-message section * BUG/MINOR: cli/server: Don't crash when a server is added with a custom id * IMPORT: slz: use the correct CRC32 instruction when running in 32-bit mode * BUILD: tree-wide: avoid warnings caused by redundant checks of obj_types * MINOR: cli: "show version" displays the current process version * CI: Github Actions: temporarily disable BoringSSL builds * BUILD: bug: Fix error when compiling with -DDEBUG_STRICT_NOCRASH * MINOR: mux-h1: Improve H1 traces by adding info about http parsers * BUG/MAJOR: segfault using multiple log forward sections. * BUG/MEDIUM: resolvers: Detach query item on response error * BUG/MINOR: server: Don't rely on last default-server to init server SSL context * BUG/MEDIUM: cli: Properly set stream analyzers to process one command at a time * BUILD/MINOR: server: fix compilation without SSL * [RELEASE] Released version 2.4.9 * BUG/MINOR: cache: Fix loop on cache entries in "show cache" * MINOR: promex: backend aggregated server check status * MINOR: server: add ws keyword * MEDIUM: server/backend: implement websocket protocol selection * MINOR: connection: add alternative mux_ops param for conn_install_mux_be * MINOR: connection: implement function to update ALPN * MINOR: stream/mux: implement websocket stream flag * BUG/MINOR: ssl: make SSL counters atomic * MINOR: shctx: add a few BUG_ON() for consistency checks * BUG/MINOR: shctx: do not look for available blocks when the first one is enough * BUG/MEDIUM: shctx: leave the block allocator when enough blocks are found * BUG/MEDIUM: cache/cli: make "show cache" thread-safe * BUG/MEDIUM: mux-h2: always process a pending shut read * BUG/MEDIUM: ssl: abort with the correct SSL error when SNI not found * CLEANUP: ssl: fix wrong #else commentary * BUG/MINOR: ssl: free correctly the sni in the backend SSL cache * BUG/MEDIUM: ssl: backend TLS resumption with sni and TLSv1.3 * BUILD: makefile: simplify detection of libatomic * BUG/MEDIUM: mux-h1: Handle delayed silent shut in h1_process() to release H1C * BUG/MINOR: stick-table/cli: Check for invalid ipv6 key * BUG/MEDIUM: connection: make cs_shutr/cs_shutw//cs_close() idempotent * BUG/MINOR: mux-h2: Fix H2_CF_DEM_SHORT_READ value * BUG/MINOR: mworker: doesn't launch the program postparser * BUG/MEDIUM: conn-stream: Don't reset CS flags on close * MINOR: mux-h1: Slightly Improve H1 traces * DOC: lua: Be explicit with the Reply object limits * Revert "BUG/MINOR: http-ana: Don't eval front after-response rules if stopped on back" * BUG/MINOR: http-ana: Apply stop to the current section for http-response rules * DOC: config: Fix typo in ssl_fc_unique_id description * BUG/MINOR: cache: properly ignore unparsable max-age in quotes * BUG/MINOR: resolvers: throw log message if trash not large enough for query * BUG/MINOR: resolvers: fix sent messages were counted twice * BUG/MEDIUM: mux-h2: reject upgrade if no RFC8441 support * MINOR: mux-h2: add trace on extended connect usage * MINOR: mux-h2: perform a full cycle shutdown+drain on close * MINOR: connection: add a new CO_FL_WANT_DRAIN flag to force drain on close - VUL-0: CVE-2023-40225: haproxy: reject any empty content-length header value (bsc#1214102) Apply upstream patch adapted for 2.4.22 (patch h2_parse_cont_len_header() instead of http_parse_cont_len_header()) Add patch: 0001-BUG-MAJOR-http-reject-any-empty-content-length-heade.patch - VUL-0: CVE-2023-45539: haproxy: misinterpretation of a path_end rule with # as part of the URI component (bsc#1217653) Apply upstream patch. Add patch: 0001-BUG-MINOR-h1-do-not-accept-as-part-of-the-URI-compon.patch - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Update to version 3.13.0 (bsc#1215588): * bump version to v3.13.0 * Fix leaking goroutines in Install * chore(deps): bump github.com/containerd/containerd from 1.7.3 to 1.7.6 * chore(deps): bump github/codeql-action from 2.21.5 to 2.21.7 * Update Helm to use k8s 1.28.2 libraries * chore(deps): bump github.com/cyphar/filepath-securejoin * make the dependabot k8s.io group explicit * use dependabot's group support for k8s.io dependencies * chore(deps): bump transparencylog/github-releases-asset-transparency-verify-action * chore(deps): bump github/codeql-action from 2.21.4 to 2.21.5 * doc:Executing helm rollback release 0 will roll back to the previous release * add check if all migrations already applied * chore(deps): bump github.com/moby/term * chore(deps): bump actions/checkout from 3.5.3 to 3.6.0 * chore(deps): bump golang.org/x/term from 0.10.0 to 0.11.0 * Use labels instead of selectorLabels for pod labels * fix(helm): fix GetPodLogs, the hooks should be sorted before get the logs of each hook * chore(deps): bump github.com/rubenv/sql-migrate from 1.5.1 to 1.5.2 * add rollback unit test * fix: helm rollback err tips * chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.3 * Add Ian Zink (z4ce) as triage maintainer * chore(deps): bump github/codeql-action from 2.21.3 to 2.21.4 * chore: HTTPGetter add default timeout * fix: precedence typo * Avoid nil dereference if passing a nil resolver * Add required changes after merge * goimports * Fix #3352, add support for --ignore-not-found just like kubectl delete * chore(deps): bump github/codeql-action from 2.21.2 to 2.21.3 * chore(deps): bump actions/setup-go from 4.0.1 to 4.1.0 * Fix helm may identify achieve of the application/x-gzip as application/vnd.ms-fontobject * Restore `helm get metadata` command * Revert "Add `helm get metadata` command" * Update pkg/action/install.go * test: replace `ensure.TempDir` with `t.TempDir` * chore(deps): bump github/codeql-action from 2.21.0 to 2.21.2 * use json api url + report curl/wget error on fail * Added error in case try to supply custom label with name of system label during install/upgrade * Updated per feedback from gjenkins8 * fix(main): fix basic auth for helm pull or push * chore(deps): bump github.com/sirupsen/logrus from 1.9.0 to 1.9.3 * cmd: support generating index in JSON format * repo: detect JSON and unmarshal efficiently * Tweaking new dry-run internal handling * chore(deps): bump github/codeql-action from 2.20.3 to 2.21.0 * chore(deps): bump github.com/stretchr/testify from 1.8.2 to 1.8.4 * chore(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 * chore(deps): bump github.com/opencontainers/image-spec * bump kubernetes modules to v0.27.3 * chore(deps): bump actions/checkout from 3.2.0 to 3.5.3 * chore(deps): bump actions/setup-go from 3.5.0 to 4.0.1 * chore(deps): bump github/codeql-action from 2.1.37 to 2.20.3 * chore(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * chore(deps): bump golang.org/x/crypto from 0.5.0 to 0.11.0 * chore(deps): bump golang.org/x/text from 0.9.0 to 0.11.0 * chore(deps): bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 * chore(deps): bump github.com/docker/docker * Remove warning for template directory not found. * Add gjenkins8 as triage maintainer * Added tests for created OCI annotation time format * Add created OCI annotation * Fix multiple bugs in values handling * chore: fix a typo in `manager.go` * chore(deps): bump github.com/rubenv/sql-migrate from 1.3.1 to 1.5.1 * add GetRegistryClient method * chore(deps): bump oras.land/oras-go from 1.2.2 to 1.2.3 * oci: add tests for plain HTTP and insecure HTTPS registries * chore(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 * oci: Add flag `--plain-http` to enable working with HTTP registries * docs: add an example for using the upgrade command with existing values * Replace `fmt.Fprintf` with `fmt.Fprint` in get_metadata.go * Replace `fmt.Fprintln` with `fmt.Fprintf` in get_metadata.go * update kubernetes dependencies from v0.27.0 to v0.27.1 * Add ClientOptResolver to test util file * Check that missing keys are still handled in tpl * chore(deps): bump github.com/docker/distribution * tests: change crd golden file to match after #11870 * Adding details on the Factory interface * move Joe Julian to maintainer * update autoscaling/v2beta1 to autoscaling/v2 in skeleton chart * chore(deps): bump github.com/Masterminds/squirrel from 1.5.3 to 1.5.4 * chore(deps): bump github.com/lib/pq from 1.10.7 to 1.10.9 * chore(deps): bump github.com/Masterminds/semver/v3 from 3.2.0 to 3.2.1 * bump version to v3.12.0 * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster to be able to render lookup functions. Closes #8137 * Updating the Helm maintainers * strip trailing newline from Files.Lines * add some test case * fix comment grammar error. * bugfix:(#11391) helm lint infinite loop when malformed template object * pkg/engine: fix nil-dereference * pkg/chartutil: fix nil-dereference * pkg/action: fix nil-dereference * full source path when output-dir is not provided * Update cmd/helm/upgrade.go * Update cmd/helm/install.go * added Contributing.md section and ref link in the README * fix: add podLabels * feat(helm): add ability for --dry-run to do lookup functions When a helm command is run with the --dry-run flag, it will try to connect to the cluster if the value is 'server' to be able to render lookup functions. Closes #8137 * feat(helm): add ability for --dry-run to do lookup functions * Add `CHART`, `VERSION` and `APP_VERSION` fields to `get all` command output * Adjust `get` command description to account metadata * fix typo: mountPath * add volumes and volumeMounts in chartutil * Seed a default switch to control `automountServiceAccountToken` * Avoid confusing error when passing in '--version X.Y.Z' * Use errors.Is to compare * Add `helm get metadata` command * Use wrapped error so that ErrNoObjectsVisited can be compared after return. * Add exact version test. See also #7563 Signed-off-by: Igor Manushin <igor.manushin@gmail.com> * Update dependabot config to include github actions * strict file permissions of repository.yaml * Check redefinition of define and include in tpl * Check that `.Template` is passed through `tpl` * Make sure empty `tpl` values render empty. * Pick the test improvement out of PR#8371 * #11369 Use the correct index repo cache directory in the `parallelRepoUpdate` method as well * #11369 Add a test case to prove the bug and its resolution * ref(helm): export DescriptorPullSummary fields * feat(helm): add 'ClientOptResolver' ClientOption * Fix flaky TestSQLCreate test by making sqlmock ignore order of sql requests * Fixing tests after adding labels to release fixture * Make default release fixture contain custom labels to make tests check that labels are not lost * Added support for storing custom labels in SQL storage driver * Adding support merging new custom labels with original release labels during upgrade * Added note to install/upgrade commands that original release labels wouldn't be persisted in upgraded release * Added unit tests for implemented install/upgrade labels logic * Remove redudant types from util_test.go * Added tests for newly introduced util.go functions * Fix broken tests for SQL storage driver * Fix broken tests for configmap and secret storage drivers * Make superseded releases keep labels * Support configmap storage driver for install/upgrade actions - -labels argument * Added upgrade --install labels argument support * Add labels support for install action with secret storage backend * test: added tests to load plugin from home dir with space * fix: plugin does not load when helm base dir contains space * Add priority class to kind sorter * Fixes #10566 * test(search): add mixedCase test case * fix(search): print repo search result in original case * Adjust error message wrongly claiming that there is a resource conflict * Throw an error from jobReady() if the job exceeds its BackoffLimit * github: add Asset Transparency action for GitHub releases - Update to version 3.13.1: * Fixing precedence issue with the import of values. * Add missing with clause to release gh action * FIX Default ServiceAccount yaml * fix(registry): unswallow error * remove useless print during prepareUpgrade * fix(registry): address anonymous pull issue * Fix missing run statement on release action * Write latest version to get.helm.sh bucket * chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 * Increased release information key name max length. * chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Update to version 3.13.2 (bsc#1217013): * chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 * Update get-helm-3 * chore(deps): bump github.com/docker/docker * Fixing release labelling in rollback * Drop filterSystemLabels usage from Query method * Apply review suggestions * Allow using label selectors for system labels for sql backend. * Allow using label selectors for system labels for secrets and configmap backends. * Revert "fix(main): fix basic auth for helm pull or push" * Revert "fix(registry): address anonymous pull issue" * chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 * Update get-helm-3 to get version through get.helm.sh - Update to version 3.13.3: * Updating Helm libraries for k8s 1.28.4 * Remove excessive logging * chore(create): indent to spaces - Update to version 3.14.0: * Notable Changes - New helm search flag of --fail-on-no-result - Allow a nested tpl invocation access to defines - Speed up the tpl function - Added qps/HELM_QPS parameter that tells Kubernetes packages how to operate - Added --kube-version to lint command - The ignore pkg is now public * Changelog - Improve release action - bump version to - Fix issues when verify generation readiness was merged - fix test to use the default code's k8sVersionMinor - lint: Add --kube-version flag to set capabilities and deprecation rules - Update to Go 1.21 for builds - chore(deps): bump github.com/containerd/containerd from 1.7.6 to 1.7.11 - chore(deps): bump github.com/spf13/cobra from 1.7.0 to 1.8.0 - Removing Asset Transparency - tests(pkg/engine): test RenderWithClientProvider - Make the `ignore` pkg public again - chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 - Updating to Kubernetes 1.29.0 libraries - feature(pkg/engine): introduce RenderWithClientProvider - chore(deps): bump github/codeql-action from 2.22.10 to 3.22.11 - chore(deps): bump github/codeql-action from 2.22.9 to 2.22.10 - Updating Helm libraries for k8s 1.28.4 - chore(deps): bump github/codeql-action from 2.22.8 to 2.22.9 - Remove excessive logging - chore(deps): bump github/codeql-action from 2.22.7 to 2.22.8 - chore(deps): bump github/codeql-action from 2.22.5 to 2.22.7 - Update CONTRIBUTING.md - Fixing release labelling in rollback - chore(deps): bump github.com/docker/docker - chore(deps): bump github/codeql-action from 2.22.4 to 2.22.5 - feat: move livenessProbe and readinessProbe values to default values file - Revert "fix(main): fix basic auth for helm pull or push" - chore(deps): bump google.golang.org/grpc from 1.54.0 to 1.56.3 - Revert "fix(registry): address anonymous pull issue" - Update get-helm-3 - chore(deps): bump github/codeql-action from 2.22.3 to 2.22.4 - chore(deps): bump actions/checkout from 3.6.0 to 4.1.1 - chore(deps): bump github/codeql-action from 2.21.8 to 2.22.3 - Drop filterSystemLabels usage from Query method - Apply review suggestions - Update get-helm-3 to get version through get.helm.sh - feat: print failed hook name - chore(deps): bump golang.org/x/net from 0.13.0 to 0.17.0 - Fixing precedence issue with the import of values. - chore(create): indent to spaces - Allow using label selectors for system labels for sql backend. - Allow using label selectors for system labels for secrets and configmap backends. - remove useless print during prepareUpgrade - Add missing with clause to release gh action - FIX Default ServiceAccount yaml - fix(registry): address anonymous pull issue - fix(registry): unswallow error - Fix missing run statement on release action - Add qps/HELM_QPS parameter - chore(deps): bump oras.land/oras-go from 1.2.3 to 1.2.4 - chore(deps): bump github/codeql-action from 2.21.7 to 2.21.8 - bump version to v3.13.0 - chore(deps): bump github.com/evanphx/json-patch - chore(deps): bump golang.org/x/text from 0.11.0 to 0.13.0 - Write latest version to get.helm.sh bucket - Increased release information key name max length. - Pin gox to specific commit - Remove `GoFish` from package managers for installing the binary - Test update for "Allow a nested `tpl` invocation access to `defines` in a containing one" - Test update for "Speed up `tpl`" - addressing comment - Add support for RISC-V - lint and validate dependency metadata to reference dependencies with a unique key (name or alias) - Work around template.Clone omitting options - fix: pass 'passCredentialsAll' as env-var to getter - feat: pass basic auth to env-vars when running download plugins - helm search: New CLI Flag --fail-on-no-result - Update pkg/kube/ready.go - fix post install hook deletion due to before-hook-creation policy - Allow a nested `tpl` invocation access to `defines` in a containing one - Remove the 'reference templates' concept - Speed up `tpl` - ready checker- comment update - ready checker- remove duplicate statefulset generational check - Verify generation in readiness checks - feat(helm): add --reset-then-reuse-values flag to 'helm upgrade' - determine git commit hash automatically - Update to version 3.14.1 (bsc#1219969, CVE-2024-25620): * validation fix - Update to version 3.14.2 (bsc#1220207, CVE-2024-26147): * Fix for uninitialized variable in yaml parsing - add CVE-2024-25620.patch (bsc#1219969, CVE-2024-25620): * dependency management path traversal - add CVE-2024-26147.patch (bsc#1220207, CVE-2024-26147): - Update to version 3.14.3: * Add a note about --dry-run displaying secrets * add error messages * Fix: Ignore alias validation error for index load * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 * Update architecture detection method - Update to version 3.14.4: Helm v3.14.4 is a patch release. Users are encouraged to upgrade for the best experience. Users are encouraged to upgrade for the best experience. * refactor: create a helper for checking if a release is uninstalled 81c902a (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 5a11c76 (Alex Petrov) * chore: remove repetitive words fb3d880 (deterclosed) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 01ac4a2 (dependabot[bot]) * chore(deps): bump github.com/docker/docker 138602d (dependabot[bot]) * bug: add proxy support for oci getter aa7d953 (Ricardo Maraschini) - Update to version 3.15.0: Helm v3.15.0 is a feature release. Users are encouraged to upgrade for the best experience. * Updating to k8s 1.30 c4e37b3 (Matt Farina) * bump version to v3.15.0 d7afa3b (Matt Farina) * bump version to 7743467 (Matt Farina) * Fix namespace on kubeconfig error 214fb6e (Calvin Krist) * Update testdata PKI with keys that have validity until 3393 (Fixes #12880) 1b75d48 (Dirk Müller) * chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 dac23c8 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.7 to 3.24.10 167d576 (dependabot[bot]) * chore: remove repetitive words dd37787 (deterclosed) * Modified how created annotation is populated based on package creation time 0a69a0d (Andrew Block) * chore(deps): bump github.com/docker/docker aaaf112 (dependabot[bot]) * chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 7f53529 (dependabot[bot]) * Enabling hide secrets on install and upgrade dry run 25c4738 (Matt Farina) * chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ff94e93 (dependabot[bot]) * Fixing all the linting errors d58d7b3 (Robert Sirchia) * Add a note about --dry-run displaying secrets a23dd9e (Matt Farina) * chore(deps): bump golang.org/x/term from 0.15.0 to 0.18.0 275f2ab (dependabot[bot]) * Updating .gitignore 8b424ba (Robert Sirchia) * chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 e22d881 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.24.3 to 3.24.5 4f200fa (dependabot[bot]) * Some fixes 764557c (Matt Farina) * chore(deps): bump github/codeql-action from 3.23.1 to 3.24.3 5bc97b9 (dependabot[bot]) * chore(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 e6db0ec (dependabot[bot]) * add error messages 8d19bcb (George Jenkins) * Fix: Ignore alias validation error for index load 68294fd (George Jenkins) * validation fix 8e6a514 (Matt Farina) * bug: add proxy support for oci getter 94c1dea (Ricardo Maraschini) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 cbab6d6 (dependabot[bot]) * chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 de332ae (dependabot[bot]) * chore(deps): bump github.com/containerd/containerd from 1.7.11 to 1.7.12 a2dd34b (dependabot[bot]) * Update architecture detection method 57a1bb8 (weidongkl) * chore(deps): bump github/codeql-action from 3.22.11 to 3.23.0 8cab7c1 (dependabot[bot]) * chore(deps): bump github.com/DATA-DOG/go-sqlmock from 1.5.0 to 1.5.2 5f9533f (dependabot[bot]) * Improve release action 4790bb9 (George Jenkins) * chore(deps): bump actions/setup-go from 4.1.0 to 5.0.0 f980ad3 (dependabot[bot]) * Fix grammatical error c25736c (Matt Carr) * Updated for review comments d2cf8c6 (MichaelMorris) * Add robustness to wait status checks fc74964 (MichaelMorris) * refactor: create a helper for checking if a release is uninstalled f908379 (Alex Petrov) * fix: reinstall previously uninstalled chart with --keep-history 9e198fa (Alex Petrov) - Update to version 3.15.1: * Fixing build issue where wrong version is used - Update to version 3.15.2: * fix: wrong cli description * fix typo in load_plugins.go * fix docs of DeployedAll * Bump github.com/docker/docker * bump oras minor version * feat(load.go): add warning on requirements.lock - Update to version 3.15.3: * fix(helm): Use burst limit setting for discovery * fixed dependency_update_test.go * fix(dependencyBuild): prevent race condition in concurrent helm dependency * fix: respect proxy envvars on helm install/upgrade * Merge pull request #13085 from alex-kattathra-johnson/issue-12961 - Update to version 3.15.4: * Bump the k8s-io group across 1 directory with 7 updates * Bump github.com/docker/docker - Update to version 3.16.0: Helm v3.16.0 is a feature release. Users are encouraged to upgrade for the best experience. * Notable Changes - added sha512sum template function - added ActiveHelp for cmds that don't take any more args - drops very old Kubernetes versions support in helm create - add --skip-schema-validation flag to helm 'install', 'upgrade' and 'lint' - fixed bug to now use burst limit setting for discovery - Added windows arm64 support * Full changelog see https://github.com/helm/helm/releases/tag/v3.16.0 - Update to version 3.16.1: * bumping version to 1.22.7 * Merge pull request #13327 from mattfarina/revert-11726 - Update to version 3.16.2: * Revering change unrelated to issue #13176 * adds tests for handling of Helm index with broken chart versions #13176 * improves handling of Helm index with broken helm chart versions [#13176] * Bump the k8s-io group with 7 updates * adding check-latest:true * Grammar fixes * Fix typos - Update to version 3.16.3: * fix: fix label name * Fix typo in pkg/lint/rules/chartfile_test.go * Increasing the size of the runner used for releases. * fix(hooks): correct hooks delete order * Bump github.com/containerd/containerd from 1.7.12 to 1.7.23 - Initial version - Add do_not_install_docs.patch: don't let make install docs - Supply LICENSE files with libraries - Update to 0.9.0 - Switch upstream to libusb/hidapi because the original maintainer is not active anymore - Use disabled services to follow Factory guidelines. - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through the -mini flavors. - Update to version 0.10.1 * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI * Add hid_version/hid_version_str API (#192) * Add podspec to support releases via cocoapods * Add support for HID over I2C and uhid devices (#166) * Fix small casting issue * Fix race condition on device close (#189) * Fix API prototype for gcc flag -Wstrict-prototypes (#207) * Fix strict typecast (#206) * Fix -Wall -Wextra -pedantic -Werror compilation (#214) … * Drop workaround for kernel < 2.6.34 * Use pkg-config to find libusb on *freebsd * Reattach kernel driver in hidapi-libusb * Move local variable declaration to the beginning of the function - Update to version 0.357 (bsc#1196332): + Updated pci, usb and vendor ids. - Update to version 0.358 (bsc#1196332): + Updated pci, usb and vendor ids. - Update to version 0.359: + Updated pci, usb and vendor ids. - Update to version 0.360 (bsc#1200110): + Updated pci, usb and vendor ids. - update to 0.361: + Updated pci, usb and vendor ids. - update to 0.362: + Updated pci, usb and vendor ids. - update to 0.363: + Updated pci, usb and vendor ids. - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - Update to version 0.357 (bsc#1196332): + Updated pci, usb and vendor ids. - Update to version 0.358 (bsc#1196332): + Updated pci, usb and vendor ids. - Update to version 0.359: + Updated pci, usb and vendor ids. - Update to version 0.360 (bsc#1200110): + Updated pci, usb and vendor ids. - update to 0.361: + Updated pci, usb and vendor ids. - update to 0.362: + Updated pci, usb and vendor ids. - update to 0.363: + Updated pci, usb and vendor ids. - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - Update to version 0.359: + Updated pci, usb and vendor ids. - Update to version 0.360 (bsc#1200110): + Updated pci, usb and vendor ids. - update to 0.361: + Updated pci, usb and vendor ids. - update to 0.362: + Updated pci, usb and vendor ids. - update to 0.363: + Updated pci, usb and vendor ids. - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - update to 0.379: * Update pci, usb and vendor ids - update to 0.380: * Update pci, usb and vendor ids - Update to version 0.359: + Updated pci, usb and vendor ids. - Update to version 0.360 (bsc#1200110): + Updated pci, usb and vendor ids. - update to 0.361: + Updated pci, usb and vendor ids. - update to 0.362: + Updated pci, usb and vendor ids. - update to 0.363: + Updated pci, usb and vendor ids. - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - update to 0.379: * Update pci, usb and vendor ids - update to 0.380: * Update pci, usb and vendor ids - update to 0.363: + Updated pci, usb and vendor ids. - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - update to 0.379: * Update pci, usb and vendor ids - update to 0.380: * Update pci, usb and vendor ids - update to 0.382: * Update pci, usb and vendor ids - update to 0.383: * Update pci and vendor ids - update to 0.385: * Update pci and vendor ids - update to 0.389: * Update pci and vendor ids - update to 0.363: + Updated pci, usb and vendor ids. - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - update to 0.379: * Update pci, usb and vendor ids - update to 0.380: * Update pci, usb and vendor ids - update to 0.382: * Update pci, usb and vendor ids - update to 0.383: * Update pci and vendor ids - update to 0.385: * Update pci and vendor ids - update to 0.389: * Update pci and vendor ids - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - update to 0.379: * Update pci, usb and vendor ids - update to 0.380: * Update pci, usb and vendor ids - update to 0.382: * Update pci, usb and vendor ids - update to 0.383: * Update pci and vendor ids - update to 0.385: * Update pci and vendor ids - update to 0.389: * Update pci and vendor ids - update to 0.390: * Update pci and vendor ids - update to 0.364: + Updated pci, usb and vendor ids. - update to 0.365: + Updated pci, usb and vendor ids. - update to 0.366: * Update pci, usb and vendor ids - update to 0.367: * Update pci, usb and vendor ids - update to 0.368: * Update pci, usb and vendor ids - update to 0.369: * Update pci, usb and vendor ids - update to 0.370: * Update pci, usb and vendor ids - update to 0.371: * Update pci, usb and vendor ids - update to 0.372: * Update pci, usb and vendor ids - update to 0.373: * Update pci, usb and vendor ids - update to 0.376: * Update pci, usb and vendor ids - update to 0.377: * Fixed trailing spaces in pnp.ids - update to 0.378: * Update pci, usb and vendor ids - update to 0.379: * Update pci, usb and vendor ids - update to 0.380: * Update pci, usb and vendor ids - update to 0.382: * Update pci, usb and vendor ids - update to 0.383: * Update pci and vendor ids - update to 0.385: * Update pci and vendor ids - update to 0.389: * Update pci and vendor ids - update to 0.390: * Update pci and vendor ids - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Implement missing ignition-kargs-helper script for kernel argument support - Update to version 2.11.0: * news: add notes for 2.11.0 * Upgraded docs * config/*: return report from previous parser when chaining * config/*: re-order testcases by version * tree: update for stable v3.3.0 and new v3.4.0-experimental * config/v3_4_experimental: adapt for experimental * config/v3_4_experimental: copy from config/v3_3 * config/v3_3: adapt for stabilization * config/v3_3_experimental: rename to config/v3_3 * config/v3_3_exp: pointerify ClevisCustom Config and Pin * config/v3_3_exp: pointerify Raid.Level * config/v3_3_exp: pointerify LinkEmbedded1.Target * stages/disks: simplify a check * config/v3_1/translate: don't point to field from input struct * config/v3_3_exp: drop devices from schema "required" field * config/*: validate that storage.raid.devices is non-empty * config/*/types: add RAID validation tests * config/shared/errors: fix ErrSparesUnsupportedForLevel message * config: fix comment * *: formally bump Go to 1.13 * platform: add powervs platform * internal/providers/*stack: drop dead timeout code * stages/disks: improve error reporting for LUKS device reuse * ignition-setup-user.service: drop Before=multipathd.service * Dockerfile: build ignition-validate container using Fedora * workflows: test on Go 1.16 * tests/*: verify deletion of block device w/o creating a FS * *: allow erasing block device without creating a filesystem * *: rename other projects' master branches to main * *: rename master branch to main * config/*: add export functions for parsing any config version < N * config/*: refactor config.go's Parse() to use GetConfigVersion * config/* : minor cleanup - Refreshed to match new Ignition spec * 0002-allow-multiple-mounts-of-same-device.patch - If a Combustion device was mounted, then unmount it in ignition-kargs-helper - the replacement script will be put on the same location - Ignore error return code if no virtualization environment detected. [bsc#1188479] This makes it possible to use Ignition also on bare metal (e.g. when dumping images directly to disk) without adding a ignition.platform.id parameter. - Include vfat and nls kernel modules into initrd so that we can read the ignition configuration from USB drives [bsc#1184202] - Update to version 2.12.0: * news: add notes for 2.12.0 * stages/files: add previousReport to result report * tests: fix linter warning * workflows: limit permissions to reading repo contents * workflows: bump linter version * go.mod: revendor * Drop EOL Go versions * internal/distro: drop DiskByIDDir * providers/azure: add support for azure gen2 VMs [bsc#1196679] * stages/mount: correctly relabel the root of a fresh ext4 filesystem * exec: fix permissions for mountpoints in home dirs * tests: drop os.ModeDir requirement in mode of output directories * examples: reboot with --force * exec/util: add blkid API to query block devices based on FSTYPE * stages/files: use IntToPtr() in createCrypttabEntries() * stages/files: write result report to /var/lib/ignition * engine: persist fetched config summaries in State * stages/disks: use State to persist keyfiles for files stage * *: add general mechanism for persisting state between stages * main: drop -clear-cache flag * engine: don't hardcode neednet path * fetch-offline: return ErrNeedNet if we need net * engine: switch Engine.logReport() to pointer receiver * engine: fix incorrect error in log message * dracut: drop ignition-setup-user.service * dracut: drop reference to ignition-setup-base.service * providers/gcp: access GCP metadata service by IP address * Remove ignition-firstboot-complete.service * OWNERS: remove * internal/exec/util: drop device argument from cResultToErr() * docs/config*: document storage.luks.clevis.threshold default * ci: disable spec bump external test workaround * docs: Add Ignition release / Spec version table * templates: update example releng signing ticket * templates: don't update %gotest lines * Provide ignition-firstboot-complete.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version; removed all non-SUSE specific stuff and integrated our own changes * Removed change-ignition-firstboot-path.conf (changes are integrated into ignition-firstboot-complete.service now). * Provide ignition-setup-user.service (removed by upstream due to correctly being considered distro spcific), based on the old upstream version. * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh * Adapted ignition-generator-suse and module-setup.sh to use the custom ignition-setup-user.service (no overriding of parts of the service file necessary any more). * Synced ignition-kargs-helper script with upstream example * Raising minimum Go version to 1.15 as required by upstream - is-live-image doesn't exist on *SUSE, and our live images don't use Ignition, so just add the Ignition device dependency to the service file directly. - Make sure to create /boot/writable (may not be present in some images) - Update to version 2.13.0: * news: add notes for 2.13.0 * config/v3_4_exp: noProxy entries cannot be null * config/v3_4_exp: mark ignition.version as required * docs/supported-platforms: add some description about Nutanix * providers/nutanix: add Nutanix platform * tests: use umountPath as a thin wrapper around umountPartition * internal/providers: refactor handling of unmounting the mount path * tests: address gostatic-check warning * tests: Add base64 decoding test * Dockerfile.validate: build with Fedora 35 * go.mod: update dataurl to 1.0.0 * ci: give blackbox tests two hours to run * tests/filesystem: fix umountPartition retry loop * templates: skip vendoring the new version in favor of dependabot * go.mod: update vcontext * providers/virtualbox: read config from /Ignition/Config guest property * stages/filesystems: use mkfs.fat instead of mkfs.vfat * docs/supported-platforms: switch to Afterburn docs URL * docs/supported-platforms: drop reference to platform-specific agents * test: ensure all platforms are documented * docs/supported-platforms: add missing platforms * stages/files: rename `relabelDirsForFile` and add docstring * stages/files: make variable name follow Go convention * docs/supported-platforms: update platform names and URLs * docs/supported-platforms: sort by platform ID * docs/supported-platforms: add platform IDs * docs: Remove default layout from front matter * docs: Do not convert -- & --- to en/em-dash * internal/*: change the location of Ignition report * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs * providers/qemu: start reporting progress reading fw_cfg after 10 s * providers/qemu: optimize fw_cfg read size * ci: use coreos-ci-lib helper for kola testiso * *: gofmt 1.17 * workflows: bump Go and golangci-lint * config: update versions in comments - Removed obsolete ignition-rpmlintrc - Add support for NetworkManager in dracut: * ignition-enable-network.service, ignition-enable-network.sh - Remove /var/lib/YaST2/reconfig_system if a config was provided: * ignition-remove-reconfig_system.service - Add ignition-touch-selinux-autorelabel.conf: Trigger SELinux autorelabel after Ignition runs; Ignition would support SELinux itself, however this is a compile time option, so it can't be used here. - Filter commented lines in ignition-mount-initrd-fstab.service - Don't include non-MarkDown files in documentation - ignition-mount-initrd-fstab.service: - Don't ignore errors in loops - Unmount mount points recursively - a new submount may have appeared - Split umount part into own service file: - ignition-umount-initrd-fstab.service: - Unmounts the additional mounts as soon as they are not required for Ignition any more; the ExecStop operation is running quite late in initrd and may unmount essential mount points flagged with "x-initrd.mount" (e.g. when storing /usr on a separate mount point). In theory this will also affect Ignition itself, but it hasn't been reported as a problem so far. - Use /bin/sh instead of /usr/bin/sh (for backwards compatibility with SLE Micro 5.1) [bsc#1196679] - Update to version 2.14.0: * NEWS: update v2.14.0 * docs/operator-notes: add section on provisioning secrets * Dockerfile.validate: build with Fedora 36 * internal/resource: fix gs:// fetches in GCE without a service account * docs/operator-notes: document supported S3 URL formats * internal/resource: fix S3 access point object ARNs * exec/util: fix infinite loop in Depth() if -root is relative * Add ignition-delete-config.service and ignition-rmcfg symlink * providers/virtualbox: support deleting Ignition configs * providers/virtualbox: add comment referencing VirtualBox source * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP * providers/virtualbox: add helper to set up hypervisor connection * providers/vmware: support deleting Ignition configs * main: add ignition-rmcfg multicall binary * go.mod: add github.com/beevik/etree * providers/vmware: switch to internal copy of OVF parser * internal/resource: fix bucket field in error message * internal/resource: derive AWS region hint from ARN partition field * internal/resource: simplify test * internal/resource: fix minor nits * provider/azure: try to fetch userdata from IMDS * providers/vmware: convert OVF tests to testify * providers/vmware: drop vmw-ovflib docs * providers/vmware: add verbatim copy of vmw-ovflib * providers/vmware: add constants for guestinfo and OVF property names * providers/virtualbox: fix reading properties with flags * internal/resource: support S3 access point URLs - Update fixes CVE from [bsc#1199524]; this introduces a new service "ignition-delete-config.service" - Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment - Use fixed paths in spec file for hardcoded installation paths - ignition-enable-network.sh: Use /lib/dracut/hooks directly instead of the usr-merged location which isn't available everywhere (bsc#1201957) - Update to version 2.15.0: * Features * Support offline Tang provisioning via pre-shared advertisement (3.4.0) * Allow enabling discard passthrough on LUKS devices (3.4.0) * Allow specifying arbitrary LUKS open options (3.4.0) * Ship aarch64 macOS ignition-validate binary in GitHub release artifacts * Changes * Mark the 3.4.0 config spec as stable * No longer accept configs with version 3.4.0-experimental * Create new 3.5.0-experimental config spec from 3.4.0 * Fail if files/links/dirs conflict with systemd units or dropins * Warn if template for enabled systemd instance unit has no Install section * Warn if filesystem overwrites partitioned disk * Warn if wipeTable overwrites a filesystem that would otherwise be reused * Warn if user/group specified for hard link * Install ignition-apply in /usr/libexec * Allow distros to add Ignition command-line arguments from a unit drop-in * Convert NEWS to Markdown and move to docs site * Require Go 1.18+ * Bug fixes * Don't overwrite LUKS1 volume when storage.luks.wipeVolume is false * Request network when custom Clevis config has needsNetwork set * Fix creating LUKS volume with custom Clevis config that uses TPM2 * Avoid logging spurious error when a LUKS volume wasn't previously formatted * Fix version string in ignition-validate release container * Fix reproducibility of systemd preset file in ignition-apply output * Document that user/group fields aren't applied to hard links * Clarify spec docs for files/directories/links group fields - Modified 0002-allow-multiple-mounts-of-same-device.patch to add new Ignition spec version - Add 0001-ignore-missing-qemu-blockdev.patch [bsc#1207679] to support booting without configuration device on s390x. - Move all /usr/libexec contents to %sbindir - Add `dasd_mod.dasd=autodetect` to kernel command line parameters (for Ignition device support on S/390) [boo#1207903] - Update to version 2.17.0: * Features * providers/hetzner: add support for Hetzner Cloud * providers/applehv: Add Apple Hypervisor * packit: add initial support * Other notable Changes * Add vsock modules into ramdisk * stages/disks: retry `sgdisk --zap-all` invocation * Add optionally-installed grub2 code * internal/exec/stages/disks: prevent races with udev - Updates from version 2.16.x [jsc#SMO-314] [bsc#1217533]: * Features * Add support for Hyper-V platform * Other notable changes * dracut: make hv_utils module optional * internal/exec: don't relabel a mountpoint that already exists * internal/exec/util: check if unit exists before disabling * platform: allow provider fetch to save files to write from files stage * providers: rename noop to metal * platform: drop function pointer indirection for fetch method * providers: add Config wrapper structs for cmdline and system providers - Fix segmentation fault if filesystem section of Ignition JSON doesn't contain path entry in 0002-allow-multiple-mounts-of-same-device.patch - Add 0003-Move-the-GPT-header-on-resized-disks.patch - Increased required Go version - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Fix arping -D problem (bsc#1146440) * added arping-revert-partially-fix-sent-vs-received-package.patch (upstream commit 18f14be) - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Fix arping -D problem (bsc#1146440) * added arping-revert-partially-fix-sent-vs-received-package.patch (upstream commit 18f14be) - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Fix arping -D problem (bsc#1146440) * added arping-revert-partially-fix-sent-vs-received-package.patch (upstream commit 18f14be) - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Fix arping -D problem (bsc#1146440) * added arping-revert-partially-fix-sent-vs-received-package.patch (upstream commit 18f14be) - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch after upstream merged the fix, update git commit hashes. - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch after upstream merged the fix, update git commit hashes. - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch after upstream merged the fix, update git commit hashes. - Fix arping -w problem (https://github.com/iputils/iputils/issues/211) * added arping-fix-f-quit-on-first-reply-regression.patch (upstream commit 1df5350) - remove unneeded libidn build dependency (boo#1174049) - Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff) Although not documented, they both belong to bsc#674304. Fix from 2011 was resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on start-up.") [1], released in s20121112. - Use %autosetup -p1 - Update to version s20200821 https://github.com/iputils/iputils/releases/tag/s20200821 - Remove BuildRequires libopenssl-devel (added md5 implementation thus not needed) - Remove patches from this release (arping-revert-partially-fix-sent-vs-received-package.patch, arping-fix-f-quit-on-first-reply-regression.patch) - No longer invoke permissions macros for ping. It now uses ICMP_PROTO sockets (bsc#1174504). - prepare usrmerge (boo#1029961) - Reference meson's build subdirectory as %_vpath_builddir, to line up with meson's structure. - Update to version 20210202 https://github.com/iputils/iputils/releases/tag/20210202 - Version scheme change: dropped leading 's', update that change - Binaries were found to be not optimized or built with proper %optflags. - Update to version 20210722 https://github.com/iputils/iputils/releases/tag/20210722 - Use rarpd.service from upstream (removes PrivateUsers=yes, which fixes broken start of the service, adds DynamicUser=yes for more security) - Add BuildRequires: iproute2 (required for running tests) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_rdisc.service.patch - Drop ProtectClock hardening, can cause issues if other device acceess is needed - Update to version 20211215 https://github.com/iputils/iputils/releases/tag/20211215 - rarpd and rdisc are going to be removed in next release (https://github.com/iputils/iputils/issues/363) therefore don't pack it since this release - Drop harden_rdisc.service.patch, which was 1) merged upstream 4bb0ace ("systemd: Add ProtectHostname, ProtectKernelLogs") for all services 2) we don't build rdisc since this release - temporarily reintroduce rarpd and rdisc tools to get them into 15sp4 [jsc#SLE-23521] - rarpd and rdisc tools are now disabled again [jsc#SLE-23521] - Backport 2 fixes for bsc#1203957: 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Update to version 20221126 https://github.com/iputils/iputils/releases/tag/20221126 - Update configure variables (ninfod, rarpd and rdisc were removed from upstream in next release => remove -DBUILD_NINFOD=false -DBUILD_RARPD=false - DBUILD_RDISC=false) - Remove 2 backported fixes from this release 0001-ping-Add-SA_RESTART-to-sa_flags.patch 0002-ping-Make-ping_rts-struct-static.patch - Backport upstream fix for bsc#1224877 4db1de6 ("arping: Fix 1s delay on exit for unsolicited arpings") 0001-arping-Fix-1s-delay-on-exit-for-unsolicited-arpings.patch - Backport proposed fix for regression in upstream commit 4db1de6 (bsc#1224877) 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch - Update 0002-arping-Fix-unsolicited-ARP-regressions-on-c-1.patch after upstream merged the fix, update git commit hashes. - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Initial SUSE package. - build -32bit packages to make libtiff5-32bit installable - fix baselibs.conf - Added url as source. Please see http://en.opensuse.org/SourceUrls - Don't strip binaries - v2.1 -Fixes bnc#870855 -Fixes CVE-2013-6369 - security update - added patches fix CVE-2022-1210 [bsc#1198146], Malicious file leads to a denial of service in TIFF File Handler + jbigkit-CVE-2022-1210.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - Fix use of DNS in the panic environment (bsc#1183070): * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless loop when resolving a hostname fails with EAI_AGAIN. * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf using its resolved path. - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - Fix use of DNS in the panic environment (bsc#1183070): * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless loop when resolving a hostname fails with EAI_AGAIN. * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf using its resolved path. - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - Fix use of DNS in the panic environment (bsc#1183070): * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless loop when resolving a hostname fails with EAI_AGAIN. * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf using its resolved path. - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - Fix use of DNS in the panic environment (bsc#1183070): * kdump-avoid-endless-loop-on-EAI_AGAIN.patch: Avoid an endless loop when resolving a hostname fails with EAI_AGAIN. * kdump-install-real-resolv.conf.patch: Install /etc/resolv.conf using its resolved path. - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - spec: return success from pre, post, preun and postun scriplets (bsc#1222228, bsc#1191410) - spec: differentiate between uninstall and upgrade in postun/preun (bsc#1191410) - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - spec: return success from pre, post, preun and postun scriplets (bsc#1222228, bsc#1191410) - spec: differentiate between uninstall and upgrade in postun/preun (bsc#1191410) - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - spec: return success from pre, post, preun and postun scriplets (bsc#1222228, bsc#1191410) - spec: differentiate between uninstall and upgrade in postun/preun (bsc#1191410) - kdump-Store-kdump-initrd-in-kernel-image-path.patch: Fix kdumprd location for usrmerge kernels (boo#1190920). - Update to 0.9.2 * Isolate fadump initrd within the default one (jsc#SLE-18272) * Bug fixes * Code cleanups - Remove patches that have been upstreamed: * kdump-mounts.cc-Include-sys-ioctl.h.patch * kdump-Add-bootdev-to-dracut-command-line.patch * kdump-do-not-iterate-past-end-of-string.patch * kdump-fix-incorrect-exit-code-checking.patch * kdump-avoid-endless-loop-on-EAI_AGAIN.patch * kdump-install-real-resolv.conf.patch * kdump-Store-kdump-initrd-in-kernel-image-path.patch - Remove patches that have been solved differently: * kdump-on-error-option-yesno.patch - Sync with SLE15-SP4 changelog. These patches were never applied to Factory: * kdump-avoid-endless-loop-EAI_AGAIN.patch * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch * kdump-calibrate-Fix-kernel-command-line-parsing.patch * kdump-do-not-add-rd.neednet.patch * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch * kdump-ensure-initrd.target.wants-directory.patch * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch * kdump-Implement-KString-isHexNumber.patch * kdump-install-etc-resolv.conf-using-resolved-path.patch * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch * kdump-remove-console-hvc0-from-commandline.patch * kdump-set-serial-console-from-Xen-cmdline.patch - kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch: Fix malformation in passing Dracut compression parameters in mkdumprd (bsc#1193765). - Refresh existing patches. - Update to 1.0 * Estimate kdump memory requirements at build time (jsc#SLE-18441). - Remove patches that have been upstreamed: * kdump-0.9.2-mkdumprd-properly-pass-compression-params.patch - kdump-calibrate-Ignore-malformed-VMCOREINFO.patch: calibrate: Ignore malformed VMCOREINFO lines (address occasional OBS build failures). - Update to 1.0.2 * Adjust crash kernel reservation at boot time (jsc#SLE-18441). - All remaining patches have been upstreamed: * kdump-fillupdir-fixes.patch * kdump-use-pbl.patch * kdump-calibrate-Ignore-malformed-VMCOREINFO.patch - kdump-calibrate.conf-depends-on-kdumptool.patch: calibrate.conf: Add dependency on kdumptool. - kdump-calibrate-fix-nic-naming.patch: calibrate: Fix network interface naming. - kdump-calibrate-include-af_packet.patch: calibrate: Explicitly include af_packet in the test initrd. - Exclude i586 from SLE builds. - pull sources directly from git using obs_scm - fix bsc#1190299, bsc#1186272 - remove patches included in upstream git: kdump-calibrate-include-af_packet.patch, kdump-calibrate-fix-nic-naming.patch, kdump-calibrate.conf-depends-on-kdumptool.patch - kdumptool calibrate: add more margin to reservation calculations (bsc#1196728) - remount target filesystem r/w for fadump (bsc1197125) - stop reloading FADump on CPU hot-add event (jsc#IBM-768) - mkdumprd: add option to run dracut in debug mode - pull from new upstream SLE-15-SP5 branch - copy SLE-15-SP4 calibration data for SLE-15-SP5 - fix broken URL in manpage (bsc#1187312) - kdumptool calibrate: modify fadump suggestions (jsc#IBM-1027) - fix renaming of qeth interfaces (bsc#1204743, bsc#1144337) - ppc64: rebuild initrd image after migration (bsc#1191410) - Make the kdump-save.service reboot after kdump-save is finished (bsc#1204000) - maintain the spec file in git - print the qemu messages and trackrss log during calibrate - fix deleting of a temporary file in dracut/module-setup.sh - look for nsswitch.conf in /etc and /usr/etc - never run a debugging shell when KDUMP_CONTINUE_ON_ERROR is set - calibrate: properly kill the tail process - improve the generation of calibrate.conf * use static IP address for calibration * all calibrate.conf variants now stored in a single file * added a README and a helper script for updating calibrate.conf * prevent dracut from running emergency shell * fix s390x build dependencies - revert back to using rd.neednet=1 to enable network (bsc#1206015) - kdumptool calibrate: add even more margin to reservation calculations (bsc#1207061) - run kdump.service only after kdump-early.service (bsc#1196335) - don't skip infiniband interfaces (bsc#1186745) (not a complete fix, requires a patch in dracut as well) - dracut: always create fstab, even if empty (bsc#1218494) - fix NOSPLIT option - Honor the KDUMP_VERBOSE setting in kdump-save - spec: return success from pre, post, preun and postun scriplets (bsc#1222228, bsc#1191410) - spec: differentiate between uninstall and upgrade in postun/preun (bsc#1191410) - update to 2.0.11 - Fix segfault while shutting down when SNMP activity occurs. Issue #1061 identified that keepalived could segfault when it shut down. It appears that this was caused by data being received on the file descriptors that the snmp agent requests keepalived to monitor with epoll(). Since the read threads weren't being processed during a shutdown, the first time an snmp fd was ready, keepalived discarded the read thread. The second time that fd became ready there was no thread to handle the fd, and, since the assert() statement was not compiled in, non existant data was queued to the thread ready queue. This commit changes the assert() calls to continue, so that non existant data is no longer queued to the thread ready queue. - While shutting down, continue to handle snmp agent fds. Since we don't shutdown the snmp connection until the very end of the shutdown process (we need to be able to send snmp traps), we should continue to handle the snmp fds on behalf of the snmp agent while shutting down. - Ensure snmp agent is in correct state when initialising/closing Make sure the snmp agent is not already initialised before initialising it, and make sure it has been initialised before closing it. - Disable asserts in bfd code by default and add --enable-asserts Asserts were enabled by default in the bfd code, which shouldn't be the case. Add --enable-asserts configure option so that the asserts tests can be enabled while debugging. - Remove debugging log message accidently left in. - Update receive buffers when interface is created. The receive buffer size used by keepalived is based on the largest MTU of any interface that keepalived uses. If dynamic interfaces are being used and an interface is created after keepalived has started, the MTU of the new interface may be larger than the previous largest, so the receive buffer may need to be increased in size. Further, if vrrp_rx_bufs_policy is MTU, then the kernel receive buffers on the receive socket may need to be increased. - Handle MTU sizes being changed. Issue #1068 identified that the MTU size wasn't being updated in keepalived if it changed. This commit now updates the MTU size and adjusts receive buffer sizes accordingly. - Fix syntax error in configure.ac. - Fix double free when global data smtp_helo_name copied from local_name Issue #1071 identified a double free fault. It occurred when smtp_helo_name was not set, in which case it was set to point to the same malloc'd memory as local_name. At termination keepalived freed both local_name and smtp_helo_name. If keepalived needs to use local_name for smtp_helo_name it now malloc's additional memory to copy the string into. - Rename TIMER_MAX to TIMER_MAXIMUM. ulibC defines TIMER_MAX, so to avoid naming conflict rename it. This issue was reported by Paul Gildea <gildeap@tcd.ie> who also provided the patch. - Fix segfault when smtp alerts configured. - First working version of nftables. - Restructed code around how iptables/nftables are called This commit also allows building keepalived without iptables support, thereby allowing only nftables support. Adding any other mechanism to handle no_accept mode, i.e. blocking receiving and sending to/from VIPs should be added to vrrp_firewall.c, in a similar way to how nftables/iptables are used. - Update doc files re nftables. - Make nftables handle dont_track_primary appropriately. - Fix config reload with nftables. - Set base chain priorities from configuration. - Use iptables by default if neither iptables or nftables configured. But if the build of keepalived does not include iptables, then use nftables default. - Stop dumping keywords - left turned on after debugging. - Make umask configuration apply to created file. - Add libmnl and libnftnl to travis file. - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not defined. - Fix compilation failure when build with nftables but without iptables. - Fix order of include files in configure COLLISION test. Since Linux 4.4.11 (commit 1575c09) including linux/if.h after net/if.h works, whereas until glibc fix their headers including net/if.h after linux/if.h causes compiler redefinition errors. Unfortunately the test for the collision was done the wrong way round, as identified in issue #1079. The patch included in the issue report corrects the order of inclusion of the header files. What we should do is ensure that glibc header files are included before Linux header files, so that at least if kernel headers from 4.4.11 onwards are used, the conflict will not occur. - Set CLOEXEC on netlink sockets. - Correct error message for invalid route metric. - Add track_process for vrrp to monitor if another process is running. Configurations frequently include a track_script to check that a process is running, often haproxy or nginx. Using any of pgrep, pkill, killall, pidof, etc, has an overhead of reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline files. In particular reading the cmdline files has a significant overhead on a system that is swapping, since the cmdline files provide access to part of the address space of each process, which may need to be fetched from the swap space. This commit reads the /proc/[1-9]*/stat and/or the /proc/[1-9]*/cmdline files only when keepalived starts, and after that uses the process events connector to track process creation and termination. keepalived will ignore zombie processes, whereas pgrep etc include them. A minimum number of instances of a process can be specified, and also a delay so that if a process is restarted, it won't cause monitoring vrrp instances to immediately transition to fault state but to wait the configured time and it the monitored process starts again it won't transition to fault state. There are potential difficulties with the process event connector if a large number of process events occur very rapidly, since there can be a receive buffer overrun on the netlink socket. This code will detect that happening, increase the receive buffer size, and reread the processes from /proc. - Add missing #include to track_process.c. - Fix number of elements of fd_set read for snmp select info. - Remove thread_event_t when EPOLL_CTL_DEL fails. If snmpd closes a file descriptor, when keepalived attempts to unregister the fd from epoll an error is returned. However, we still need to remove the thread_event_t from the io_events rbtree. - Fix connection to snmpd after it has to reconnect. Issue #1080 identified that keepalived wasn't handling a connection failure and reconnect to snmpd properly. The problem was created when the change from select() to epoll() was made. This commit makes keepalived unregister and reregister the snmp file descriptors after snmpd reconnects. - Fix retry count for SMTP_CHECK checker. The checker was doing one too few retries. - Make healthchecker failure reporting consistent Some healthcheckers were reporting all failures, and others only when the retries expired. This commit by default makes the checkers only report failure when the retries expire, unless the global keyword checker_log_all_failures or log_all_failures on the specific checker is configured. - After reload, reinitialise current track processes state. - Remove unused variable in track_process.c. - Add configure checks re --with-kernel-dir. - Convert remaining select() to epoll_wait(). keepalived was using select() for handling the termination of child processes, but the main scheduling loop now uses epoll_wait(), so convert the select() to epoll_wait() from consistency. - Stop keepalived leaving zombie child processes. keepalived wasn't reaping the termination of its child processes, so this commit adds waitpid() calls once it knows the processes have terminated. - Fix make distclean and make distcheck. - Also skip route not configured with down interface. Otherwise, if keepalived has virtual_routes configured, we create a virtual interface and bring it up and down, current code will bring VRRP state to FAULT and never return. - Stop vrrp process entering infinite loop when track script times out Issue #1093 identified that the vrrp process was entering an infinite loop after a track script timed out. This was due to a child process thread having an RB tree for PIDs as well as for the timeout, and if a child process timed out, the thread wasn't being removed from the PID RB tree. This commit now ensures it is removed. - Fix the abbreviation of Shortest Expected Delay. - Don't free unallocated memory if not tracking processes. - vrrp: Rewrote JSON code Remove dependency to json-c extralib by using a simple streaming JSON writter. Refactored code to make it simple to maintain. - vrrp: Fix JSON handling for v{route;rule}. - autoconf: fix nftables selection We need to inhibit nftable compilation if compiling system has kernel header file nf_tables.h but not libnftnl nor libmnl. - fix build on 42.3/sle12 by disabling http regexp check support - add nftables to the BR - cleanup BR support for sle11, moved almost all BR to pkgconfig style - disable dbus instance creation support as it is marked as dangerous - update to 2.0.13 - Add BFD build option to keepalived.spec rpm file Issue #1114 identified that the keepalived.spec file was not being generated to build BFD support even if keepalived had been configured to support it. - Copy tarball to rpmbuild/SOURCES when building in place It seems that even when building in place, rpmbuild expects the tarball to be in the rpmbuild/SOURCES directory. - Fix configure check for __always_inline - Handle interface MAC addresses changing When an interface is added to a bond interface, if it is the first interface added, the MAC address of the bond interface is changed to the MAC address of the added interface. When subsequent interfaces are added, their MAC addresses are changed to that of the bond interface. Issue #1112 identified that if a bond interface is deleted and recreated, the gratuitous ARPs were sent with the wrong source MAC address. This commit now updates interface MAC addresses from the netlink RTM_NEWLINK messages, so that the correct MAC address is always used. - Minor tidying up of opening gratuitous ARP socket. - Streamline setting SOCK_NONBLOCK on vrrp sockets. - Use netlink reported hardware address length for unsolicited NAs ETH_ALEN is correct for Ethernet type interaces, but is not right for Infiniband interfaces. - Minor tidying up of opening gratuitous NA socket. - Make gratuitous ARP/NA sockets non blocking keepalived shouldn't block when sending gratutious ARP/NA messages. It is better to lose the messages than for keepalived to block, so set the sockets non blocking. - Use netlink provided broadcast address for gratuitous ARP If an interface has a non-standard broadcast address, we should honour it. - Fix building on pre 3.10 kernels re track_process Issue #1119 reported that keepalived wouldn't build on CentOS 6. Various PROC_EVENT_- declarations were assumed to exist, some of which were not introduced until Linux v3.10. Most of them are not needed, but PROC_EVENT_COMM is used by the track_process code. This commit now checks for the existence of the PROC_EVENT_- declarations, but since keepalived uses PROC_EVENT_COMM, track_process is not supported prior to Linux v3.2. - Make track_process work prior to Linux 3.2, but with limitations Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which means that keepalived is unable to detect changes to process name (/proc/PID/comm) prior to Linux 3.2. most processes do not change their process name, and so using track_process prior to Linux 3.2 is safe so long as the monitored processes are known not to change their process name. - Stop configure failing when nftables is not supported. - Streamline socket use with linkbeat. Previously the socket used for ioctls was opened and closed twice per poll if using MII or ETHTOOL polling, and once per poll if using ioctl polling. This commit opens the socket once at startup, uses that socket for all linkbeat polls, and closes it on termination. - Enable linkbeat polling to work with dynamic interfaces. - Add linkbeat_interfaces configuration block It was not possible to indicate that an interface that wasn't used as the interface of a vrrp instance, but was used either as a track interface, or for virtual/static ip addresses or routes should use linkbeat. This commit adds that capability. - Add ability to specify linkbeat type in linkbeat_interfaces block. - Add --disable-linkbeat configure option Does anyone use linkbeat anymore? This commit enables keepalived to be build without the linkbeat code. - Don't remove link local IPv6 address from VMAC that isn't keepalived's If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface already had a (non-default) link local addresss and the link local address that matched the interface's MAC address was added, keepalived was removing it as soon as it was added. This commit stop keepalived removing the address when we shouldn't. - Set configure init type correctly in keepalived.spec file. - Fix handling of VMACs with multiple reloads If a configuration is loaded that has a VRRP instance using a VMAC, then the configuration is updated to remove that VRRP instance and keepalived reloads its configuration, then the configuration is updated again to reinstate the VRRP instance and the configuration is again reloaded, keepalived thought the VMAC interface still existed, whereas it was deleted following the first reload. This commit ensures that keepalived properly detects whether an interface exists following a reload. - Remember more than one interface local address per interface Keepalived needs a local address for each interface it sends adverts on. If the address keepalived is using is deleted and another address is configured on the interface, then keepalived should start using that address. To do this, a list of configured address on each interfaces needs to be maintained. - Don't consider VIPs as local addresses when restart after crash Keepalived maintains a list of addresses per interface that can be used as source adddresses for adverts. To build the list, keepalived reads the addresses configured on interfaces when it starts. However, if keepalived crashed it will have left VIPs configured on interfaces, and we don't want to use them as advert source addresses. This commit makes keepalived compare the addresses on interfaces to VIPs, and ignores any addresses that are VIPs. - Fix removing left over VIPs at startup. - Use read_timer() when parsing config where appropriate. - Allow fractional warmup, delay_loop and delay_before_retry for checkers To shorten the real server monitoring interval, make it possible to specify decimal value for following items: warmup delay_loop delay_before_retry - Update connect_timeout configuration options Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch allows setting the connect_timeout to a resolution of micro-seconds. The patch also adds the ability to set a default value at the virtual server and real server levels. - Fix unused variable warning when building only with RFC compliant SNMP. - It enable to set zero value as mintime for delay_loop and connect_timeout. - Add option not to check for EINTR if using signalfd() If keepalived is using signalfd(), there are no asynchronous signal handlers, and therefore EINTR cannot be returned. Currently the check for EINTR is enabled by default, and configure option --disable-eintr-debug disables the check, while - -enable-eintr-debug enables writing log entries if EINTR is returned. Once sufficient testing has been performed, the default will be changed not to test for EINTR if signalfd() is supported. - Make checking for EAGAIN/EWOULDBLOCK consistent The code in some places checked errno for EAGAIN and EWOULDBLOCK and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK, so the check is not necessary, but EAGAIN is not guaranteed to be the same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN if they are the same value, but checks both if they are different. - Ensure default connection timeout for smtp checker hosts set. - Set default connection timeout if no smtp check host specified. - Fix min timer value, zero to 0.000001Sec. - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler(). - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds. - vrrp: vrrp_dispatcher_read() performance extension We took time with Quentin to simulate and rework this code. We introduced 2 imbricated while loop: (1) First one is catching recvfrom EINTR (this code trig only on kernel older than 2.6.22 where signalfd was firstly introduced). Newer kernel will immediately break the loop (hey guys: if you are running older than 2.6.22 it is worth considering upgrading). (2) Second loop will continue reading from socket until same VRID advert has been received during the same cycle. After simulating, it appears that during contention with a lot of VRRP instances (around 1500), this design is needed to relax socket recvq from growing. This can be viewed as a Poll-Mode activation during contention and fallback to regular I/O MUX during normal operations. This loop breaks immediately and re-submit opration to I/O MUX when there is no more to be read. - Fix conversion from long for double in read_timer(). - Remove variable timer of unsigned long cast in read_timer(). When Double type variable timer is cast to long type, it's scale falls. - changes from2.0.12 - Documentation related. Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage. Update README manifest to reflect actual Keepalived goal and features. - Improve error message if process events connector not enabled in kernel. - Add option to disable track-process functionality Issue #1099 reported that their kernel did not support the proc events connector, and it would therefore be helpful to have an option to build keepalived without the track-process functionality. This commit adds the --disable-track-process configure option. - Fix vrrp instances going to fault state when have virtual routes If an interface going down caused a vrrp instance to go to fault state, and the vrrp instance also had virtual routes, the state of the vrrp instance would be set to backup when the deletion of the virtual route was detected. This commit ensures that the vrrp instance stays in fault state until the interface is brought up again. - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file. Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on Linux 2.4, which is no longer supported by keepalived. The options in the spec file for Reh Hat Linux 9 have twice caused people to specify wrong options to configure when trying to build keepalived, so the options are removed to i) avoid confusion and ii) they are not longer relevant. - Add global option vrrp_min_garp. By default keepalived sends 5 gratuitous ARP/NA messages after transitioning to master, and 5 more 5 seconds later. This isn't necessary with modern switches, and so if the vrrp_min_garp option is set, only one gratuitious ARP/NA message is sent after transition to master, and no repeat messages are sent 4 seconds later. - Standardise definition of _INCLUDE_UNUSED_CODE_ - Remove out of date comment re VRRP over IPv6. - Correct typo in keepalived.conf.5. - Directly use structure sizes for packet header lengths. - vrrp_state_fault_rx() is not used. Wrap the function in conditional compilation so it is not compiled - Convert so list loops to use LIST_FOREACH. - Don't recalculate vrrp packet header address. vrrp_get_header() calculates the address of the vrrp header in a received packet, but it was being recalculated in vrrp_in_chk(). This commit passes the already calculated address to vrrp_in_chk(). - Ensure a received packet has an AH header if and only if AH auth. Ensure that a received packet has an AH header if we expect AH authentication, and doesn't have an AH header if we don't expect AH authentication. - Ensure all protocol headers received before return pointer to vrrp header vrrp_get_header() returns a pointer to the vrrp header, but it now returns NULL if insufficient data has been received to include all the (IP, possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP packet). This means that when a pointer to the VRRP header is returned, all fields in all protocol headers can safely be accessed. - Add check of received IPv6 hop count in multicast adverts The VRRP RFC requires that IPv6 hop count MUST be checked to be 255, just as the TTL for IPv6 must be 255. Previously that wasn't being checked, since IPv6 raw sockets don't provide access to the IPv6 header. Using recvmsg() rather than recvfrom(), and setting socket option IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as ancillary data, and that can now be checked. - Improve reading from vrrp receive sockets. Previously no check was made of the return value from recvfrom()/ recvmsg(). This meant than an error could occur (e.g. EINTR), or no data might be returned, and keepalived would still attempt to process the receive buffer as though data had been received. - Enhance and streamline checking of validity of received VRRP packet This includes checking that a packet is multicast, unless unicast is expected in which case it is checked for unicast, ensuring that if AH authentication is used, the next header protocol is VRRP. The sequence of some checks is revised to ensure that the fields being checked are valid to be accessed prior to accessing them, e.g. check that the packet is VRRP version 2 before checking the authentication. - Stop clearing receive buffer before receiving VRRP packets. This is no longer necessary now that the appropriate checks are made of the return status of recvmsg(), and also that the checks of received packet length and packet headers now do all necessary checks. - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO support. - Update keepalived.spec.in build-requires. The kernel package required for building keepalived is kernel-headers not kernel-devel. Also, it is superfluous to have package kernel in the build-requires! - Add missing file (build.setup) to tarball. - Fix calculating print format to rlim_t in configure.ac. - Fix compiler warnings on 32 bit systems re HASH_UPDATE. Removing all the casts stopped the warnings. - Use PRI_rlim_t when printing rlim_t types. - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems. - Fix some space/tab formatting. - Stop declaring some timer definitions unsigned to stop compiler warnings. TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings on some systems due to being defined with a 'U' unsigned suffix. Removing the unsigned specifier stopped the compiler warnings. - Fix compiler warning due to incorrect format specifier. An int64_t should use % PRIi64 and not %ld - Stop an uninitialized variable compiler warning. - Fix MEM_CHECK debugging on processors without unaligned memory access. - Don't attempt to use unopened socket for getting ipset version. - Tidy up an error message. - vrrp: make vrrp_dispatcher_read() async while catching error. During investigations we decided to update previous patch to resubmit into I/O MUX on read error. It will make read procedure I/O MUX freindly by removing potential sync operation potentially leading to a global I/O MUX desync. We aggreed, the situation is really and very exceptionnal but could happen. - vrrp: vrrp_arp_thread split. Split the function for maintainability purpose. - update to 2.0.14 - Add compiler warning -Wfloat-conversion and fix new warnings. It was discovered that passing 0.000001 as a parameter specified as uint32_t to a function did not generate any warning of type mismatch, or loss of precision. This commit adds -Wfloat-conversion and fixes 3 instances of new warnings that were generated. - For non systemd enviroment, it occurs syntax error 'fi'. To avoid syntax error, modify keepalived.spec.in. - When uninstall keepalived with init upstart, stop keepalived process. - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached. The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and so isn't currently compiled. - Register missing thread function for thread debugging. - Fix reutrn value of notify_script_compare misusing issue. - Fix typo in keepalived.conf man page re BFD min_rx. - Fix segfault when bfd process reloads config. Issue #1145 reported the bdf process was segfaulting when reloading. The bfd process was freeing and allocating a new thread_master_t when reloading, which doesn't work. This commit changes the bfd process to clean and reinitialise the thread_master_t. - Fix segfault in handle_proc_ev(). On Linux 3.10 the ack bit can be set in a connector message, and the CPU number is set to UINT32_MAX. This commit skips acks, and also checks that CPU number is within range of the number of CPUs on the system. - Fix OpenSSL init failure with OpenSSL v1.1.1. OpenSSL v1.1.1, but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously been called. This commit doesn't call OPENSSL_init_crypto() if doing so causes SSL_CTX_new() to fail. - Remove all references to libnfnetlink. Commit 2899da6 (Stop using linbl for mcast group membership and setting rx buf sizes) stopped using libnfnetlink, but INSTALL and keepalived.spec.in were not updated accordingly. - Fix genhash re OPENSSL_init_crypto bug and improve configure.ac. Commit fe6d6ac (Fix OpenSSL init failure with OpenSSL v1.1.1) didn't update the identical code in genhash/ssl.c. Also, an improvement for the test in configure.ac was suggested. - Fix log output when real server removed. FMT_VS() and FMT_RS() both call inet_sockaddrtotrio which uses a static buffer to return the formatted string, but since FMT_VS(), wheich simply calls format_vs() copies the returned string to its own static buffer, if FMT_VS() was called before FMT_RS() then the returned strings from both could be used. The problem occurs when both FMT_VS() and FMT_RS() are used as parameters to log_message() (or printf etc). It appeared to work fine on x86_64, but was writing the same IP address for both the real server and virtual server on ARM architectures. This is due to the compiler evaluating parameters to the log_message() function call in a different order on the different architectures. This commit adds inet_sockaddrtotrio_r() which allows the output to be in a buffer specified by the caller, and so FMT_VS() and FMT_RS() can now be called in either order without one overwriting a buffer used by the other. - Streamline some string formatting with FMT_RS() and FMR_VS(). Following commit 9fe353d (Fix log output when real server removed) some code can be streamlined now that the order of calling FMT_VS() and FMT_RS() does not matter. - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with FMT_CHK(). They were all simply defined to be FMT_CHK() so just replace them with that. This made it much simpler to find all used of FMT_CHK(). - Fix building with gcc 4.4.7 (Centos 6.5). gcc v4.4.7 doesn't support -Wfloat-conversion, so check for it at configure time. - Add dumping checker config/status when receive SIGUSR1. - Don't put alpha mode checkers into failed state at reload If a new checker is added at a reload, unless the real server aleady has failed checkers, then ignore the alpha mode of the checker. This means that the real server, if up, won't be taken down and then brought back up again almost straight away. If the real server already has failed checkers, then setting an alpha mode checker down initially won't take down the real server, so we can allow the alpha mode setting to apply. - Handle alpha mode checkers initial failure at startup better. - Fix compile failure discovered by Travis-CI. - Fix calling syslog when not using signalfd(). Pull request [#1149] identified that syslog is AS-Unsafe (see signal-safety man page), and that therefore signals should be blocked when calling it. This commit blocks signals when calling syslog()/vsyslog() when signalfd() is not being used. - Rationalise function attributes. - Fix enable-optimise configure option. - Use AS_HELP_STRING for all options in configure.ac. - Streamline genhash -h option. - Make genhash -v version match keepalived. - Fix config check of virtual server quorum against weights of real servers. - Fix some configure tested checks for OPENSSL_init_crypto. - Add infrastructure for adding additional compiler warnings. - Add standard and extra compiler warnings. - Add and resolve missing-declarations and missing-prototypes warnings Approximately 16 additional functions are now declared static. - Add and resolve old-style-definitions warnings - Add and resolve redundant-decls warnings - Add and resolve jump-misses-init warnings - Add and resolve shadow warnings - Add and resolve unsuffixed-float-constants warnings - Add and resolve suggest-attribute=const warnings - Add and resolve suggest-attribute=format warnings - Add and resolve suggest-attribute=malloc warnings - Add and resolve suggest-attribute=noreturn warnings - Add and resolve suggest-attribute=pure warnings - Add and resolve unused-macros warnings - Add and resolve null-dereference warnings - Add and resolve float-equal warnings - Add and resolve stack-protector warnings - Add and resolve strict-overflow=4 warnings - Add and resolve pointer-arith warnings This particularly includes adding a number of bytes to a void -. - Add and resolve cast-qual warnings - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7 - Remove static from zalloc() - Fix some compiler warnings on Ubuntu Xenial, and add comments re others. - Rename LIST parameters to lst in list_head.h to avoid upper case. - Fix real server checkers moving from failed to OK on reload. - add rs judgement in migrate_checkers. - Detect connection failure in genhash and exit rather than loop. - Add another function pure attribute. - Fix sending notifies for vrrp instances at startup when in sync group Issue #1155 idenfified that notify scripts for vrrp instance transition to backup state when keepalived started up were not being sent if the vrrp instance was in a sync group. It was also the case that SNMP traps, SMTP alerts and FIFO notifies were not being sent either. This commit make keepalived send the initial notifies when the vrrp instance is in a sync group. - Fix building keepalived RPM on Fedora 26. For some reason - fPIC is needed when testing for the presence of setns(). - Add vrrp_startup_delay configuration option. Some systems that start keepalived at boot time need to delay the startup of the vrrp instances, due to network interfaces taking time to properly come up. This commit adds a global configuration option vrrp_startup_delay that delays the vrrp instances starting up, for the specified number of seconds. - Handle checkers properly when reload immediately after startup. - Streamline some of the SMTP checker code. - Create separate checker for each host in SMTP_CHECK block Having multiple host entries in an SMTP_CHECK block is deprecated. This commit streamlines the SMTP_CHECK code by creating a separate SMTP checker for each host declared in the SMTP_CHECK block, so that apart from parsing the configuration, the code no longer handles multiple hosts per checker. The support for parsing configuration with multiple hosts is only enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is currently enabled, but when support for multiple hosts in the SMTP_CHECK block is finally removed, it will simply be a matter of deleting all code in the WITH_HOST_ENTRIES conditional blocks. - Make checker fail if ENETUNREACH returned by connect(). The connect() call can return some immediate errors such as ENETUNREACH. These were not being treated as a failure of the checker, since the code used to assume that any non success return by connect() meant that the connection was in progress. keepalived will now treat ENETUNREACH, EHOSTUNREACH, ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED, ETIMEDOUT, when returned by connect(), as meaning that the checker has failed. - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a timeout of 0 causes a TCP connection to be reset rather than cleanly closed. Instead of specifying a timeout of 0, use 5 seconds, so that there is an orderly shutdown of the TCP connection, but the close socket doesn't remain in TIMED_WAIT state for more than a short time. - nftables: fix build with kernel lower than 4.1. - Remove dead code and cosmectics. Remove code marked as UNUSED where things simply go nowhere even if define is set. We keep for the moment UNUSED code related to debug helpers used during coding process. - add buildrequires for file-devel - used in the checker to verify scripts - update to 2.0.15 - Fix uninitialised variable. - Fix rpmbuild on CentOS7, and rely on auto-requires. - Add option to flush lvs on shutdown. Currently all known virtual servers and their real servers are removed one at a time at shutdown. With large configurations on a busy system, this can take some time. Add an option just like the existing 'lvs_flush' which operates on shutdown. Typical environments with a single keepalived instance can take advantage of this option to achieve a faster shutdown or restart cycle. - Make alpha mode checkers on new real servers start down on reload. Patch #1180 identified that new real servers with alpha mode checkers were being added online immediately, and if the checker then failed were being removed. This commit makes real servers that didn't exist before the reload start in down state if they have alpha mode checkers. - Remove duplicate config dump entry. - Make new real servers at reload start down if have alpha mode checkers. - Close checker and smtp_alert sockets on reload. Issue #1177 identified that sockets were being left open (lost) after a reload. It transpired that these were sockets opened by TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK checkers, and by smtp_alerts in the process of being sent. This commit adds an extra parameter to thread_add_read() and thread_add_write() to allow indicating that the scheduler should close the socket when destroying threads. - Send vrrp group backup notifies at startup. - Make inhibit_on_failure be inherited by real server from virtual server. - Allow real and sorry servers to be configured with port 0 This is to maintain backwards compatibility with keepalived prior to commit d87f07c - "Ensure always check return from inet_stosockaddr when parsing config". The proper way to configure this is to omit the port, which requires the next commit. - Don't setup IPVS config with real and virtual servers ports different. If the real server is using DR or TUN, the port of the real server must be the same as the port of the virtual server. This commit uses the virtual server port for the real server when configuring IPVS. - Log warnings if real server and virtual server ports don't match This commit adds logging warnings if virtual and real server ports, when using TUN or DR, don't match. It also sets the real server ports to be the same as the virtual server ports. Although listing the IPVS configuration with ipvsadm will look different, the kernel ignored the port of a real server when using DR or TUN, so the behaviour isn't changed, but when looking at the configuration it now shows what is actually happening. - Fix warning when protocol specified for virtual server with fwmark. - Add log message that nb_get_retry is deprecated. - Fix whitespace in configure.ac. - Fix configure error when systemd not installed configure was trying to execute pkg-config --variable=systemdsystemunitdir systemd even if systemd was not available. This commit makes configure only execute the above if it has determined that systemd is the correct init package to use. - Correct references to RFC6527 (VRRPv3 SNMP RFC). - nsure checker->has_run is always set once a checker has run. - Fix some indentation in configure.ac. - Update fopen_safe() to open temporary file in destination directory rename() in fopen_safe() was failing if the file being created was not on the same filesystem as /tmp. - Add ${_RANDOM} configuration keyword. It might seem strange to introduce random elements to configuration files, but it can be useful for testing. - Fix using ~SEQ() in multiline configuration definitions. - Make blank lines terminate a multiline definition. - Minor updates for lvs_flush_on_stop. - Add option to skip deleting real servers on shutdown or reload If a virtual server is removed, the kernel will remove its real servers, so keepalived doesn't explicitly need to do so. The lvs_flush_onstop option removes all LVS configuration, whereas this new option will only remove the virtual servers managed by keepalived. - Correct error message re checker_log_all_failures. - Fix syntax error in configure.ac. - Fix track_process initialisation for processes with PIDs starting 9. - Remove debugging log message. - Remove inappropriate function const attributes They were causing iptables/ipsets not to be initialised. - Stop warning: function might be candidate for attribute "const" Depending on what configure options are selected, gcc can output the above warning for initialise_debug_options(). This commit ensures that the warning is not produced. - Enable strict-config-checks option in keepalived.spec RPM file. - vrrp: relax attribute 'const' warning at iptables helpers. - Propagate libm to KA_LIBS. - Fix building on Alpine Linux. Alpine (musl) doesn't have a definition of __GNU_PREREQ, so create a dummy definition. - added systemd-after-snmp.patch: If you want to use the snmp support the masterx socket needs be available otherwise the snmp support is broken strictly speaking we would need to use BindsTo= here but that would require that add a Requires for net-snmp to the keepalived package. to be discussed. - Update to 2.0.17 (2019-06-25) * https://www.keepalived.org/changelog.html - remove obsolete patch * systemd-after-snmp.patch - rebase patch * linux-4.15.patch - update to 2.0.19 Fix minor IPVS features support. Extend BFD to support more than one BFD instance with a neighnour. Extend nftable support. Script timeout extension. Properly filter IGMP/MLD packets on VMAC interface. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - changes from 2.0.18 Add support to IPVS new GUE tunnel type. New feature 'weight reverse' available in all trackers. Resolve all outstanding coverity issues. Some fixes and performance extensions. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - new BR pkgconfig(libnftnl) to fix nftables support - Inclusion into SLE as ACC supported packages (bsc#1158280, ECO#223) - Update to 2.2.1 https://www.keepalived.org/release-notes/Release-2.2.1.html https://www.keepalived.org/release-notes/Release-2.2.0.html https://www.keepalived.org/release-notes/Release-2.1.5.html https://www.keepalived.org/release-notes/Release-2.1.4.html https://www.keepalived.org/release-notes/Release-2.1.3.html https://www.keepalived.org/release-notes/Release-2.1.2.html https://www.keepalived.org/release-notes/Release-2.1.1.html https://www.keepalived.org/release-notes/Release-2.1.0.html - enable systemd integration via libsystemd (new BR: libsystemd) - switch to systemd_ordering instead of systemd_requires - sync configure options with the configure script - Make sure we pull in the libraries we need for dlopen, by following the symlinks from the .so symlinks with the requires_file macro. - Update to 2.2.2 https://www.keepalived.org/release-notes/Release-2.2.2.html - change how we install documentation to avoid duplicated files - Link all the files for ipset, iptables, libnl instead of dlopen. Drop the previous workaround for generating requires for the dlopen-ed libaries. - remove unsupported configure option: --enable-libiptc - drop linux-4.15.patch: No longer needed as it was a backport from upstream - Cleanup configure options after consultation with upstream: - --enable-regex-timers is for debugging purposes - --enable-snmp-checker and --enable-snmp-vrrp are enabled by - -enable-snmp - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by - -enable-snmp-rfc - --enable-stacktrace is definitely a debugging option - on systems where we have nftables support we will only ship with nftables support (>= 15.0) and use iptables support only on older distributions. - add 1915.patch to fix build on tumbleweed - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_keepalived.service.patch - VUL-0: CVE-2021-44225: keepalived: possible privilege escalation due to insufficient control in the D-Bus policy (bsc#1193115) apply upstream patch: * 0001-dbus-fix-policy-to-not-be-overly-broad.patch - FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default (bsc#1202808) Set ProtectKernelModules to false in service file - VUL-0: CVE-2024-41184: keepalived: integer overflow in vrrp_ipsets_handler (bsc#1228123) Apply upstream patches: bsc-1228123.patch - update to 2.0.11 - Fix segfault while shutting down when SNMP activity occurs. Issue #1061 identified that keepalived could segfault when it shut down. It appears that this was caused by data being received on the file descriptors that the snmp agent requests keepalived to monitor with epoll(). Since the read threads weren't being processed during a shutdown, the first time an snmp fd was ready, keepalived discarded the read thread. The second time that fd became ready there was no thread to handle the fd, and, since the assert() statement was not compiled in, non existant data was queued to the thread ready queue. This commit changes the assert() calls to continue, so that non existant data is no longer queued to the thread ready queue. - While shutting down, continue to handle snmp agent fds. Since we don't shutdown the snmp connection until the very end of the shutdown process (we need to be able to send snmp traps), we should continue to handle the snmp fds on behalf of the snmp agent while shutting down. - Ensure snmp agent is in correct state when initialising/closing Make sure the snmp agent is not already initialised before initialising it, and make sure it has been initialised before closing it. - Disable asserts in bfd code by default and add --enable-asserts Asserts were enabled by default in the bfd code, which shouldn't be the case. Add --enable-asserts configure option so that the asserts tests can be enabled while debugging. - Remove debugging log message accidently left in. - Update receive buffers when interface is created. The receive buffer size used by keepalived is based on the largest MTU of any interface that keepalived uses. If dynamic interfaces are being used and an interface is created after keepalived has started, the MTU of the new interface may be larger than the previous largest, so the receive buffer may need to be increased in size. Further, if vrrp_rx_bufs_policy is MTU, then the kernel receive buffers on the receive socket may need to be increased. - Handle MTU sizes being changed. Issue #1068 identified that the MTU size wasn't being updated in keepalived if it changed. This commit now updates the MTU size and adjusts receive buffer sizes accordingly. - Fix syntax error in configure.ac. - Fix double free when global data smtp_helo_name copied from local_name Issue #1071 identified a double free fault. It occurred when smtp_helo_name was not set, in which case it was set to point to the same malloc'd memory as local_name. At termination keepalived freed both local_name and smtp_helo_name. If keepalived needs to use local_name for smtp_helo_name it now malloc's additional memory to copy the string into. - Rename TIMER_MAX to TIMER_MAXIMUM. ulibC defines TIMER_MAX, so to avoid naming conflict rename it. This issue was reported by Paul Gildea <gildeap@tcd.ie> who also provided the patch. - Fix segfault when smtp alerts configured. - First working version of nftables. - Restructed code around how iptables/nftables are called This commit also allows building keepalived without iptables support, thereby allowing only nftables support. Adding any other mechanism to handle no_accept mode, i.e. blocking receiving and sending to/from VIPs should be added to vrrp_firewall.c, in a similar way to how nftables/iptables are used. - Update doc files re nftables. - Make nftables handle dont_track_primary appropriately. - Fix config reload with nftables. - Set base chain priorities from configuration. - Use iptables by default if neither iptables or nftables configured. But if the build of keepalived does not include iptables, then use nftables default. - Stop dumping keywords - left turned on after debugging. - Make umask configuration apply to created file. - Add libmnl and libnftnl to travis file. - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not defined. - Fix compilation failure when build with nftables but without iptables. - Fix order of include files in configure COLLISION test. Since Linux 4.4.11 (commit 1575c09) including linux/if.h after net/if.h works, whereas until glibc fix their headers including net/if.h after linux/if.h causes compiler redefinition errors. Unfortunately the test for the collision was done the wrong way round, as identified in issue #1079. The patch included in the issue report corrects the order of inclusion of the header files. What we should do is ensure that glibc header files are included before Linux header files, so that at least if kernel headers from 4.4.11 onwards are used, the conflict will not occur. - Set CLOEXEC on netlink sockets. - Correct error message for invalid route metric. - Add track_process for vrrp to monitor if another process is running. Configurations frequently include a track_script to check that a process is running, often haproxy or nginx. Using any of pgrep, pkill, killall, pidof, etc, has an overhead of reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline files. In particular reading the cmdline files has a significant overhead on a system that is swapping, since the cmdline files provide access to part of the address space of each process, which may need to be fetched from the swap space. This commit reads the /proc/[1-9]*/stat and/or the /proc/[1-9]*/cmdline files only when keepalived starts, and after that uses the process events connector to track process creation and termination. keepalived will ignore zombie processes, whereas pgrep etc include them. A minimum number of instances of a process can be specified, and also a delay so that if a process is restarted, it won't cause monitoring vrrp instances to immediately transition to fault state but to wait the configured time and it the monitored process starts again it won't transition to fault state. There are potential difficulties with the process event connector if a large number of process events occur very rapidly, since there can be a receive buffer overrun on the netlink socket. This code will detect that happening, increase the receive buffer size, and reread the processes from /proc. - Add missing #include to track_process.c. - Fix number of elements of fd_set read for snmp select info. - Remove thread_event_t when EPOLL_CTL_DEL fails. If snmpd closes a file descriptor, when keepalived attempts to unregister the fd from epoll an error is returned. However, we still need to remove the thread_event_t from the io_events rbtree. - Fix connection to snmpd after it has to reconnect. Issue #1080 identified that keepalived wasn't handling a connection failure and reconnect to snmpd properly. The problem was created when the change from select() to epoll() was made. This commit makes keepalived unregister and reregister the snmp file descriptors after snmpd reconnects. - Fix retry count for SMTP_CHECK checker. The checker was doing one too few retries. - Make healthchecker failure reporting consistent Some healthcheckers were reporting all failures, and others only when the retries expired. This commit by default makes the checkers only report failure when the retries expire, unless the global keyword checker_log_all_failures or log_all_failures on the specific checker is configured. - After reload, reinitialise current track processes state. - Remove unused variable in track_process.c. - Add configure checks re --with-kernel-dir. - Convert remaining select() to epoll_wait(). keepalived was using select() for handling the termination of child processes, but the main scheduling loop now uses epoll_wait(), so convert the select() to epoll_wait() from consistency. - Stop keepalived leaving zombie child processes. keepalived wasn't reaping the termination of its child processes, so this commit adds waitpid() calls once it knows the processes have terminated. - Fix make distclean and make distcheck. - Also skip route not configured with down interface. Otherwise, if keepalived has virtual_routes configured, we create a virtual interface and bring it up and down, current code will bring VRRP state to FAULT and never return. - Stop vrrp process entering infinite loop when track script times out Issue #1093 identified that the vrrp process was entering an infinite loop after a track script timed out. This was due to a child process thread having an RB tree for PIDs as well as for the timeout, and if a child process timed out, the thread wasn't being removed from the PID RB tree. This commit now ensures it is removed. - Fix the abbreviation of Shortest Expected Delay. - Don't free unallocated memory if not tracking processes. - vrrp: Rewrote JSON code Remove dependency to json-c extralib by using a simple streaming JSON writter. Refactored code to make it simple to maintain. - vrrp: Fix JSON handling for v{route;rule}. - autoconf: fix nftables selection We need to inhibit nftable compilation if compiling system has kernel header file nf_tables.h but not libnftnl nor libmnl. - fix build on 42.3/sle12 by disabling http regexp check support - add nftables to the BR - cleanup BR support for sle11, moved almost all BR to pkgconfig style - disable dbus instance creation support as it is marked as dangerous - update to 2.0.13 - Add BFD build option to keepalived.spec rpm file Issue #1114 identified that the keepalived.spec file was not being generated to build BFD support even if keepalived had been configured to support it. - Copy tarball to rpmbuild/SOURCES when building in place It seems that even when building in place, rpmbuild expects the tarball to be in the rpmbuild/SOURCES directory. - Fix configure check for __always_inline - Handle interface MAC addresses changing When an interface is added to a bond interface, if it is the first interface added, the MAC address of the bond interface is changed to the MAC address of the added interface. When subsequent interfaces are added, their MAC addresses are changed to that of the bond interface. Issue #1112 identified that if a bond interface is deleted and recreated, the gratuitous ARPs were sent with the wrong source MAC address. This commit now updates interface MAC addresses from the netlink RTM_NEWLINK messages, so that the correct MAC address is always used. - Minor tidying up of opening gratuitous ARP socket. - Streamline setting SOCK_NONBLOCK on vrrp sockets. - Use netlink reported hardware address length for unsolicited NAs ETH_ALEN is correct for Ethernet type interaces, but is not right for Infiniband interfaces. - Minor tidying up of opening gratuitous NA socket. - Make gratuitous ARP/NA sockets non blocking keepalived shouldn't block when sending gratutious ARP/NA messages. It is better to lose the messages than for keepalived to block, so set the sockets non blocking. - Use netlink provided broadcast address for gratuitous ARP If an interface has a non-standard broadcast address, we should honour it. - Fix building on pre 3.10 kernels re track_process Issue #1119 reported that keepalived wouldn't build on CentOS 6. Various PROC_EVENT_- declarations were assumed to exist, some of which were not introduced until Linux v3.10. Most of them are not needed, but PROC_EVENT_COMM is used by the track_process code. This commit now checks for the existence of the PROC_EVENT_- declarations, but since keepalived uses PROC_EVENT_COMM, track_process is not supported prior to Linux v3.2. - Make track_process work prior to Linux 3.2, but with limitations Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which means that keepalived is unable to detect changes to process name (/proc/PID/comm) prior to Linux 3.2. most processes do not change their process name, and so using track_process prior to Linux 3.2 is safe so long as the monitored processes are known not to change their process name. - Stop configure failing when nftables is not supported. - Streamline socket use with linkbeat. Previously the socket used for ioctls was opened and closed twice per poll if using MII or ETHTOOL polling, and once per poll if using ioctl polling. This commit opens the socket once at startup, uses that socket for all linkbeat polls, and closes it on termination. - Enable linkbeat polling to work with dynamic interfaces. - Add linkbeat_interfaces configuration block It was not possible to indicate that an interface that wasn't used as the interface of a vrrp instance, but was used either as a track interface, or for virtual/static ip addresses or routes should use linkbeat. This commit adds that capability. - Add ability to specify linkbeat type in linkbeat_interfaces block. - Add --disable-linkbeat configure option Does anyone use linkbeat anymore? This commit enables keepalived to be build without the linkbeat code. - Don't remove link local IPv6 address from VMAC that isn't keepalived's If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface already had a (non-default) link local addresss and the link local address that matched the interface's MAC address was added, keepalived was removing it as soon as it was added. This commit stop keepalived removing the address when we shouldn't. - Set configure init type correctly in keepalived.spec file. - Fix handling of VMACs with multiple reloads If a configuration is loaded that has a VRRP instance using a VMAC, then the configuration is updated to remove that VRRP instance and keepalived reloads its configuration, then the configuration is updated again to reinstate the VRRP instance and the configuration is again reloaded, keepalived thought the VMAC interface still existed, whereas it was deleted following the first reload. This commit ensures that keepalived properly detects whether an interface exists following a reload. - Remember more than one interface local address per interface Keepalived needs a local address for each interface it sends adverts on. If the address keepalived is using is deleted and another address is configured on the interface, then keepalived should start using that address. To do this, a list of configured address on each interfaces needs to be maintained. - Don't consider VIPs as local addresses when restart after crash Keepalived maintains a list of addresses per interface that can be used as source adddresses for adverts. To build the list, keepalived reads the addresses configured on interfaces when it starts. However, if keepalived crashed it will have left VIPs configured on interfaces, and we don't want to use them as advert source addresses. This commit makes keepalived compare the addresses on interfaces to VIPs, and ignores any addresses that are VIPs. - Fix removing left over VIPs at startup. - Use read_timer() when parsing config where appropriate. - Allow fractional warmup, delay_loop and delay_before_retry for checkers To shorten the real server monitoring interval, make it possible to specify decimal value for following items: warmup delay_loop delay_before_retry - Update connect_timeout configuration options Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch allows setting the connect_timeout to a resolution of micro-seconds. The patch also adds the ability to set a default value at the virtual server and real server levels. - Fix unused variable warning when building only with RFC compliant SNMP. - It enable to set zero value as mintime for delay_loop and connect_timeout. - Add option not to check for EINTR if using signalfd() If keepalived is using signalfd(), there are no asynchronous signal handlers, and therefore EINTR cannot be returned. Currently the check for EINTR is enabled by default, and configure option --disable-eintr-debug disables the check, while - -enable-eintr-debug enables writing log entries if EINTR is returned. Once sufficient testing has been performed, the default will be changed not to test for EINTR if signalfd() is supported. - Make checking for EAGAIN/EWOULDBLOCK consistent The code in some places checked errno for EAGAIN and EWOULDBLOCK and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK, so the check is not necessary, but EAGAIN is not guaranteed to be the same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN if they are the same value, but checks both if they are different. - Ensure default connection timeout for smtp checker hosts set. - Set default connection timeout if no smtp check host specified. - Fix min timer value, zero to 0.000001Sec. - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler(). - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds. - vrrp: vrrp_dispatcher_read() performance extension We took time with Quentin to simulate and rework this code. We introduced 2 imbricated while loop: (1) First one is catching recvfrom EINTR (this code trig only on kernel older than 2.6.22 where signalfd was firstly introduced). Newer kernel will immediately break the loop (hey guys: if you are running older than 2.6.22 it is worth considering upgrading). (2) Second loop will continue reading from socket until same VRID advert has been received during the same cycle. After simulating, it appears that during contention with a lot of VRRP instances (around 1500), this design is needed to relax socket recvq from growing. This can be viewed as a Poll-Mode activation during contention and fallback to regular I/O MUX during normal operations. This loop breaks immediately and re-submit opration to I/O MUX when there is no more to be read. - Fix conversion from long for double in read_timer(). - Remove variable timer of unsigned long cast in read_timer(). When Double type variable timer is cast to long type, it's scale falls. - changes from2.0.12 - Documentation related. Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage. Update README manifest to reflect actual Keepalived goal and features. - Improve error message if process events connector not enabled in kernel. - Add option to disable track-process functionality Issue #1099 reported that their kernel did not support the proc events connector, and it would therefore be helpful to have an option to build keepalived without the track-process functionality. This commit adds the --disable-track-process configure option. - Fix vrrp instances going to fault state when have virtual routes If an interface going down caused a vrrp instance to go to fault state, and the vrrp instance also had virtual routes, the state of the vrrp instance would be set to backup when the deletion of the virtual route was detected. This commit ensures that the vrrp instance stays in fault state until the interface is brought up again. - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file. Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on Linux 2.4, which is no longer supported by keepalived. The options in the spec file for Reh Hat Linux 9 have twice caused people to specify wrong options to configure when trying to build keepalived, so the options are removed to i) avoid confusion and ii) they are not longer relevant. - Add global option vrrp_min_garp. By default keepalived sends 5 gratuitous ARP/NA messages after transitioning to master, and 5 more 5 seconds later. This isn't necessary with modern switches, and so if the vrrp_min_garp option is set, only one gratuitious ARP/NA message is sent after transition to master, and no repeat messages are sent 4 seconds later. - Standardise definition of _INCLUDE_UNUSED_CODE_ - Remove out of date comment re VRRP over IPv6. - Correct typo in keepalived.conf.5. - Directly use structure sizes for packet header lengths. - vrrp_state_fault_rx() is not used. Wrap the function in conditional compilation so it is not compiled - Convert so list loops to use LIST_FOREACH. - Don't recalculate vrrp packet header address. vrrp_get_header() calculates the address of the vrrp header in a received packet, but it was being recalculated in vrrp_in_chk(). This commit passes the already calculated address to vrrp_in_chk(). - Ensure a received packet has an AH header if and only if AH auth. Ensure that a received packet has an AH header if we expect AH authentication, and doesn't have an AH header if we don't expect AH authentication. - Ensure all protocol headers received before return pointer to vrrp header vrrp_get_header() returns a pointer to the vrrp header, but it now returns NULL if insufficient data has been received to include all the (IP, possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP packet). This means that when a pointer to the VRRP header is returned, all fields in all protocol headers can safely be accessed. - Add check of received IPv6 hop count in multicast adverts The VRRP RFC requires that IPv6 hop count MUST be checked to be 255, just as the TTL for IPv6 must be 255. Previously that wasn't being checked, since IPv6 raw sockets don't provide access to the IPv6 header. Using recvmsg() rather than recvfrom(), and setting socket option IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as ancillary data, and that can now be checked. - Improve reading from vrrp receive sockets. Previously no check was made of the return value from recvfrom()/ recvmsg(). This meant than an error could occur (e.g. EINTR), or no data might be returned, and keepalived would still attempt to process the receive buffer as though data had been received. - Enhance and streamline checking of validity of received VRRP packet This includes checking that a packet is multicast, unless unicast is expected in which case it is checked for unicast, ensuring that if AH authentication is used, the next header protocol is VRRP. The sequence of some checks is revised to ensure that the fields being checked are valid to be accessed prior to accessing them, e.g. check that the packet is VRRP version 2 before checking the authentication. - Stop clearing receive buffer before receiving VRRP packets. This is no longer necessary now that the appropriate checks are made of the return status of recvmsg(), and also that the checks of received packet length and packet headers now do all necessary checks. - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO support. - Update keepalived.spec.in build-requires. The kernel package required for building keepalived is kernel-headers not kernel-devel. Also, it is superfluous to have package kernel in the build-requires! - Add missing file (build.setup) to tarball. - Fix calculating print format to rlim_t in configure.ac. - Fix compiler warnings on 32 bit systems re HASH_UPDATE. Removing all the casts stopped the warnings. - Use PRI_rlim_t when printing rlim_t types. - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems. - Fix some space/tab formatting. - Stop declaring some timer definitions unsigned to stop compiler warnings. TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings on some systems due to being defined with a 'U' unsigned suffix. Removing the unsigned specifier stopped the compiler warnings. - Fix compiler warning due to incorrect format specifier. An int64_t should use % PRIi64 and not %ld - Stop an uninitialized variable compiler warning. - Fix MEM_CHECK debugging on processors without unaligned memory access. - Don't attempt to use unopened socket for getting ipset version. - Tidy up an error message. - vrrp: make vrrp_dispatcher_read() async while catching error. During investigations we decided to update previous patch to resubmit into I/O MUX on read error. It will make read procedure I/O MUX freindly by removing potential sync operation potentially leading to a global I/O MUX desync. We aggreed, the situation is really and very exceptionnal but could happen. - vrrp: vrrp_arp_thread split. Split the function for maintainability purpose. - update to 2.0.14 - Add compiler warning -Wfloat-conversion and fix new warnings. It was discovered that passing 0.000001 as a parameter specified as uint32_t to a function did not generate any warning of type mismatch, or loss of precision. This commit adds -Wfloat-conversion and fixes 3 instances of new warnings that were generated. - For non systemd enviroment, it occurs syntax error 'fi'. To avoid syntax error, modify keepalived.spec.in. - When uninstall keepalived with init upstart, stop keepalived process. - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached. The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and so isn't currently compiled. - Register missing thread function for thread debugging. - Fix reutrn value of notify_script_compare misusing issue. - Fix typo in keepalived.conf man page re BFD min_rx. - Fix segfault when bfd process reloads config. Issue #1145 reported the bdf process was segfaulting when reloading. The bfd process was freeing and allocating a new thread_master_t when reloading, which doesn't work. This commit changes the bfd process to clean and reinitialise the thread_master_t. - Fix segfault in handle_proc_ev(). On Linux 3.10 the ack bit can be set in a connector message, and the CPU number is set to UINT32_MAX. This commit skips acks, and also checks that CPU number is within range of the number of CPUs on the system. - Fix OpenSSL init failure with OpenSSL v1.1.1. OpenSSL v1.1.1, but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously been called. This commit doesn't call OPENSSL_init_crypto() if doing so causes SSL_CTX_new() to fail. - Remove all references to libnfnetlink. Commit 2899da6 (Stop using linbl for mcast group membership and setting rx buf sizes) stopped using libnfnetlink, but INSTALL and keepalived.spec.in were not updated accordingly. - Fix genhash re OPENSSL_init_crypto bug and improve configure.ac. Commit fe6d6ac (Fix OpenSSL init failure with OpenSSL v1.1.1) didn't update the identical code in genhash/ssl.c. Also, an improvement for the test in configure.ac was suggested. - Fix log output when real server removed. FMT_VS() and FMT_RS() both call inet_sockaddrtotrio which uses a static buffer to return the formatted string, but since FMT_VS(), wheich simply calls format_vs() copies the returned string to its own static buffer, if FMT_VS() was called before FMT_RS() then the returned strings from both could be used. The problem occurs when both FMT_VS() and FMT_RS() are used as parameters to log_message() (or printf etc). It appeared to work fine on x86_64, but was writing the same IP address for both the real server and virtual server on ARM architectures. This is due to the compiler evaluating parameters to the log_message() function call in a different order on the different architectures. This commit adds inet_sockaddrtotrio_r() which allows the output to be in a buffer specified by the caller, and so FMT_VS() and FMT_RS() can now be called in either order without one overwriting a buffer used by the other. - Streamline some string formatting with FMT_RS() and FMR_VS(). Following commit 9fe353d (Fix log output when real server removed) some code can be streamlined now that the order of calling FMT_VS() and FMT_RS() does not matter. - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with FMT_CHK(). They were all simply defined to be FMT_CHK() so just replace them with that. This made it much simpler to find all used of FMT_CHK(). - Fix building with gcc 4.4.7 (Centos 6.5). gcc v4.4.7 doesn't support -Wfloat-conversion, so check for it at configure time. - Add dumping checker config/status when receive SIGUSR1. - Don't put alpha mode checkers into failed state at reload If a new checker is added at a reload, unless the real server aleady has failed checkers, then ignore the alpha mode of the checker. This means that the real server, if up, won't be taken down and then brought back up again almost straight away. If the real server already has failed checkers, then setting an alpha mode checker down initially won't take down the real server, so we can allow the alpha mode setting to apply. - Handle alpha mode checkers initial failure at startup better. - Fix compile failure discovered by Travis-CI. - Fix calling syslog when not using signalfd(). Pull request [#1149] identified that syslog is AS-Unsafe (see signal-safety man page), and that therefore signals should be blocked when calling it. This commit blocks signals when calling syslog()/vsyslog() when signalfd() is not being used. - Rationalise function attributes. - Fix enable-optimise configure option. - Use AS_HELP_STRING for all options in configure.ac. - Streamline genhash -h option. - Make genhash -v version match keepalived. - Fix config check of virtual server quorum against weights of real servers. - Fix some configure tested checks for OPENSSL_init_crypto. - Add infrastructure for adding additional compiler warnings. - Add standard and extra compiler warnings. - Add and resolve missing-declarations and missing-prototypes warnings Approximately 16 additional functions are now declared static. - Add and resolve old-style-definitions warnings - Add and resolve redundant-decls warnings - Add and resolve jump-misses-init warnings - Add and resolve shadow warnings - Add and resolve unsuffixed-float-constants warnings - Add and resolve suggest-attribute=const warnings - Add and resolve suggest-attribute=format warnings - Add and resolve suggest-attribute=malloc warnings - Add and resolve suggest-attribute=noreturn warnings - Add and resolve suggest-attribute=pure warnings - Add and resolve unused-macros warnings - Add and resolve null-dereference warnings - Add and resolve float-equal warnings - Add and resolve stack-protector warnings - Add and resolve strict-overflow=4 warnings - Add and resolve pointer-arith warnings This particularly includes adding a number of bytes to a void -. - Add and resolve cast-qual warnings - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7 - Remove static from zalloc() - Fix some compiler warnings on Ubuntu Xenial, and add comments re others. - Rename LIST parameters to lst in list_head.h to avoid upper case. - Fix real server checkers moving from failed to OK on reload. - add rs judgement in migrate_checkers. - Detect connection failure in genhash and exit rather than loop. - Add another function pure attribute. - Fix sending notifies for vrrp instances at startup when in sync group Issue #1155 idenfified that notify scripts for vrrp instance transition to backup state when keepalived started up were not being sent if the vrrp instance was in a sync group. It was also the case that SNMP traps, SMTP alerts and FIFO notifies were not being sent either. This commit make keepalived send the initial notifies when the vrrp instance is in a sync group. - Fix building keepalived RPM on Fedora 26. For some reason - fPIC is needed when testing for the presence of setns(). - Add vrrp_startup_delay configuration option. Some systems that start keepalived at boot time need to delay the startup of the vrrp instances, due to network interfaces taking time to properly come up. This commit adds a global configuration option vrrp_startup_delay that delays the vrrp instances starting up, for the specified number of seconds. - Handle checkers properly when reload immediately after startup. - Streamline some of the SMTP checker code. - Create separate checker for each host in SMTP_CHECK block Having multiple host entries in an SMTP_CHECK block is deprecated. This commit streamlines the SMTP_CHECK code by creating a separate SMTP checker for each host declared in the SMTP_CHECK block, so that apart from parsing the configuration, the code no longer handles multiple hosts per checker. The support for parsing configuration with multiple hosts is only enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is currently enabled, but when support for multiple hosts in the SMTP_CHECK block is finally removed, it will simply be a matter of deleting all code in the WITH_HOST_ENTRIES conditional blocks. - Make checker fail if ENETUNREACH returned by connect(). The connect() call can return some immediate errors such as ENETUNREACH. These were not being treated as a failure of the checker, since the code used to assume that any non success return by connect() meant that the connection was in progress. keepalived will now treat ENETUNREACH, EHOSTUNREACH, ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED, ETIMEDOUT, when returned by connect(), as meaning that the checker has failed. - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a timeout of 0 causes a TCP connection to be reset rather than cleanly closed. Instead of specifying a timeout of 0, use 5 seconds, so that there is an orderly shutdown of the TCP connection, but the close socket doesn't remain in TIMED_WAIT state for more than a short time. - nftables: fix build with kernel lower than 4.1. - Remove dead code and cosmectics. Remove code marked as UNUSED where things simply go nowhere even if define is set. We keep for the moment UNUSED code related to debug helpers used during coding process. - add buildrequires for file-devel - used in the checker to verify scripts - update to 2.0.15 - Fix uninitialised variable. - Fix rpmbuild on CentOS7, and rely on auto-requires. - Add option to flush lvs on shutdown. Currently all known virtual servers and their real servers are removed one at a time at shutdown. With large configurations on a busy system, this can take some time. Add an option just like the existing 'lvs_flush' which operates on shutdown. Typical environments with a single keepalived instance can take advantage of this option to achieve a faster shutdown or restart cycle. - Make alpha mode checkers on new real servers start down on reload. Patch #1180 identified that new real servers with alpha mode checkers were being added online immediately, and if the checker then failed were being removed. This commit makes real servers that didn't exist before the reload start in down state if they have alpha mode checkers. - Remove duplicate config dump entry. - Make new real servers at reload start down if have alpha mode checkers. - Close checker and smtp_alert sockets on reload. Issue #1177 identified that sockets were being left open (lost) after a reload. It transpired that these were sockets opened by TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK checkers, and by smtp_alerts in the process of being sent. This commit adds an extra parameter to thread_add_read() and thread_add_write() to allow indicating that the scheduler should close the socket when destroying threads. - Send vrrp group backup notifies at startup. - Make inhibit_on_failure be inherited by real server from virtual server. - Allow real and sorry servers to be configured with port 0 This is to maintain backwards compatibility with keepalived prior to commit d87f07c - "Ensure always check return from inet_stosockaddr when parsing config". The proper way to configure this is to omit the port, which requires the next commit. - Don't setup IPVS config with real and virtual servers ports different. If the real server is using DR or TUN, the port of the real server must be the same as the port of the virtual server. This commit uses the virtual server port for the real server when configuring IPVS. - Log warnings if real server and virtual server ports don't match This commit adds logging warnings if virtual and real server ports, when using TUN or DR, don't match. It also sets the real server ports to be the same as the virtual server ports. Although listing the IPVS configuration with ipvsadm will look different, the kernel ignored the port of a real server when using DR or TUN, so the behaviour isn't changed, but when looking at the configuration it now shows what is actually happening. - Fix warning when protocol specified for virtual server with fwmark. - Add log message that nb_get_retry is deprecated. - Fix whitespace in configure.ac. - Fix configure error when systemd not installed configure was trying to execute pkg-config --variable=systemdsystemunitdir systemd even if systemd was not available. This commit makes configure only execute the above if it has determined that systemd is the correct init package to use. - Correct references to RFC6527 (VRRPv3 SNMP RFC). - nsure checker->has_run is always set once a checker has run. - Fix some indentation in configure.ac. - Update fopen_safe() to open temporary file in destination directory rename() in fopen_safe() was failing if the file being created was not on the same filesystem as /tmp. - Add ${_RANDOM} configuration keyword. It might seem strange to introduce random elements to configuration files, but it can be useful for testing. - Fix using ~SEQ() in multiline configuration definitions. - Make blank lines terminate a multiline definition. - Minor updates for lvs_flush_on_stop. - Add option to skip deleting real servers on shutdown or reload If a virtual server is removed, the kernel will remove its real servers, so keepalived doesn't explicitly need to do so. The lvs_flush_onstop option removes all LVS configuration, whereas this new option will only remove the virtual servers managed by keepalived. - Correct error message re checker_log_all_failures. - Fix syntax error in configure.ac. - Fix track_process initialisation for processes with PIDs starting 9. - Remove debugging log message. - Remove inappropriate function const attributes They were causing iptables/ipsets not to be initialised. - Stop warning: function might be candidate for attribute "const" Depending on what configure options are selected, gcc can output the above warning for initialise_debug_options(). This commit ensures that the warning is not produced. - Enable strict-config-checks option in keepalived.spec RPM file. - vrrp: relax attribute 'const' warning at iptables helpers. - Propagate libm to KA_LIBS. - Fix building on Alpine Linux. Alpine (musl) doesn't have a definition of __GNU_PREREQ, so create a dummy definition. - added systemd-after-snmp.patch: If you want to use the snmp support the masterx socket needs be available otherwise the snmp support is broken strictly speaking we would need to use BindsTo= here but that would require that add a Requires for net-snmp to the keepalived package. to be discussed. - Update to 2.0.17 (2019-06-25) * https://www.keepalived.org/changelog.html - remove obsolete patch * systemd-after-snmp.patch - rebase patch * linux-4.15.patch - update to 2.0.19 Fix minor IPVS features support. Extend BFD to support more than one BFD instance with a neighnour. Extend nftable support. Script timeout extension. Properly filter IGMP/MLD packets on VMAC interface. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - changes from 2.0.18 Add support to IPVS new GUE tunnel type. New feature 'weight reverse' available in all trackers. Resolve all outstanding coverity issues. Some fixes and performance extensions. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - new BR pkgconfig(libnftnl) to fix nftables support - Inclusion into SLE as ACC supported packages (bsc#1158280, ECO#223) - Update to 2.2.1 https://www.keepalived.org/release-notes/Release-2.2.1.html https://www.keepalived.org/release-notes/Release-2.2.0.html https://www.keepalived.org/release-notes/Release-2.1.5.html https://www.keepalived.org/release-notes/Release-2.1.4.html https://www.keepalived.org/release-notes/Release-2.1.3.html https://www.keepalived.org/release-notes/Release-2.1.2.html https://www.keepalived.org/release-notes/Release-2.1.1.html https://www.keepalived.org/release-notes/Release-2.1.0.html - enable systemd integration via libsystemd (new BR: libsystemd) - switch to systemd_ordering instead of systemd_requires - sync configure options with the configure script - Make sure we pull in the libraries we need for dlopen, by following the symlinks from the .so symlinks with the requires_file macro. - Update to 2.2.2 https://www.keepalived.org/release-notes/Release-2.2.2.html - change how we install documentation to avoid duplicated files - Link all the files for ipset, iptables, libnl instead of dlopen. Drop the previous workaround for generating requires for the dlopen-ed libaries. - remove unsupported configure option: --enable-libiptc - drop linux-4.15.patch: No longer needed as it was a backport from upstream - Cleanup configure options after consultation with upstream: - --enable-regex-timers is for debugging purposes - --enable-snmp-checker and --enable-snmp-vrrp are enabled by - -enable-snmp - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by - -enable-snmp-rfc - --enable-stacktrace is definitely a debugging option - on systems where we have nftables support we will only ship with nftables support (>= 15.0) and use iptables support only on older distributions. - add 1915.patch to fix build on tumbleweed - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_keepalived.service.patch - VUL-0: CVE-2021-44225: keepalived: possible privilege escalation due to insufficient control in the D-Bus policy (bsc#1193115) apply upstream patch: * 0001-dbus-fix-policy-to-not-be-overly-broad.patch - FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default (bsc#1202808) Set ProtectKernelModules to false in service file - VUL-0: CVE-2024-41184: keepalived: integer overflow in vrrp_ipsets_handler (bsc#1228123) Apply upstream patches: bsc-1228123.patch - update to 2.0.11 - Fix segfault while shutting down when SNMP activity occurs. Issue #1061 identified that keepalived could segfault when it shut down. It appears that this was caused by data being received on the file descriptors that the snmp agent requests keepalived to monitor with epoll(). Since the read threads weren't being processed during a shutdown, the first time an snmp fd was ready, keepalived discarded the read thread. The second time that fd became ready there was no thread to handle the fd, and, since the assert() statement was not compiled in, non existant data was queued to the thread ready queue. This commit changes the assert() calls to continue, so that non existant data is no longer queued to the thread ready queue. - While shutting down, continue to handle snmp agent fds. Since we don't shutdown the snmp connection until the very end of the shutdown process (we need to be able to send snmp traps), we should continue to handle the snmp fds on behalf of the snmp agent while shutting down. - Ensure snmp agent is in correct state when initialising/closing Make sure the snmp agent is not already initialised before initialising it, and make sure it has been initialised before closing it. - Disable asserts in bfd code by default and add --enable-asserts Asserts were enabled by default in the bfd code, which shouldn't be the case. Add --enable-asserts configure option so that the asserts tests can be enabled while debugging. - Remove debugging log message accidently left in. - Update receive buffers when interface is created. The receive buffer size used by keepalived is based on the largest MTU of any interface that keepalived uses. If dynamic interfaces are being used and an interface is created after keepalived has started, the MTU of the new interface may be larger than the previous largest, so the receive buffer may need to be increased in size. Further, if vrrp_rx_bufs_policy is MTU, then the kernel receive buffers on the receive socket may need to be increased. - Handle MTU sizes being changed. Issue #1068 identified that the MTU size wasn't being updated in keepalived if it changed. This commit now updates the MTU size and adjusts receive buffer sizes accordingly. - Fix syntax error in configure.ac. - Fix double free when global data smtp_helo_name copied from local_name Issue #1071 identified a double free fault. It occurred when smtp_helo_name was not set, in which case it was set to point to the same malloc'd memory as local_name. At termination keepalived freed both local_name and smtp_helo_name. If keepalived needs to use local_name for smtp_helo_name it now malloc's additional memory to copy the string into. - Rename TIMER_MAX to TIMER_MAXIMUM. ulibC defines TIMER_MAX, so to avoid naming conflict rename it. This issue was reported by Paul Gildea <gildeap@tcd.ie> who also provided the patch. - Fix segfault when smtp alerts configured. - First working version of nftables. - Restructed code around how iptables/nftables are called This commit also allows building keepalived without iptables support, thereby allowing only nftables support. Adding any other mechanism to handle no_accept mode, i.e. blocking receiving and sending to/from VIPs should be added to vrrp_firewall.c, in a similar way to how nftables/iptables are used. - Update doc files re nftables. - Make nftables handle dont_track_primary appropriately. - Fix config reload with nftables. - Set base chain priorities from configuration. - Use iptables by default if neither iptables or nftables configured. But if the build of keepalived does not include iptables, then use nftables default. - Stop dumping keywords - left turned on after debugging. - Make umask configuration apply to created file. - Add libmnl and libnftnl to travis file. - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not defined. - Fix compilation failure when build with nftables but without iptables. - Fix order of include files in configure COLLISION test. Since Linux 4.4.11 (commit 1575c09) including linux/if.h after net/if.h works, whereas until glibc fix their headers including net/if.h after linux/if.h causes compiler redefinition errors. Unfortunately the test for the collision was done the wrong way round, as identified in issue #1079. The patch included in the issue report corrects the order of inclusion of the header files. What we should do is ensure that glibc header files are included before Linux header files, so that at least if kernel headers from 4.4.11 onwards are used, the conflict will not occur. - Set CLOEXEC on netlink sockets. - Correct error message for invalid route metric. - Add track_process for vrrp to monitor if another process is running. Configurations frequently include a track_script to check that a process is running, often haproxy or nginx. Using any of pgrep, pkill, killall, pidof, etc, has an overhead of reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline files. In particular reading the cmdline files has a significant overhead on a system that is swapping, since the cmdline files provide access to part of the address space of each process, which may need to be fetched from the swap space. This commit reads the /proc/[1-9]*/stat and/or the /proc/[1-9]*/cmdline files only when keepalived starts, and after that uses the process events connector to track process creation and termination. keepalived will ignore zombie processes, whereas pgrep etc include them. A minimum number of instances of a process can be specified, and also a delay so that if a process is restarted, it won't cause monitoring vrrp instances to immediately transition to fault state but to wait the configured time and it the monitored process starts again it won't transition to fault state. There are potential difficulties with the process event connector if a large number of process events occur very rapidly, since there can be a receive buffer overrun on the netlink socket. This code will detect that happening, increase the receive buffer size, and reread the processes from /proc. - Add missing #include to track_process.c. - Fix number of elements of fd_set read for snmp select info. - Remove thread_event_t when EPOLL_CTL_DEL fails. If snmpd closes a file descriptor, when keepalived attempts to unregister the fd from epoll an error is returned. However, we still need to remove the thread_event_t from the io_events rbtree. - Fix connection to snmpd after it has to reconnect. Issue #1080 identified that keepalived wasn't handling a connection failure and reconnect to snmpd properly. The problem was created when the change from select() to epoll() was made. This commit makes keepalived unregister and reregister the snmp file descriptors after snmpd reconnects. - Fix retry count for SMTP_CHECK checker. The checker was doing one too few retries. - Make healthchecker failure reporting consistent Some healthcheckers were reporting all failures, and others only when the retries expired. This commit by default makes the checkers only report failure when the retries expire, unless the global keyword checker_log_all_failures or log_all_failures on the specific checker is configured. - After reload, reinitialise current track processes state. - Remove unused variable in track_process.c. - Add configure checks re --with-kernel-dir. - Convert remaining select() to epoll_wait(). keepalived was using select() for handling the termination of child processes, but the main scheduling loop now uses epoll_wait(), so convert the select() to epoll_wait() from consistency. - Stop keepalived leaving zombie child processes. keepalived wasn't reaping the termination of its child processes, so this commit adds waitpid() calls once it knows the processes have terminated. - Fix make distclean and make distcheck. - Also skip route not configured with down interface. Otherwise, if keepalived has virtual_routes configured, we create a virtual interface and bring it up and down, current code will bring VRRP state to FAULT and never return. - Stop vrrp process entering infinite loop when track script times out Issue #1093 identified that the vrrp process was entering an infinite loop after a track script timed out. This was due to a child process thread having an RB tree for PIDs as well as for the timeout, and if a child process timed out, the thread wasn't being removed from the PID RB tree. This commit now ensures it is removed. - Fix the abbreviation of Shortest Expected Delay. - Don't free unallocated memory if not tracking processes. - vrrp: Rewrote JSON code Remove dependency to json-c extralib by using a simple streaming JSON writter. Refactored code to make it simple to maintain. - vrrp: Fix JSON handling for v{route;rule}. - autoconf: fix nftables selection We need to inhibit nftable compilation if compiling system has kernel header file nf_tables.h but not libnftnl nor libmnl. - fix build on 42.3/sle12 by disabling http regexp check support - add nftables to the BR - cleanup BR support for sle11, moved almost all BR to pkgconfig style - disable dbus instance creation support as it is marked as dangerous - update to 2.0.13 - Add BFD build option to keepalived.spec rpm file Issue #1114 identified that the keepalived.spec file was not being generated to build BFD support even if keepalived had been configured to support it. - Copy tarball to rpmbuild/SOURCES when building in place It seems that even when building in place, rpmbuild expects the tarball to be in the rpmbuild/SOURCES directory. - Fix configure check for __always_inline - Handle interface MAC addresses changing When an interface is added to a bond interface, if it is the first interface added, the MAC address of the bond interface is changed to the MAC address of the added interface. When subsequent interfaces are added, their MAC addresses are changed to that of the bond interface. Issue #1112 identified that if a bond interface is deleted and recreated, the gratuitous ARPs were sent with the wrong source MAC address. This commit now updates interface MAC addresses from the netlink RTM_NEWLINK messages, so that the correct MAC address is always used. - Minor tidying up of opening gratuitous ARP socket. - Streamline setting SOCK_NONBLOCK on vrrp sockets. - Use netlink reported hardware address length for unsolicited NAs ETH_ALEN is correct for Ethernet type interaces, but is not right for Infiniband interfaces. - Minor tidying up of opening gratuitous NA socket. - Make gratuitous ARP/NA sockets non blocking keepalived shouldn't block when sending gratutious ARP/NA messages. It is better to lose the messages than for keepalived to block, so set the sockets non blocking. - Use netlink provided broadcast address for gratuitous ARP If an interface has a non-standard broadcast address, we should honour it. - Fix building on pre 3.10 kernels re track_process Issue #1119 reported that keepalived wouldn't build on CentOS 6. Various PROC_EVENT_- declarations were assumed to exist, some of which were not introduced until Linux v3.10. Most of them are not needed, but PROC_EVENT_COMM is used by the track_process code. This commit now checks for the existence of the PROC_EVENT_- declarations, but since keepalived uses PROC_EVENT_COMM, track_process is not supported prior to Linux v3.2. - Make track_process work prior to Linux 3.2, but with limitations Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which means that keepalived is unable to detect changes to process name (/proc/PID/comm) prior to Linux 3.2. most processes do not change their process name, and so using track_process prior to Linux 3.2 is safe so long as the monitored processes are known not to change their process name. - Stop configure failing when nftables is not supported. - Streamline socket use with linkbeat. Previously the socket used for ioctls was opened and closed twice per poll if using MII or ETHTOOL polling, and once per poll if using ioctl polling. This commit opens the socket once at startup, uses that socket for all linkbeat polls, and closes it on termination. - Enable linkbeat polling to work with dynamic interfaces. - Add linkbeat_interfaces configuration block It was not possible to indicate that an interface that wasn't used as the interface of a vrrp instance, but was used either as a track interface, or for virtual/static ip addresses or routes should use linkbeat. This commit adds that capability. - Add ability to specify linkbeat type in linkbeat_interfaces block. - Add --disable-linkbeat configure option Does anyone use linkbeat anymore? This commit enables keepalived to be build without the linkbeat code. - Don't remove link local IPv6 address from VMAC that isn't keepalived's If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface already had a (non-default) link local addresss and the link local address that matched the interface's MAC address was added, keepalived was removing it as soon as it was added. This commit stop keepalived removing the address when we shouldn't. - Set configure init type correctly in keepalived.spec file. - Fix handling of VMACs with multiple reloads If a configuration is loaded that has a VRRP instance using a VMAC, then the configuration is updated to remove that VRRP instance and keepalived reloads its configuration, then the configuration is updated again to reinstate the VRRP instance and the configuration is again reloaded, keepalived thought the VMAC interface still existed, whereas it was deleted following the first reload. This commit ensures that keepalived properly detects whether an interface exists following a reload. - Remember more than one interface local address per interface Keepalived needs a local address for each interface it sends adverts on. If the address keepalived is using is deleted and another address is configured on the interface, then keepalived should start using that address. To do this, a list of configured address on each interfaces needs to be maintained. - Don't consider VIPs as local addresses when restart after crash Keepalived maintains a list of addresses per interface that can be used as source adddresses for adverts. To build the list, keepalived reads the addresses configured on interfaces when it starts. However, if keepalived crashed it will have left VIPs configured on interfaces, and we don't want to use them as advert source addresses. This commit makes keepalived compare the addresses on interfaces to VIPs, and ignores any addresses that are VIPs. - Fix removing left over VIPs at startup. - Use read_timer() when parsing config where appropriate. - Allow fractional warmup, delay_loop and delay_before_retry for checkers To shorten the real server monitoring interval, make it possible to specify decimal value for following items: warmup delay_loop delay_before_retry - Update connect_timeout configuration options Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch allows setting the connect_timeout to a resolution of micro-seconds. The patch also adds the ability to set a default value at the virtual server and real server levels. - Fix unused variable warning when building only with RFC compliant SNMP. - It enable to set zero value as mintime for delay_loop and connect_timeout. - Add option not to check for EINTR if using signalfd() If keepalived is using signalfd(), there are no asynchronous signal handlers, and therefore EINTR cannot be returned. Currently the check for EINTR is enabled by default, and configure option --disable-eintr-debug disables the check, while - -enable-eintr-debug enables writing log entries if EINTR is returned. Once sufficient testing has been performed, the default will be changed not to test for EINTR if signalfd() is supported. - Make checking for EAGAIN/EWOULDBLOCK consistent The code in some places checked errno for EAGAIN and EWOULDBLOCK and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK, so the check is not necessary, but EAGAIN is not guaranteed to be the same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN if they are the same value, but checks both if they are different. - Ensure default connection timeout for smtp checker hosts set. - Set default connection timeout if no smtp check host specified. - Fix min timer value, zero to 0.000001Sec. - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler(). - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds. - vrrp: vrrp_dispatcher_read() performance extension We took time with Quentin to simulate and rework this code. We introduced 2 imbricated while loop: (1) First one is catching recvfrom EINTR (this code trig only on kernel older than 2.6.22 where signalfd was firstly introduced). Newer kernel will immediately break the loop (hey guys: if you are running older than 2.6.22 it is worth considering upgrading). (2) Second loop will continue reading from socket until same VRID advert has been received during the same cycle. After simulating, it appears that during contention with a lot of VRRP instances (around 1500), this design is needed to relax socket recvq from growing. This can be viewed as a Poll-Mode activation during contention and fallback to regular I/O MUX during normal operations. This loop breaks immediately and re-submit opration to I/O MUX when there is no more to be read. - Fix conversion from long for double in read_timer(). - Remove variable timer of unsigned long cast in read_timer(). When Double type variable timer is cast to long type, it's scale falls. - changes from2.0.12 - Documentation related. Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage. Update README manifest to reflect actual Keepalived goal and features. - Improve error message if process events connector not enabled in kernel. - Add option to disable track-process functionality Issue #1099 reported that their kernel did not support the proc events connector, and it would therefore be helpful to have an option to build keepalived without the track-process functionality. This commit adds the --disable-track-process configure option. - Fix vrrp instances going to fault state when have virtual routes If an interface going down caused a vrrp instance to go to fault state, and the vrrp instance also had virtual routes, the state of the vrrp instance would be set to backup when the deletion of the virtual route was detected. This commit ensures that the vrrp instance stays in fault state until the interface is brought up again. - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file. Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on Linux 2.4, which is no longer supported by keepalived. The options in the spec file for Reh Hat Linux 9 have twice caused people to specify wrong options to configure when trying to build keepalived, so the options are removed to i) avoid confusion and ii) they are not longer relevant. - Add global option vrrp_min_garp. By default keepalived sends 5 gratuitous ARP/NA messages after transitioning to master, and 5 more 5 seconds later. This isn't necessary with modern switches, and so if the vrrp_min_garp option is set, only one gratuitious ARP/NA message is sent after transition to master, and no repeat messages are sent 4 seconds later. - Standardise definition of _INCLUDE_UNUSED_CODE_ - Remove out of date comment re VRRP over IPv6. - Correct typo in keepalived.conf.5. - Directly use structure sizes for packet header lengths. - vrrp_state_fault_rx() is not used. Wrap the function in conditional compilation so it is not compiled - Convert so list loops to use LIST_FOREACH. - Don't recalculate vrrp packet header address. vrrp_get_header() calculates the address of the vrrp header in a received packet, but it was being recalculated in vrrp_in_chk(). This commit passes the already calculated address to vrrp_in_chk(). - Ensure a received packet has an AH header if and only if AH auth. Ensure that a received packet has an AH header if we expect AH authentication, and doesn't have an AH header if we don't expect AH authentication. - Ensure all protocol headers received before return pointer to vrrp header vrrp_get_header() returns a pointer to the vrrp header, but it now returns NULL if insufficient data has been received to include all the (IP, possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP packet). This means that when a pointer to the VRRP header is returned, all fields in all protocol headers can safely be accessed. - Add check of received IPv6 hop count in multicast adverts The VRRP RFC requires that IPv6 hop count MUST be checked to be 255, just as the TTL for IPv6 must be 255. Previously that wasn't being checked, since IPv6 raw sockets don't provide access to the IPv6 header. Using recvmsg() rather than recvfrom(), and setting socket option IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as ancillary data, and that can now be checked. - Improve reading from vrrp receive sockets. Previously no check was made of the return value from recvfrom()/ recvmsg(). This meant than an error could occur (e.g. EINTR), or no data might be returned, and keepalived would still attempt to process the receive buffer as though data had been received. - Enhance and streamline checking of validity of received VRRP packet This includes checking that a packet is multicast, unless unicast is expected in which case it is checked for unicast, ensuring that if AH authentication is used, the next header protocol is VRRP. The sequence of some checks is revised to ensure that the fields being checked are valid to be accessed prior to accessing them, e.g. check that the packet is VRRP version 2 before checking the authentication. - Stop clearing receive buffer before receiving VRRP packets. This is no longer necessary now that the appropriate checks are made of the return status of recvmsg(), and also that the checks of received packet length and packet headers now do all necessary checks. - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO support. - Update keepalived.spec.in build-requires. The kernel package required for building keepalived is kernel-headers not kernel-devel. Also, it is superfluous to have package kernel in the build-requires! - Add missing file (build.setup) to tarball. - Fix calculating print format to rlim_t in configure.ac. - Fix compiler warnings on 32 bit systems re HASH_UPDATE. Removing all the casts stopped the warnings. - Use PRI_rlim_t when printing rlim_t types. - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems. - Fix some space/tab formatting. - Stop declaring some timer definitions unsigned to stop compiler warnings. TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings on some systems due to being defined with a 'U' unsigned suffix. Removing the unsigned specifier stopped the compiler warnings. - Fix compiler warning due to incorrect format specifier. An int64_t should use % PRIi64 and not %ld - Stop an uninitialized variable compiler warning. - Fix MEM_CHECK debugging on processors without unaligned memory access. - Don't attempt to use unopened socket for getting ipset version. - Tidy up an error message. - vrrp: make vrrp_dispatcher_read() async while catching error. During investigations we decided to update previous patch to resubmit into I/O MUX on read error. It will make read procedure I/O MUX freindly by removing potential sync operation potentially leading to a global I/O MUX desync. We aggreed, the situation is really and very exceptionnal but could happen. - vrrp: vrrp_arp_thread split. Split the function for maintainability purpose. - update to 2.0.14 - Add compiler warning -Wfloat-conversion and fix new warnings. It was discovered that passing 0.000001 as a parameter specified as uint32_t to a function did not generate any warning of type mismatch, or loss of precision. This commit adds -Wfloat-conversion and fixes 3 instances of new warnings that were generated. - For non systemd enviroment, it occurs syntax error 'fi'. To avoid syntax error, modify keepalived.spec.in. - When uninstall keepalived with init upstart, stop keepalived process. - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached. The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and so isn't currently compiled. - Register missing thread function for thread debugging. - Fix reutrn value of notify_script_compare misusing issue. - Fix typo in keepalived.conf man page re BFD min_rx. - Fix segfault when bfd process reloads config. Issue #1145 reported the bdf process was segfaulting when reloading. The bfd process was freeing and allocating a new thread_master_t when reloading, which doesn't work. This commit changes the bfd process to clean and reinitialise the thread_master_t. - Fix segfault in handle_proc_ev(). On Linux 3.10 the ack bit can be set in a connector message, and the CPU number is set to UINT32_MAX. This commit skips acks, and also checks that CPU number is within range of the number of CPUs on the system. - Fix OpenSSL init failure with OpenSSL v1.1.1. OpenSSL v1.1.1, but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously been called. This commit doesn't call OPENSSL_init_crypto() if doing so causes SSL_CTX_new() to fail. - Remove all references to libnfnetlink. Commit 2899da6 (Stop using linbl for mcast group membership and setting rx buf sizes) stopped using libnfnetlink, but INSTALL and keepalived.spec.in were not updated accordingly. - Fix genhash re OPENSSL_init_crypto bug and improve configure.ac. Commit fe6d6ac (Fix OpenSSL init failure with OpenSSL v1.1.1) didn't update the identical code in genhash/ssl.c. Also, an improvement for the test in configure.ac was suggested. - Fix log output when real server removed. FMT_VS() and FMT_RS() both call inet_sockaddrtotrio which uses a static buffer to return the formatted string, but since FMT_VS(), wheich simply calls format_vs() copies the returned string to its own static buffer, if FMT_VS() was called before FMT_RS() then the returned strings from both could be used. The problem occurs when both FMT_VS() and FMT_RS() are used as parameters to log_message() (or printf etc). It appeared to work fine on x86_64, but was writing the same IP address for both the real server and virtual server on ARM architectures. This is due to the compiler evaluating parameters to the log_message() function call in a different order on the different architectures. This commit adds inet_sockaddrtotrio_r() which allows the output to be in a buffer specified by the caller, and so FMT_VS() and FMT_RS() can now be called in either order without one overwriting a buffer used by the other. - Streamline some string formatting with FMT_RS() and FMR_VS(). Following commit 9fe353d (Fix log output when real server removed) some code can be streamlined now that the order of calling FMT_VS() and FMT_RS() does not matter. - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with FMT_CHK(). They were all simply defined to be FMT_CHK() so just replace them with that. This made it much simpler to find all used of FMT_CHK(). - Fix building with gcc 4.4.7 (Centos 6.5). gcc v4.4.7 doesn't support -Wfloat-conversion, so check for it at configure time. - Add dumping checker config/status when receive SIGUSR1. - Don't put alpha mode checkers into failed state at reload If a new checker is added at a reload, unless the real server aleady has failed checkers, then ignore the alpha mode of the checker. This means that the real server, if up, won't be taken down and then brought back up again almost straight away. If the real server already has failed checkers, then setting an alpha mode checker down initially won't take down the real server, so we can allow the alpha mode setting to apply. - Handle alpha mode checkers initial failure at startup better. - Fix compile failure discovered by Travis-CI. - Fix calling syslog when not using signalfd(). Pull request [#1149] identified that syslog is AS-Unsafe (see signal-safety man page), and that therefore signals should be blocked when calling it. This commit blocks signals when calling syslog()/vsyslog() when signalfd() is not being used. - Rationalise function attributes. - Fix enable-optimise configure option. - Use AS_HELP_STRING for all options in configure.ac. - Streamline genhash -h option. - Make genhash -v version match keepalived. - Fix config check of virtual server quorum against weights of real servers. - Fix some configure tested checks for OPENSSL_init_crypto. - Add infrastructure for adding additional compiler warnings. - Add standard and extra compiler warnings. - Add and resolve missing-declarations and missing-prototypes warnings Approximately 16 additional functions are now declared static. - Add and resolve old-style-definitions warnings - Add and resolve redundant-decls warnings - Add and resolve jump-misses-init warnings - Add and resolve shadow warnings - Add and resolve unsuffixed-float-constants warnings - Add and resolve suggest-attribute=const warnings - Add and resolve suggest-attribute=format warnings - Add and resolve suggest-attribute=malloc warnings - Add and resolve suggest-attribute=noreturn warnings - Add and resolve suggest-attribute=pure warnings - Add and resolve unused-macros warnings - Add and resolve null-dereference warnings - Add and resolve float-equal warnings - Add and resolve stack-protector warnings - Add and resolve strict-overflow=4 warnings - Add and resolve pointer-arith warnings This particularly includes adding a number of bytes to a void -. - Add and resolve cast-qual warnings - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7 - Remove static from zalloc() - Fix some compiler warnings on Ubuntu Xenial, and add comments re others. - Rename LIST parameters to lst in list_head.h to avoid upper case. - Fix real server checkers moving from failed to OK on reload. - add rs judgement in migrate_checkers. - Detect connection failure in genhash and exit rather than loop. - Add another function pure attribute. - Fix sending notifies for vrrp instances at startup when in sync group Issue #1155 idenfified that notify scripts for vrrp instance transition to backup state when keepalived started up were not being sent if the vrrp instance was in a sync group. It was also the case that SNMP traps, SMTP alerts and FIFO notifies were not being sent either. This commit make keepalived send the initial notifies when the vrrp instance is in a sync group. - Fix building keepalived RPM on Fedora 26. For some reason - fPIC is needed when testing for the presence of setns(). - Add vrrp_startup_delay configuration option. Some systems that start keepalived at boot time need to delay the startup of the vrrp instances, due to network interfaces taking time to properly come up. This commit adds a global configuration option vrrp_startup_delay that delays the vrrp instances starting up, for the specified number of seconds. - Handle checkers properly when reload immediately after startup. - Streamline some of the SMTP checker code. - Create separate checker for each host in SMTP_CHECK block Having multiple host entries in an SMTP_CHECK block is deprecated. This commit streamlines the SMTP_CHECK code by creating a separate SMTP checker for each host declared in the SMTP_CHECK block, so that apart from parsing the configuration, the code no longer handles multiple hosts per checker. The support for parsing configuration with multiple hosts is only enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is currently enabled, but when support for multiple hosts in the SMTP_CHECK block is finally removed, it will simply be a matter of deleting all code in the WITH_HOST_ENTRIES conditional blocks. - Make checker fail if ENETUNREACH returned by connect(). The connect() call can return some immediate errors such as ENETUNREACH. These were not being treated as a failure of the checker, since the code used to assume that any non success return by connect() meant that the connection was in progress. keepalived will now treat ENETUNREACH, EHOSTUNREACH, ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED, ETIMEDOUT, when returned by connect(), as meaning that the checker has failed. - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a timeout of 0 causes a TCP connection to be reset rather than cleanly closed. Instead of specifying a timeout of 0, use 5 seconds, so that there is an orderly shutdown of the TCP connection, but the close socket doesn't remain in TIMED_WAIT state for more than a short time. - nftables: fix build with kernel lower than 4.1. - Remove dead code and cosmectics. Remove code marked as UNUSED where things simply go nowhere even if define is set. We keep for the moment UNUSED code related to debug helpers used during coding process. - add buildrequires for file-devel - used in the checker to verify scripts - update to 2.0.15 - Fix uninitialised variable. - Fix rpmbuild on CentOS7, and rely on auto-requires. - Add option to flush lvs on shutdown. Currently all known virtual servers and their real servers are removed one at a time at shutdown. With large configurations on a busy system, this can take some time. Add an option just like the existing 'lvs_flush' which operates on shutdown. Typical environments with a single keepalived instance can take advantage of this option to achieve a faster shutdown or restart cycle. - Make alpha mode checkers on new real servers start down on reload. Patch #1180 identified that new real servers with alpha mode checkers were being added online immediately, and if the checker then failed were being removed. This commit makes real servers that didn't exist before the reload start in down state if they have alpha mode checkers. - Remove duplicate config dump entry. - Make new real servers at reload start down if have alpha mode checkers. - Close checker and smtp_alert sockets on reload. Issue #1177 identified that sockets were being left open (lost) after a reload. It transpired that these were sockets opened by TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK checkers, and by smtp_alerts in the process of being sent. This commit adds an extra parameter to thread_add_read() and thread_add_write() to allow indicating that the scheduler should close the socket when destroying threads. - Send vrrp group backup notifies at startup. - Make inhibit_on_failure be inherited by real server from virtual server. - Allow real and sorry servers to be configured with port 0 This is to maintain backwards compatibility with keepalived prior to commit d87f07c - "Ensure always check return from inet_stosockaddr when parsing config". The proper way to configure this is to omit the port, which requires the next commit. - Don't setup IPVS config with real and virtual servers ports different. If the real server is using DR or TUN, the port of the real server must be the same as the port of the virtual server. This commit uses the virtual server port for the real server when configuring IPVS. - Log warnings if real server and virtual server ports don't match This commit adds logging warnings if virtual and real server ports, when using TUN or DR, don't match. It also sets the real server ports to be the same as the virtual server ports. Although listing the IPVS configuration with ipvsadm will look different, the kernel ignored the port of a real server when using DR or TUN, so the behaviour isn't changed, but when looking at the configuration it now shows what is actually happening. - Fix warning when protocol specified for virtual server with fwmark. - Add log message that nb_get_retry is deprecated. - Fix whitespace in configure.ac. - Fix configure error when systemd not installed configure was trying to execute pkg-config --variable=systemdsystemunitdir systemd even if systemd was not available. This commit makes configure only execute the above if it has determined that systemd is the correct init package to use. - Correct references to RFC6527 (VRRPv3 SNMP RFC). - nsure checker->has_run is always set once a checker has run. - Fix some indentation in configure.ac. - Update fopen_safe() to open temporary file in destination directory rename() in fopen_safe() was failing if the file being created was not on the same filesystem as /tmp. - Add ${_RANDOM} configuration keyword. It might seem strange to introduce random elements to configuration files, but it can be useful for testing. - Fix using ~SEQ() in multiline configuration definitions. - Make blank lines terminate a multiline definition. - Minor updates for lvs_flush_on_stop. - Add option to skip deleting real servers on shutdown or reload If a virtual server is removed, the kernel will remove its real servers, so keepalived doesn't explicitly need to do so. The lvs_flush_onstop option removes all LVS configuration, whereas this new option will only remove the virtual servers managed by keepalived. - Correct error message re checker_log_all_failures. - Fix syntax error in configure.ac. - Fix track_process initialisation for processes with PIDs starting 9. - Remove debugging log message. - Remove inappropriate function const attributes They were causing iptables/ipsets not to be initialised. - Stop warning: function might be candidate for attribute "const" Depending on what configure options are selected, gcc can output the above warning for initialise_debug_options(). This commit ensures that the warning is not produced. - Enable strict-config-checks option in keepalived.spec RPM file. - vrrp: relax attribute 'const' warning at iptables helpers. - Propagate libm to KA_LIBS. - Fix building on Alpine Linux. Alpine (musl) doesn't have a definition of __GNU_PREREQ, so create a dummy definition. - added systemd-after-snmp.patch: If you want to use the snmp support the masterx socket needs be available otherwise the snmp support is broken strictly speaking we would need to use BindsTo= here but that would require that add a Requires for net-snmp to the keepalived package. to be discussed. - Update to 2.0.17 (2019-06-25) * https://www.keepalived.org/changelog.html - remove obsolete patch * systemd-after-snmp.patch - rebase patch * linux-4.15.patch - update to 2.0.19 Fix minor IPVS features support. Extend BFD to support more than one BFD instance with a neighnour. Extend nftable support. Script timeout extension. Properly filter IGMP/MLD packets on VMAC interface. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - changes from 2.0.18 Add support to IPVS new GUE tunnel type. New feature 'weight reverse' available in all trackers. Resolve all outstanding coverity issues. Some fixes and performance extensions. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - new BR pkgconfig(libnftnl) to fix nftables support - Inclusion into SLE as ACC supported packages (bsc#1158280, ECO#223) - Update to 2.2.1 https://www.keepalived.org/release-notes/Release-2.2.1.html https://www.keepalived.org/release-notes/Release-2.2.0.html https://www.keepalived.org/release-notes/Release-2.1.5.html https://www.keepalived.org/release-notes/Release-2.1.4.html https://www.keepalived.org/release-notes/Release-2.1.3.html https://www.keepalived.org/release-notes/Release-2.1.2.html https://www.keepalived.org/release-notes/Release-2.1.1.html https://www.keepalived.org/release-notes/Release-2.1.0.html - enable systemd integration via libsystemd (new BR: libsystemd) - switch to systemd_ordering instead of systemd_requires - sync configure options with the configure script - Make sure we pull in the libraries we need for dlopen, by following the symlinks from the .so symlinks with the requires_file macro. - Update to 2.2.2 https://www.keepalived.org/release-notes/Release-2.2.2.html - change how we install documentation to avoid duplicated files - Link all the files for ipset, iptables, libnl instead of dlopen. Drop the previous workaround for generating requires for the dlopen-ed libaries. - remove unsupported configure option: --enable-libiptc - drop linux-4.15.patch: No longer needed as it was a backport from upstream - Cleanup configure options after consultation with upstream: - --enable-regex-timers is for debugging purposes - --enable-snmp-checker and --enable-snmp-vrrp are enabled by - -enable-snmp - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by - -enable-snmp-rfc - --enable-stacktrace is definitely a debugging option - on systems where we have nftables support we will only ship with nftables support (>= 15.0) and use iptables support only on older distributions. - add 1915.patch to fix build on tumbleweed - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_keepalived.service.patch - VUL-0: CVE-2021-44225: keepalived: possible privilege escalation due to insufficient control in the D-Bus policy (bsc#1193115) apply upstream patch: * 0001-dbus-fix-policy-to-not-be-overly-broad.patch - FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default (bsc#1202808) Set ProtectKernelModules to false in service file - VUL-0: CVE-2024-41184: keepalived: integer overflow in vrrp_ipsets_handler (bsc#1228123) Apply upstream patches: bsc-1228123.patch - update to 2.0.11 - Fix segfault while shutting down when SNMP activity occurs. Issue #1061 identified that keepalived could segfault when it shut down. It appears that this was caused by data being received on the file descriptors that the snmp agent requests keepalived to monitor with epoll(). Since the read threads weren't being processed during a shutdown, the first time an snmp fd was ready, keepalived discarded the read thread. The second time that fd became ready there was no thread to handle the fd, and, since the assert() statement was not compiled in, non existant data was queued to the thread ready queue. This commit changes the assert() calls to continue, so that non existant data is no longer queued to the thread ready queue. - While shutting down, continue to handle snmp agent fds. Since we don't shutdown the snmp connection until the very end of the shutdown process (we need to be able to send snmp traps), we should continue to handle the snmp fds on behalf of the snmp agent while shutting down. - Ensure snmp agent is in correct state when initialising/closing Make sure the snmp agent is not already initialised before initialising it, and make sure it has been initialised before closing it. - Disable asserts in bfd code by default and add --enable-asserts Asserts were enabled by default in the bfd code, which shouldn't be the case. Add --enable-asserts configure option so that the asserts tests can be enabled while debugging. - Remove debugging log message accidently left in. - Update receive buffers when interface is created. The receive buffer size used by keepalived is based on the largest MTU of any interface that keepalived uses. If dynamic interfaces are being used and an interface is created after keepalived has started, the MTU of the new interface may be larger than the previous largest, so the receive buffer may need to be increased in size. Further, if vrrp_rx_bufs_policy is MTU, then the kernel receive buffers on the receive socket may need to be increased. - Handle MTU sizes being changed. Issue #1068 identified that the MTU size wasn't being updated in keepalived if it changed. This commit now updates the MTU size and adjusts receive buffer sizes accordingly. - Fix syntax error in configure.ac. - Fix double free when global data smtp_helo_name copied from local_name Issue #1071 identified a double free fault. It occurred when smtp_helo_name was not set, in which case it was set to point to the same malloc'd memory as local_name. At termination keepalived freed both local_name and smtp_helo_name. If keepalived needs to use local_name for smtp_helo_name it now malloc's additional memory to copy the string into. - Rename TIMER_MAX to TIMER_MAXIMUM. ulibC defines TIMER_MAX, so to avoid naming conflict rename it. This issue was reported by Paul Gildea <gildeap@tcd.ie> who also provided the patch. - Fix segfault when smtp alerts configured. - First working version of nftables. - Restructed code around how iptables/nftables are called This commit also allows building keepalived without iptables support, thereby allowing only nftables support. Adding any other mechanism to handle no_accept mode, i.e. blocking receiving and sending to/from VIPs should be added to vrrp_firewall.c, in a similar way to how nftables/iptables are used. - Update doc files re nftables. - Make nftables handle dont_track_primary appropriately. - Fix config reload with nftables. - Set base chain priorities from configuration. - Use iptables by default if neither iptables or nftables configured. But if the build of keepalived does not include iptables, then use nftables default. - Stop dumping keywords - left turned on after debugging. - Make umask configuration apply to created file. - Add libmnl and libnftnl to travis file. - Fix compilation failure when NFTNL_EXPR_LOOKUP_FLAGS not defined. - Fix compilation failure when build with nftables but without iptables. - Fix order of include files in configure COLLISION test. Since Linux 4.4.11 (commit 1575c09) including linux/if.h after net/if.h works, whereas until glibc fix their headers including net/if.h after linux/if.h causes compiler redefinition errors. Unfortunately the test for the collision was done the wrong way round, as identified in issue #1079. The patch included in the issue report corrects the order of inclusion of the header files. What we should do is ensure that glibc header files are included before Linux header files, so that at least if kernel headers from 4.4.11 onwards are used, the conflict will not occur. - Set CLOEXEC on netlink sockets. - Correct error message for invalid route metric. - Add track_process for vrrp to monitor if another process is running. Configurations frequently include a track_script to check that a process is running, often haproxy or nginx. Using any of pgrep, pkill, killall, pidof, etc, has an overhead of reading all /proc/[1-9]*/status and/or /proc/[1-9]*/cmdline files. In particular reading the cmdline files has a significant overhead on a system that is swapping, since the cmdline files provide access to part of the address space of each process, which may need to be fetched from the swap space. This commit reads the /proc/[1-9]*/stat and/or the /proc/[1-9]*/cmdline files only when keepalived starts, and after that uses the process events connector to track process creation and termination. keepalived will ignore zombie processes, whereas pgrep etc include them. A minimum number of instances of a process can be specified, and also a delay so that if a process is restarted, it won't cause monitoring vrrp instances to immediately transition to fault state but to wait the configured time and it the monitored process starts again it won't transition to fault state. There are potential difficulties with the process event connector if a large number of process events occur very rapidly, since there can be a receive buffer overrun on the netlink socket. This code will detect that happening, increase the receive buffer size, and reread the processes from /proc. - Add missing #include to track_process.c. - Fix number of elements of fd_set read for snmp select info. - Remove thread_event_t when EPOLL_CTL_DEL fails. If snmpd closes a file descriptor, when keepalived attempts to unregister the fd from epoll an error is returned. However, we still need to remove the thread_event_t from the io_events rbtree. - Fix connection to snmpd after it has to reconnect. Issue #1080 identified that keepalived wasn't handling a connection failure and reconnect to snmpd properly. The problem was created when the change from select() to epoll() was made. This commit makes keepalived unregister and reregister the snmp file descriptors after snmpd reconnects. - Fix retry count for SMTP_CHECK checker. The checker was doing one too few retries. - Make healthchecker failure reporting consistent Some healthcheckers were reporting all failures, and others only when the retries expired. This commit by default makes the checkers only report failure when the retries expire, unless the global keyword checker_log_all_failures or log_all_failures on the specific checker is configured. - After reload, reinitialise current track processes state. - Remove unused variable in track_process.c. - Add configure checks re --with-kernel-dir. - Convert remaining select() to epoll_wait(). keepalived was using select() for handling the termination of child processes, but the main scheduling loop now uses epoll_wait(), so convert the select() to epoll_wait() from consistency. - Stop keepalived leaving zombie child processes. keepalived wasn't reaping the termination of its child processes, so this commit adds waitpid() calls once it knows the processes have terminated. - Fix make distclean and make distcheck. - Also skip route not configured with down interface. Otherwise, if keepalived has virtual_routes configured, we create a virtual interface and bring it up and down, current code will bring VRRP state to FAULT and never return. - Stop vrrp process entering infinite loop when track script times out Issue #1093 identified that the vrrp process was entering an infinite loop after a track script timed out. This was due to a child process thread having an RB tree for PIDs as well as for the timeout, and if a child process timed out, the thread wasn't being removed from the PID RB tree. This commit now ensures it is removed. - Fix the abbreviation of Shortest Expected Delay. - Don't free unallocated memory if not tracking processes. - vrrp: Rewrote JSON code Remove dependency to json-c extralib by using a simple streaming JSON writter. Refactored code to make it simple to maintain. - vrrp: Fix JSON handling for v{route;rule}. - autoconf: fix nftables selection We need to inhibit nftable compilation if compiling system has kernel header file nf_tables.h but not libnftnl nor libmnl. - fix build on 42.3/sle12 by disabling http regexp check support - add nftables to the BR - cleanup BR support for sle11, moved almost all BR to pkgconfig style - disable dbus instance creation support as it is marked as dangerous - update to 2.0.13 - Add BFD build option to keepalived.spec rpm file Issue #1114 identified that the keepalived.spec file was not being generated to build BFD support even if keepalived had been configured to support it. - Copy tarball to rpmbuild/SOURCES when building in place It seems that even when building in place, rpmbuild expects the tarball to be in the rpmbuild/SOURCES directory. - Fix configure check for __always_inline - Handle interface MAC addresses changing When an interface is added to a bond interface, if it is the first interface added, the MAC address of the bond interface is changed to the MAC address of the added interface. When subsequent interfaces are added, their MAC addresses are changed to that of the bond interface. Issue #1112 identified that if a bond interface is deleted and recreated, the gratuitous ARPs were sent with the wrong source MAC address. This commit now updates interface MAC addresses from the netlink RTM_NEWLINK messages, so that the correct MAC address is always used. - Minor tidying up of opening gratuitous ARP socket. - Streamline setting SOCK_NONBLOCK on vrrp sockets. - Use netlink reported hardware address length for unsolicited NAs ETH_ALEN is correct for Ethernet type interaces, but is not right for Infiniband interfaces. - Minor tidying up of opening gratuitous NA socket. - Make gratuitous ARP/NA sockets non blocking keepalived shouldn't block when sending gratutious ARP/NA messages. It is better to lose the messages than for keepalived to block, so set the sockets non blocking. - Use netlink provided broadcast address for gratuitous ARP If an interface has a non-standard broadcast address, we should honour it. - Fix building on pre 3.10 kernels re track_process Issue #1119 reported that keepalived wouldn't build on CentOS 6. Various PROC_EVENT_- declarations were assumed to exist, some of which were not introduced until Linux v3.10. Most of them are not needed, but PROC_EVENT_COMM is used by the track_process code. This commit now checks for the existence of the PROC_EVENT_- declarations, but since keepalived uses PROC_EVENT_COMM, track_process is not supported prior to Linux v3.2. - Make track_process work prior to Linux 3.2, but with limitations Prior to Linux 3.2 the PROC_EVENT_COMM event did not exist, which means that keepalived is unable to detect changes to process name (/proc/PID/comm) prior to Linux 3.2. most processes do not change their process name, and so using track_process prior to Linux 3.2 is safe so long as the monitored processes are known not to change their process name. - Stop configure failing when nftables is not supported. - Streamline socket use with linkbeat. Previously the socket used for ioctls was opened and closed twice per poll if using MII or ETHTOOL polling, and once per poll if using ioctl polling. This commit opens the socket once at startup, uses that socket for all linkbeat polls, and closes it on termination. - Enable linkbeat polling to work with dynamic interfaces. - Add linkbeat_interfaces configuration block It was not possible to indicate that an interface that wasn't used as the interface of a vrrp instance, but was used either as a track interface, or for virtual/static ip addresses or routes should use linkbeat. This commit adds that capability. - Add ability to specify linkbeat type in linkbeat_interfaces block. - Add --disable-linkbeat configure option Does anyone use linkbeat anymore? This commit enables keepalived to be build without the linkbeat code. - Don't remove link local IPv6 address from VMAC that isn't keepalived's If IFLA_INET6_ADDR_GEN_MODE isn't supported and a macvlan interface already had a (non-default) link local addresss and the link local address that matched the interface's MAC address was added, keepalived was removing it as soon as it was added. This commit stop keepalived removing the address when we shouldn't. - Set configure init type correctly in keepalived.spec file. - Fix handling of VMACs with multiple reloads If a configuration is loaded that has a VRRP instance using a VMAC, then the configuration is updated to remove that VRRP instance and keepalived reloads its configuration, then the configuration is updated again to reinstate the VRRP instance and the configuration is again reloaded, keepalived thought the VMAC interface still existed, whereas it was deleted following the first reload. This commit ensures that keepalived properly detects whether an interface exists following a reload. - Remember more than one interface local address per interface Keepalived needs a local address for each interface it sends adverts on. If the address keepalived is using is deleted and another address is configured on the interface, then keepalived should start using that address. To do this, a list of configured address on each interfaces needs to be maintained. - Don't consider VIPs as local addresses when restart after crash Keepalived maintains a list of addresses per interface that can be used as source adddresses for adverts. To build the list, keepalived reads the addresses configured on interfaces when it starts. However, if keepalived crashed it will have left VIPs configured on interfaces, and we don't want to use them as advert source addresses. This commit makes keepalived compare the addresses on interfaces to VIPs, and ignores any addresses that are VIPs. - Fix removing left over VIPs at startup. - Use read_timer() when parsing config where appropriate. - Allow fractional warmup, delay_loop and delay_before_retry for checkers To shorten the real server monitoring interval, make it possible to specify decimal value for following items: warmup delay_loop delay_before_retry - Update connect_timeout configuration options Based on the patch submitted by tamu.0.0.tamu@gmail.com this patch allows setting the connect_timeout to a resolution of micro-seconds. The patch also adds the ability to set a default value at the virtual server and real server levels. - Fix unused variable warning when building only with RFC compliant SNMP. - It enable to set zero value as mintime for delay_loop and connect_timeout. - Add option not to check for EINTR if using signalfd() If keepalived is using signalfd(), there are no asynchronous signal handlers, and therefore EINTR cannot be returned. Currently the check for EINTR is enabled by default, and configure option --disable-eintr-debug disables the check, while - -enable-eintr-debug enables writing log entries if EINTR is returned. Once sufficient testing has been performed, the default will be changed not to test for EINTR if signalfd() is supported. - Make checking for EAGAIN/EWOULDBLOCK consistent The code in some places checked errno for EAGAIN and EWOULDBLOCK and in other places only checked EAGAIN. On Linux EAGAIN == EWOULDBLOCK, so the check is not necessary, but EAGAIN is not guaranteed to be the same value as EWOULDBLOCK, so define check_EAGAIN that only checks EAGAIN if they are the same value, but checks both if they are different. - Ensure default connection timeout for smtp checker hosts set. - Set default connection timeout if no smtp check host specified. - Fix min timer value, zero to 0.000001Sec. - Add fixing min time for vs_co_timeout_handler() and rs_co_timeout_handler(). - Fix parameter of read_timer(), it treat Mintime and Maxtime as microseconds. - vrrp: vrrp_dispatcher_read() performance extension We took time with Quentin to simulate and rework this code. We introduced 2 imbricated while loop: (1) First one is catching recvfrom EINTR (this code trig only on kernel older than 2.6.22 where signalfd was firstly introduced). Newer kernel will immediately break the loop (hey guys: if you are running older than 2.6.22 it is worth considering upgrading). (2) Second loop will continue reading from socket until same VRID advert has been received during the same cycle. After simulating, it appears that during contention with a lot of VRRP instances (around 1500), this design is needed to relax socket recvq from growing. This can be viewed as a Poll-Mode activation during contention and fallback to regular I/O MUX during normal operations. This loop breaks immediately and re-submit opration to I/O MUX when there is no more to be read. - Fix conversion from long for double in read_timer(). - Remove variable timer of unsigned long cast in read_timer(). When Double type variable timer is cast to long type, it's scale falls. - changes from2.0.12 - Documentation related. Remove keepalived.conf.SYNOPSIS content to make a pointer to manpage. Update README manifest to reflect actual Keepalived goal and features. - Improve error message if process events connector not enabled in kernel. - Add option to disable track-process functionality Issue #1099 reported that their kernel did not support the proc events connector, and it would therefore be helpful to have an option to build keepalived without the track-process functionality. This commit adds the --disable-track-process configure option. - Fix vrrp instances going to fault state when have virtual routes If an interface going down caused a vrrp instance to go to fault state, and the vrrp instance also had virtual routes, the state of the vrrp instance would be set to backup when the deletion of the virtual route was detected. This commit ensures that the vrrp instance stays in fault state until the interface is brought up again. - Remove Red Hat Linux 9 and RH Enterprise Linux 3 from spec file. Red Hat Linux 9 and Red Hat Enterprise Linux 3 are both based on Linux 2.4, which is no longer supported by keepalived. The options in the spec file for Reh Hat Linux 9 have twice caused people to specify wrong options to configure when trying to build keepalived, so the options are removed to i) avoid confusion and ii) they are not longer relevant. - Add global option vrrp_min_garp. By default keepalived sends 5 gratuitous ARP/NA messages after transitioning to master, and 5 more 5 seconds later. This isn't necessary with modern switches, and so if the vrrp_min_garp option is set, only one gratuitious ARP/NA message is sent after transition to master, and no repeat messages are sent 4 seconds later. - Standardise definition of _INCLUDE_UNUSED_CODE_ - Remove out of date comment re VRRP over IPv6. - Correct typo in keepalived.conf.5. - Directly use structure sizes for packet header lengths. - vrrp_state_fault_rx() is not used. Wrap the function in conditional compilation so it is not compiled - Convert so list loops to use LIST_FOREACH. - Don't recalculate vrrp packet header address. vrrp_get_header() calculates the address of the vrrp header in a received packet, but it was being recalculated in vrrp_in_chk(). This commit passes the already calculated address to vrrp_in_chk(). - Ensure a received packet has an AH header if and only if AH auth. Ensure that a received packet has an AH header if we expect AH authentication, and doesn't have an AH header if we don't expect AH authentication. - Ensure all protocol headers received before return pointer to vrrp header vrrp_get_header() returns a pointer to the vrrp header, but it now returns NULL if insufficient data has been received to include all the (IP, possibly AH, and VRRP) headers (this does not include the VIPs in the VRRP packet). This means that when a pointer to the VRRP header is returned, all fields in all protocol headers can safely be accessed. - Add check of received IPv6 hop count in multicast adverts The VRRP RFC requires that IPv6 hop count MUST be checked to be 255, just as the TTL for IPv6 must be 255. Previously that wasn't being checked, since IPv6 raw sockets don't provide access to the IPv6 header. Using recvmsg() rather than recvfrom(), and setting socket option IPV6_RECVHOPLIMIT allows keepalived to receive the hop count as ancillary data, and that can now be checked. - Improve reading from vrrp receive sockets. Previously no check was made of the return value from recvfrom()/ recvmsg(). This meant than an error could occur (e.g. EINTR), or no data might be returned, and keepalived would still attempt to process the receive buffer as though data had been received. - Enhance and streamline checking of validity of received VRRP packet This includes checking that a packet is multicast, unless unicast is expected in which case it is checked for unicast, ensuring that if AH authentication is used, the next header protocol is VRRP. The sequence of some checks is revised to ensure that the fields being checked are valid to be accessed prior to accessing them, e.g. check that the packet is VRRP version 2 before checking the authentication. - Stop clearing receive buffer before receiving VRRP packets. This is no longer necessary now that the appropriate checks are made of the return status of recvmsg(), and also that the checks of received packet length and packet headers now do all necessary checks. - Add compile time checks for IPV6_RECVHOPLIMIT/IPV6_RECVPKTINFO support. - Update keepalived.spec.in build-requires. The kernel package required for building keepalived is kernel-headers not kernel-devel. Also, it is superfluous to have package kernel in the build-requires! - Add missing file (build.setup) to tarball. - Fix calculating print format to rlim_t in configure.ac. - Fix compiler warnings on 32 bit systems re HASH_UPDATE. Removing all the casts stopped the warnings. - Use PRI_rlim_t when printing rlim_t types. - Use %zd/%zu for ssize_t/size_t to avoid warnings on 32 bit systems. - Fix some space/tab formatting. - Stop declaring some timer definitions unsigned to stop compiler warnings. TIMER_HZ, TIMER_CENTI_HZ, NSEC_PER_SEC were causing some compiler warnings on some systems due to being defined with a 'U' unsigned suffix. Removing the unsigned specifier stopped the compiler warnings. - Fix compiler warning due to incorrect format specifier. An int64_t should use % PRIi64 and not %ld - Stop an uninitialized variable compiler warning. - Fix MEM_CHECK debugging on processors without unaligned memory access. - Don't attempt to use unopened socket for getting ipset version. - Tidy up an error message. - vrrp: make vrrp_dispatcher_read() async while catching error. During investigations we decided to update previous patch to resubmit into I/O MUX on read error. It will make read procedure I/O MUX freindly by removing potential sync operation potentially leading to a global I/O MUX desync. We aggreed, the situation is really and very exceptionnal but could happen. - vrrp: vrrp_arp_thread split. Split the function for maintainability purpose. - update to 2.0.14 - Add compiler warning -Wfloat-conversion and fix new warnings. It was discovered that passing 0.000001 as a parameter specified as uint32_t to a function did not generate any warning of type mismatch, or loss of precision. This commit adds -Wfloat-conversion and fixes 3 instances of new warnings that were generated. - For non systemd enviroment, it occurs syntax error 'fi'. To avoid syntax error, modify keepalived.spec.in. - When uninstall keepalived with init upstart, stop keepalived process. - Fix type re LOG_INGO should be LOG_INFO - 6git stash --cached. The code was actualy in a #ifdef INCLUDE_UNUSED_CODE block, and so isn't currently compiled. - Register missing thread function for thread debugging. - Fix reutrn value of notify_script_compare misusing issue. - Fix typo in keepalived.conf man page re BFD min_rx. - Fix segfault when bfd process reloads config. Issue #1145 reported the bdf process was segfaulting when reloading. The bfd process was freeing and allocating a new thread_master_t when reloading, which doesn't work. This commit changes the bfd process to clean and reinitialise the thread_master_t. - Fix segfault in handle_proc_ev(). On Linux 3.10 the ack bit can be set in a connector message, and the CPU number is set to UINT32_MAX. This commit skips acks, and also checks that CPU number is within range of the number of CPUs on the system. - Fix OpenSSL init failure with OpenSSL v1.1.1. OpenSSL v1.1.1, but not v1.1.0h or v1.1.1b failed in SSL_CTX_new() if OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG) had previously been called. This commit doesn't call OPENSSL_init_crypto() if doing so causes SSL_CTX_new() to fail. - Remove all references to libnfnetlink. Commit 2899da6 (Stop using linbl for mcast group membership and setting rx buf sizes) stopped using libnfnetlink, but INSTALL and keepalived.spec.in were not updated accordingly. - Fix genhash re OPENSSL_init_crypto bug and improve configure.ac. Commit fe6d6ac (Fix OpenSSL init failure with OpenSSL v1.1.1) didn't update the identical code in genhash/ssl.c. Also, an improvement for the test in configure.ac was suggested. - Fix log output when real server removed. FMT_VS() and FMT_RS() both call inet_sockaddrtotrio which uses a static buffer to return the formatted string, but since FMT_VS(), wheich simply calls format_vs() copies the returned string to its own static buffer, if FMT_VS() was called before FMT_RS() then the returned strings from both could be used. The problem occurs when both FMT_VS() and FMT_RS() are used as parameters to log_message() (or printf etc). It appeared to work fine on x86_64, but was writing the same IP address for both the real server and virtual server on ARM architectures. This is due to the compiler evaluating parameters to the log_message() function call in a different order on the different architectures. This commit adds inet_sockaddrtotrio_r() which allows the output to be in a buffer specified by the caller, and so FMT_VS() and FMT_RS() can now be called in either order without one overwriting a buffer used by the other. - Streamline some string formatting with FMT_RS() and FMR_VS(). Following commit 9fe353d (Fix log output when real server removed) some code can be streamlined now that the order of calling FMT_VS() and FMT_RS() does not matter. - Replace FMT_HTTP_RS(), FMT_TCP_RS() and FMT_DNS_RS() with FMT_CHK(). They were all simply defined to be FMT_CHK() so just replace them with that. This made it much simpler to find all used of FMT_CHK(). - Fix building with gcc 4.4.7 (Centos 6.5). gcc v4.4.7 doesn't support -Wfloat-conversion, so check for it at configure time. - Add dumping checker config/status when receive SIGUSR1. - Don't put alpha mode checkers into failed state at reload If a new checker is added at a reload, unless the real server aleady has failed checkers, then ignore the alpha mode of the checker. This means that the real server, if up, won't be taken down and then brought back up again almost straight away. If the real server already has failed checkers, then setting an alpha mode checker down initially won't take down the real server, so we can allow the alpha mode setting to apply. - Handle alpha mode checkers initial failure at startup better. - Fix compile failure discovered by Travis-CI. - Fix calling syslog when not using signalfd(). Pull request [#1149] identified that syslog is AS-Unsafe (see signal-safety man page), and that therefore signals should be blocked when calling it. This commit blocks signals when calling syslog()/vsyslog() when signalfd() is not being used. - Rationalise function attributes. - Fix enable-optimise configure option. - Use AS_HELP_STRING for all options in configure.ac. - Streamline genhash -h option. - Make genhash -v version match keepalived. - Fix config check of virtual server quorum against weights of real servers. - Fix some configure tested checks for OPENSSL_init_crypto. - Add infrastructure for adding additional compiler warnings. - Add standard and extra compiler warnings. - Add and resolve missing-declarations and missing-prototypes warnings Approximately 16 additional functions are now declared static. - Add and resolve old-style-definitions warnings - Add and resolve redundant-decls warnings - Add and resolve jump-misses-init warnings - Add and resolve shadow warnings - Add and resolve unsuffixed-float-constants warnings - Add and resolve suggest-attribute=const warnings - Add and resolve suggest-attribute=format warnings - Add and resolve suggest-attribute=malloc warnings - Add and resolve suggest-attribute=noreturn warnings - Add and resolve suggest-attribute=pure warnings - Add and resolve unused-macros warnings - Add and resolve null-dereference warnings - Add and resolve float-equal warnings - Add and resolve stack-protector warnings - Add and resolve strict-overflow=4 warnings - Add and resolve pointer-arith warnings This particularly includes adding a number of bytes to a void -. - Add and resolve cast-qual warnings - Resolve additional warnings identified on Centos 6.5/gcc 4.4.7 - Remove static from zalloc() - Fix some compiler warnings on Ubuntu Xenial, and add comments re others. - Rename LIST parameters to lst in list_head.h to avoid upper case. - Fix real server checkers moving from failed to OK on reload. - add rs judgement in migrate_checkers. - Detect connection failure in genhash and exit rather than loop. - Add another function pure attribute. - Fix sending notifies for vrrp instances at startup when in sync group Issue #1155 idenfified that notify scripts for vrrp instance transition to backup state when keepalived started up were not being sent if the vrrp instance was in a sync group. It was also the case that SNMP traps, SMTP alerts and FIFO notifies were not being sent either. This commit make keepalived send the initial notifies when the vrrp instance is in a sync group. - Fix building keepalived RPM on Fedora 26. For some reason - fPIC is needed when testing for the presence of setns(). - Add vrrp_startup_delay configuration option. Some systems that start keepalived at boot time need to delay the startup of the vrrp instances, due to network interfaces taking time to properly come up. This commit adds a global configuration option vrrp_startup_delay that delays the vrrp instances starting up, for the specified number of seconds. - Handle checkers properly when reload immediately after startup. - Streamline some of the SMTP checker code. - Create separate checker for each host in SMTP_CHECK block Having multiple host entries in an SMTP_CHECK block is deprecated. This commit streamlines the SMTP_CHECK code by creating a separate SMTP checker for each host declared in the SMTP_CHECK block, so that apart from parsing the configuration, the code no longer handles multiple hosts per checker. The support for parsing configuration with multiple hosts is only enabled if WITH_HOST_ENTRIES is defined in check_smtp.c. It is currently enabled, but when support for multiple hosts in the SMTP_CHECK block is finally removed, it will simply be a matter of deleting all code in the WITH_HOST_ENTRIES conditional blocks. - Make checker fail if ENETUNREACH returned by connect(). The connect() call can return some immediate errors such as ENETUNREACH. These were not being treated as a failure of the checker, since the code used to assume that any non success return by connect() meant that the connection was in progress. keepalived will now treat ENETUNREACH, EHOSTUNREACH, ECONNREFUSED, EHOSTDOWN, ENETDOWN, ECONNRESET, ECONNABORTED, ETIMEDOUT, when returned by connect(), as meaning that the checker has failed. - Don't set SO_LINGER with a timeout of 0 SO_LINGER with a timeout of 0 causes a TCP connection to be reset rather than cleanly closed. Instead of specifying a timeout of 0, use 5 seconds, so that there is an orderly shutdown of the TCP connection, but the close socket doesn't remain in TIMED_WAIT state for more than a short time. - nftables: fix build with kernel lower than 4.1. - Remove dead code and cosmectics. Remove code marked as UNUSED where things simply go nowhere even if define is set. We keep for the moment UNUSED code related to debug helpers used during coding process. - add buildrequires for file-devel - used in the checker to verify scripts - update to 2.0.15 - Fix uninitialised variable. - Fix rpmbuild on CentOS7, and rely on auto-requires. - Add option to flush lvs on shutdown. Currently all known virtual servers and their real servers are removed one at a time at shutdown. With large configurations on a busy system, this can take some time. Add an option just like the existing 'lvs_flush' which operates on shutdown. Typical environments with a single keepalived instance can take advantage of this option to achieve a faster shutdown or restart cycle. - Make alpha mode checkers on new real servers start down on reload. Patch #1180 identified that new real servers with alpha mode checkers were being added online immediately, and if the checker then failed were being removed. This commit makes real servers that didn't exist before the reload start in down state if they have alpha mode checkers. - Remove duplicate config dump entry. - Make new real servers at reload start down if have alpha mode checkers. - Close checker and smtp_alert sockets on reload. Issue #1177 identified that sockets were being left open (lost) after a reload. It transpired that these were sockets opened by TCP_CHECK, HTTP_GET, SSL_GET, DNS_CHECK and SMTP_CHECK checkers, and by smtp_alerts in the process of being sent. This commit adds an extra parameter to thread_add_read() and thread_add_write() to allow indicating that the scheduler should close the socket when destroying threads. - Send vrrp group backup notifies at startup. - Make inhibit_on_failure be inherited by real server from virtual server. - Allow real and sorry servers to be configured with port 0 This is to maintain backwards compatibility with keepalived prior to commit d87f07c - "Ensure always check return from inet_stosockaddr when parsing config". The proper way to configure this is to omit the port, which requires the next commit. - Don't setup IPVS config with real and virtual servers ports different. If the real server is using DR or TUN, the port of the real server must be the same as the port of the virtual server. This commit uses the virtual server port for the real server when configuring IPVS. - Log warnings if real server and virtual server ports don't match This commit adds logging warnings if virtual and real server ports, when using TUN or DR, don't match. It also sets the real server ports to be the same as the virtual server ports. Although listing the IPVS configuration with ipvsadm will look different, the kernel ignored the port of a real server when using DR or TUN, so the behaviour isn't changed, but when looking at the configuration it now shows what is actually happening. - Fix warning when protocol specified for virtual server with fwmark. - Add log message that nb_get_retry is deprecated. - Fix whitespace in configure.ac. - Fix configure error when systemd not installed configure was trying to execute pkg-config --variable=systemdsystemunitdir systemd even if systemd was not available. This commit makes configure only execute the above if it has determined that systemd is the correct init package to use. - Correct references to RFC6527 (VRRPv3 SNMP RFC). - nsure checker->has_run is always set once a checker has run. - Fix some indentation in configure.ac. - Update fopen_safe() to open temporary file in destination directory rename() in fopen_safe() was failing if the file being created was not on the same filesystem as /tmp. - Add ${_RANDOM} configuration keyword. It might seem strange to introduce random elements to configuration files, but it can be useful for testing. - Fix using ~SEQ() in multiline configuration definitions. - Make blank lines terminate a multiline definition. - Minor updates for lvs_flush_on_stop. - Add option to skip deleting real servers on shutdown or reload If a virtual server is removed, the kernel will remove its real servers, so keepalived doesn't explicitly need to do so. The lvs_flush_onstop option removes all LVS configuration, whereas this new option will only remove the virtual servers managed by keepalived. - Correct error message re checker_log_all_failures. - Fix syntax error in configure.ac. - Fix track_process initialisation for processes with PIDs starting 9. - Remove debugging log message. - Remove inappropriate function const attributes They were causing iptables/ipsets not to be initialised. - Stop warning: function might be candidate for attribute "const" Depending on what configure options are selected, gcc can output the above warning for initialise_debug_options(). This commit ensures that the warning is not produced. - Enable strict-config-checks option in keepalived.spec RPM file. - vrrp: relax attribute 'const' warning at iptables helpers. - Propagate libm to KA_LIBS. - Fix building on Alpine Linux. Alpine (musl) doesn't have a definition of __GNU_PREREQ, so create a dummy definition. - added systemd-after-snmp.patch: If you want to use the snmp support the masterx socket needs be available otherwise the snmp support is broken strictly speaking we would need to use BindsTo= here but that would require that add a Requires for net-snmp to the keepalived package. to be discussed. - Update to 2.0.17 (2019-06-25) * https://www.keepalived.org/changelog.html - remove obsolete patch * systemd-after-snmp.patch - rebase patch * linux-4.15.patch - update to 2.0.19 Fix minor IPVS features support. Extend BFD to support more than one BFD instance with a neighnour. Extend nftable support. Script timeout extension. Properly filter IGMP/MLD packets on VMAC interface. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - changes from 2.0.18 Add support to IPVS new GUE tunnel type. New feature 'weight reverse' available in all trackers. Resolve all outstanding coverity issues. Some fixes and performance extensions. Refer to ChangeLog for more infos. https://keepalived.org/changelog.html - new BR pkgconfig(libnftnl) to fix nftables support - Inclusion into SLE as ACC supported packages (bsc#1158280, ECO#223) - Update to 2.2.1 https://www.keepalived.org/release-notes/Release-2.2.1.html https://www.keepalived.org/release-notes/Release-2.2.0.html https://www.keepalived.org/release-notes/Release-2.1.5.html https://www.keepalived.org/release-notes/Release-2.1.4.html https://www.keepalived.org/release-notes/Release-2.1.3.html https://www.keepalived.org/release-notes/Release-2.1.2.html https://www.keepalived.org/release-notes/Release-2.1.1.html https://www.keepalived.org/release-notes/Release-2.1.0.html - enable systemd integration via libsystemd (new BR: libsystemd) - switch to systemd_ordering instead of systemd_requires - sync configure options with the configure script - Make sure we pull in the libraries we need for dlopen, by following the symlinks from the .so symlinks with the requires_file macro. - Update to 2.2.2 https://www.keepalived.org/release-notes/Release-2.2.2.html - change how we install documentation to avoid duplicated files - Link all the files for ipset, iptables, libnl instead of dlopen. Drop the previous workaround for generating requires for the dlopen-ed libaries. - remove unsupported configure option: --enable-libiptc - drop linux-4.15.patch: No longer needed as it was a backport from upstream - Cleanup configure options after consultation with upstream: - --enable-regex-timers is for debugging purposes - --enable-snmp-checker and --enable-snmp-vrrp are enabled by - -enable-snmp - --enable-snmp-rfcv2 and --enable-snmp-rfcv3 anre enabled by - -enable-snmp-rfc - --enable-stacktrace is definitely a debugging option - on systems where we have nftables support we will only ship with nftables support (>= 15.0) and use iptables support only on older distributions. - add 1915.patch to fix build on tumbleweed - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_keepalived.service.patch - VUL-0: CVE-2021-44225: keepalived: possible privilege escalation due to insufficient control in the D-Bus policy (bsc#1193115) apply upstream patch: * 0001-dbus-fix-policy-to-not-be-overly-broad.patch - FATAL: Module ip_vs not found in directory /lib/modules/5.14.21-150400.24.18-default (bsc#1202808) Set ProtectKernelModules to false in service file - VUL-0: CVE-2024-41184: keepalived: integer overflow in vrrp_ipsets_handler (bsc#1228123) Apply upstream patches: bsc-1228123.patch - RDMA/siw: Correct wrong debug message (git-fixes) - commit 3732fc1 - RDMA/efa: Fix wrong resources deallocation order (git-fixes) - commit c7f667b - scsi: RDMA/srp: Fix residual handling (git-fixes) - commit 429e77b - Refresh patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch. - Refresh patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch. - commit 452e63f - USB: core: Unite old scheme and new scheme descriptor reads (bsc#1213123 CVE-2023-37453). - commit 9f60ef1 - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (bsc#1213123 CVE-2023-37453). - commit a1f446d - blacklist.conf: Not a fix, relatively high risk of performance regression - commit fd04425 - USB: core: Fix oversight in SuperSpeed initialization (bsc#1213123 CVE-2023-37453). - commit 6b6c148 - sched/fair: Use recent_used_cpu to test p->cpus_ptr (git fixes). - sched/fair: Fix inaccurate tally of ttwu_move_affine (git fixes). - commit 4be7d48 - cpufreq: Fix the race condition while updating the transition_task of policy (git-fixes). - rpmsg: glink: Add check for kstrdup (git-fixes). - leds: turris-omnia: Drop unnecessary mutex locking (git-fixes). - leds: trigger: tty: Do not use LED_ON/OFF constants, use led_blink_set_oneshot instead (git-fixes). - leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false (git-fixes). - leds: multicolor: Use rounded division when calculating color components (git-fixes). - leds: pwm: Fix error code in led_pwm_create_fwnode() (git-fixes). - docs: printk-formats: Fix hex printing of signed values (git-fixes). - commit 1c98d58 - s390/ipl: add missing secure/has_secure file to ipl type 'unknown' (bsc#1214976). - commit 33974e8 - "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457) This patch also fixes two CVEs. Update the References tag accordingly. - commit 552e790 - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). - commit 47ff352 - netfilter: nf_tables: use correct lock to protect gc_list (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with abort path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with netns dismantle (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix kdoc warnings after gc rework (CVE-2023-4563 bsc#1214727). - refresh - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch - kabi: hide changes in struct nft_set (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction API to avoid race with control plane (CVE-2023-4563 bsc#1214727). - commit cfed41c - Refresh sorted section - commit a6fbcee - powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051). - commit ac82be8 - Update References patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch (git-fixes bsc#1214233 CVE-2023-40283). - commit 63a801c - USB: core: Change usb_get_device_descriptor() API (bsc#1213123 CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552). Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk) Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context) - commit be6100d - Drop amdgpu patch causing spamming (bsc#1215523) Deleted: patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch. - commit 2351f50 - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). - commit c11336f - RDMA/siw: Correct wrong debug message (git-fixes) - commit 3732fc1 - RDMA/efa: Fix wrong resources deallocation order (git-fixes) - commit c7f667b - scsi: RDMA/srp: Fix residual handling (git-fixes) - commit 429e77b - Refresh patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch. - Refresh patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch. - commit 452e63f - USB: core: Unite old scheme and new scheme descriptor reads (bsc#1213123 CVE-2023-37453). - commit 9f60ef1 - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (bsc#1213123 CVE-2023-37453). - commit a1f446d - blacklist.conf: Not a fix, relatively high risk of performance regression - commit fd04425 - USB: core: Fix oversight in SuperSpeed initialization (bsc#1213123 CVE-2023-37453). - commit 6b6c148 - sched/fair: Use recent_used_cpu to test p->cpus_ptr (git fixes). - sched/fair: Fix inaccurate tally of ttwu_move_affine (git fixes). - commit 4be7d48 - cpufreq: Fix the race condition while updating the transition_task of policy (git-fixes). - rpmsg: glink: Add check for kstrdup (git-fixes). - leds: turris-omnia: Drop unnecessary mutex locking (git-fixes). - leds: trigger: tty: Do not use LED_ON/OFF constants, use led_blink_set_oneshot instead (git-fixes). - leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false (git-fixes). - leds: multicolor: Use rounded division when calculating color components (git-fixes). - leds: pwm: Fix error code in led_pwm_create_fwnode() (git-fixes). - docs: printk-formats: Fix hex printing of signed values (git-fixes). - commit 1c98d58 - s390/ipl: add missing secure/has_secure file to ipl type 'unknown' (bsc#1214976). - commit 33974e8 - "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457) This patch also fixes two CVEs. Update the References tag accordingly. - commit 552e790 - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). - commit 47ff352 - netfilter: nf_tables: use correct lock to protect gc_list (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with abort path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with netns dismantle (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix kdoc warnings after gc rework (CVE-2023-4563 bsc#1214727). - refresh - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch - kabi: hide changes in struct nft_set (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction API to avoid race with control plane (CVE-2023-4563 bsc#1214727). - commit cfed41c - Refresh sorted section - commit a6fbcee - powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051). - commit ac82be8 - Update References patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch (git-fixes bsc#1214233 CVE-2023-40283). - commit 63a801c - USB: core: Change usb_get_device_descriptor() API (bsc#1213123 CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552). Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk) Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context) - commit be6100d - Drop amdgpu patch causing spamming (bsc#1215523) Deleted: patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch. - commit 2351f50 - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). - commit c11336f - RDMA/siw: Correct wrong debug message (git-fixes) - commit 3732fc1 - RDMA/efa: Fix wrong resources deallocation order (git-fixes) - commit c7f667b - scsi: RDMA/srp: Fix residual handling (git-fixes) - commit 429e77b - Refresh patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch. - Refresh patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch. - commit 452e63f - USB: core: Unite old scheme and new scheme descriptor reads (bsc#1213123 CVE-2023-37453). - commit 9f60ef1 - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (bsc#1213123 CVE-2023-37453). - commit a1f446d - blacklist.conf: Not a fix, relatively high risk of performance regression - commit fd04425 - USB: core: Fix oversight in SuperSpeed initialization (bsc#1213123 CVE-2023-37453). - commit 6b6c148 - sched/fair: Use recent_used_cpu to test p->cpus_ptr (git fixes). - sched/fair: Fix inaccurate tally of ttwu_move_affine (git fixes). - commit 4be7d48 - cpufreq: Fix the race condition while updating the transition_task of policy (git-fixes). - rpmsg: glink: Add check for kstrdup (git-fixes). - leds: turris-omnia: Drop unnecessary mutex locking (git-fixes). - leds: trigger: tty: Do not use LED_ON/OFF constants, use led_blink_set_oneshot instead (git-fixes). - leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false (git-fixes). - leds: multicolor: Use rounded division when calculating color components (git-fixes). - leds: pwm: Fix error code in led_pwm_create_fwnode() (git-fixes). - docs: printk-formats: Fix hex printing of signed values (git-fixes). - commit 1c98d58 - s390/ipl: add missing secure/has_secure file to ipl type 'unknown' (bsc#1214976). - commit 33974e8 - "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457) This patch also fixes two CVEs. Update the References tag accordingly. - commit 552e790 - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). - commit 47ff352 - netfilter: nf_tables: use correct lock to protect gc_list (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with abort path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with netns dismantle (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix kdoc warnings after gc rework (CVE-2023-4563 bsc#1214727). - refresh - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch - kabi: hide changes in struct nft_set (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction API to avoid race with control plane (CVE-2023-4563 bsc#1214727). - commit cfed41c - Refresh sorted section - commit a6fbcee - powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051). - commit ac82be8 - Update References patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch (git-fixes bsc#1214233 CVE-2023-40283). - commit 63a801c - USB: core: Change usb_get_device_descriptor() API (bsc#1213123 CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552). Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk) Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context) - commit be6100d - Drop amdgpu patch causing spamming (bsc#1215523) Deleted: patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch. - commit 2351f50 - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). - commit c11336f - RDMA/siw: Correct wrong debug message (git-fixes) - commit 3732fc1 - RDMA/efa: Fix wrong resources deallocation order (git-fixes) - commit c7f667b - scsi: RDMA/srp: Fix residual handling (git-fixes) - commit 429e77b - Refresh patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch. - Refresh patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch. - commit 452e63f - USB: core: Unite old scheme and new scheme descriptor reads (bsc#1213123 CVE-2023-37453). - commit 9f60ef1 - USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() (bsc#1213123 CVE-2023-37453). - commit a1f446d - blacklist.conf: Not a fix, relatively high risk of performance regression - commit fd04425 - USB: core: Fix oversight in SuperSpeed initialization (bsc#1213123 CVE-2023-37453). - commit 6b6c148 - sched/fair: Use recent_used_cpu to test p->cpus_ptr (git fixes). - sched/fair: Fix inaccurate tally of ttwu_move_affine (git fixes). - commit 4be7d48 - cpufreq: Fix the race condition while updating the transition_task of policy (git-fixes). - rpmsg: glink: Add check for kstrdup (git-fixes). - leds: turris-omnia: Drop unnecessary mutex locking (git-fixes). - leds: trigger: tty: Do not use LED_ON/OFF constants, use led_blink_set_oneshot instead (git-fixes). - leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false (git-fixes). - leds: multicolor: Use rounded division when calculating color components (git-fixes). - leds: pwm: Fix error code in led_pwm_create_fwnode() (git-fixes). - docs: printk-formats: Fix hex printing of signed values (git-fixes). - commit 1c98d58 - s390/ipl: add missing secure/has_secure file to ipl type 'unknown' (bsc#1214976). - commit 33974e8 - "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457) This patch also fixes two CVEs. Update the References tag accordingly. - commit 552e790 - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). - commit 47ff352 - netfilter: nf_tables: use correct lock to protect gc_list (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with abort path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction race with netns dismantle (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: fix kdoc warnings after gc rework (CVE-2023-4563 bsc#1214727). - refresh - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch - kabi: hide changes in struct nft_set (CVE-2023-4563 bsc#1214727). - netfilter: nf_tables: GC transaction API to avoid race with control plane (CVE-2023-4563 bsc#1214727). - commit cfed41c - Refresh sorted section - commit a6fbcee - powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051). - commit ac82be8 - Update References patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch (git-fixes bsc#1214233 CVE-2023-40283). - commit 63a801c - USB: core: Change usb_get_device_descriptor() API (bsc#1213123 CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552). Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk) Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context) - commit be6100d - Drop amdgpu patch causing spamming (bsc#1215523) Deleted: patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch. - commit 2351f50 - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). - commit c11336f - printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). - commit e0d3999 - blacklist.conf: printk: the changes look good but they do not fix any serious problem - commit c560ceb - blacklist.conf: workqueue: Code refactoring - commit e204334 - blacklist.conf: workqueue: compiler warning on 32-bit systems with Clang (bsc#1215877) - commit b7e65aa - tcp: Reduce chance of collisions in inet6_hashfn() (CVE-2023-1206 bsc#1212703). - commit e3ebd17 - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150). - commit 7a6be79 - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). - commit 9c5bbd7 - KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). - commit 9ff1a1e - KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). - commit 8726736 - blacklist.conf: kABi breakage (vmalloc) - commit 10bad47 - fs/smb/client: Reset password pointer to NULL (bsc#1215899 CVE-2023-5345). - commit 679511d - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). - commit 6454286 - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). - commit fe7fbfc - btrfs: fix root ref counts in error handling in btrfs_get_root_ref (bsc#1214351 CVE-2023-4389). - commit 3731029 - KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). - commit f1893aa - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754 bsc#1215467). - commit ad87dd3 - netfilter: xt_u32: validate user space input (CVE-2023-39192 bsc#1215858). - commit 292c059 - netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193 bsc#1215860). - commit 5ec24b7 - net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194 bsc#1215861). - commit 55308cb - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). - commit a62865f - printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). - commit e0d3999 - blacklist.conf: printk: the changes look good but they do not fix any serious problem - commit c560ceb - blacklist.conf: workqueue: Code refactoring - commit e204334 - blacklist.conf: workqueue: compiler warning on 32-bit systems with Clang (bsc#1215877) - commit b7e65aa - tcp: Reduce chance of collisions in inet6_hashfn() (CVE-2023-1206 bsc#1212703). - commit e3ebd17 - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150). - commit 7a6be79 - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). - commit 9c5bbd7 - KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). - commit 9ff1a1e - KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). - commit 8726736 - blacklist.conf: kABi breakage (vmalloc) - commit 10bad47 - fs/smb/client: Reset password pointer to NULL (bsc#1215899 CVE-2023-5345). - commit 679511d - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). - commit 6454286 - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). - commit fe7fbfc - btrfs: fix root ref counts in error handling in btrfs_get_root_ref (bsc#1214351 CVE-2023-4389). - commit 3731029 - KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). - commit f1893aa - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754 bsc#1215467). - commit ad87dd3 - netfilter: xt_u32: validate user space input (CVE-2023-39192 bsc#1215858). - commit 292c059 - netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193 bsc#1215860). - commit 5ec24b7 - net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194 bsc#1215861). - commit 55308cb - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). - commit a62865f - printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). - commit e0d3999 - blacklist.conf: printk: the changes look good but they do not fix any serious problem - commit c560ceb - blacklist.conf: workqueue: Code refactoring - commit e204334 - blacklist.conf: workqueue: compiler warning on 32-bit systems with Clang (bsc#1215877) - commit b7e65aa - tcp: Reduce chance of collisions in inet6_hashfn() (CVE-2023-1206 bsc#1212703). - commit e3ebd17 - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150). - commit 7a6be79 - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). - commit 9c5bbd7 - KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). - commit 9ff1a1e - KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). - commit 8726736 - blacklist.conf: kABi breakage (vmalloc) - commit 10bad47 - fs/smb/client: Reset password pointer to NULL (bsc#1215899 CVE-2023-5345). - commit 679511d - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). - commit 6454286 - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). - commit fe7fbfc - btrfs: fix root ref counts in error handling in btrfs_get_root_ref (bsc#1214351 CVE-2023-4389). - commit 3731029 - KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). - commit f1893aa - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754 bsc#1215467). - commit ad87dd3 - netfilter: xt_u32: validate user space input (CVE-2023-39192 bsc#1215858). - commit 292c059 - netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193 bsc#1215860). - commit 5ec24b7 - net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194 bsc#1215861). - commit 55308cb - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). - commit a62865f - printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). - commit e0d3999 - blacklist.conf: printk: the changes look good but they do not fix any serious problem - commit c560ceb - blacklist.conf: workqueue: Code refactoring - commit e204334 - blacklist.conf: workqueue: compiler warning on 32-bit systems with Clang (bsc#1215877) - commit b7e65aa - tcp: Reduce chance of collisions in inet6_hashfn() (CVE-2023-1206 bsc#1212703). - commit e3ebd17 - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150). - commit 7a6be79 - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). - commit 9c5bbd7 - KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). - commit 9ff1a1e - KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). - commit 8726736 - blacklist.conf: kABi breakage (vmalloc) - commit 10bad47 - fs/smb/client: Reset password pointer to NULL (bsc#1215899 CVE-2023-5345). - commit 679511d - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). - commit 6454286 - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). - commit fe7fbfc - btrfs: fix root ref counts in error handling in btrfs_get_root_ref (bsc#1214351 CVE-2023-4389). - commit 3731029 - KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). - commit f1893aa - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754 bsc#1215467). - commit ad87dd3 - netfilter: xt_u32: validate user space input (CVE-2023-39192 bsc#1215858). - commit 292c059 - netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193 bsc#1215860). - commit 5ec24b7 - net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194 bsc#1215861). - commit 55308cb - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). - commit a62865f - s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511). - commit 2bb6835 - KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512). - commit 3976fa9 - Update patches.suse/USB-ene_usb6250-Allocate-enough-memory-for-full-obje.patch (bsc#1216051 CVE-2023-45862). Retroactively recognized as a security issue - commit 716929e - ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085 bsc#1210778). - commit 86e05f1 - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842). - commit 3b513db - blacklist.conf: added two commmits that break kabi - commit fdf2030 - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes). - scsi: pm8001: Setup IRQs on resume (git-fixes). - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (git-fixes). - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes). - scsi: qla4xxx: Add length check when parsing nlattrs (git-fixes). - scsi: be2iscsi: Add length check when parsing nlattrs (git-fixes). - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (git-fixes). - scsi: iscsi: Add length check for nlattr payload (git-fixes). - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (git-fixes). - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (git-fixes). - net: use sk_is_tcp() in more places (git-fixes). - commit 24cbf21 - x86/mm: Print the encryption features correctly when a paravisor is present (bsc#1206453). - commit d1a6274 - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes). - phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes). - phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes). - gpio: vf610: set value before the direction to avoid a glitch (git-fixes). - platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes). - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes). - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (git-fixes). - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). - USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). - mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes). - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). - Bluetooth: avoid memcmp() out of bounds warning (git-fixes). - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes). - Bluetooth: hci_event: Fix coding style (git-fixes). - Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes). - Bluetooth: vhci: Fix race when opening vhci device (git-fixes). - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes). - drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes). - HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes). - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes). - wifi: cfg80211: Fix 6GHz scan configuration (git-fixes). - wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes). - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes). - Bluetooth: Avoid redundant authentication (git-fixes). - Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes). - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-fixes). - gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes). - commit b480af6 - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes). - drm/mediatek: Correctly free sg_table in gem prime vmap (git-fixes). - drm/amd/pm: add unique_id for gc 11.0.3 (git-fixes). - commit ad38bcf - x86/sev: Disable MMIO emulation from user mode (bsc#1212649). - commit 5dae47e - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649). - commit 2b69036 - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649). - commit 816f817 - quota: Fix slow quotaoff (bsc#1216621). - commit 988e5f4 - btrfs: don't start transaction for scrub if the fs is mounted read-only (bsc#1214874). - commit cc8e6f1 - remove unnecessary WARN_ON_ONCE() (bsc#1214823). - NFSD: Never call nfsd_file_gc() in foreground paths (bsc#1215545). - commit d81dfc3 - Update patches.suse/0001-x86-sev-Disable-MMIO-emulation-from-user-mode.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0002-x86-sev-Check-IOBM-for-IOIO-exceptions-from-user-spa.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0003-x86-sev-Check-for-user-space-IOIO-pointing-to-kernel.patch (bsc#1212649 CVE-2023-46813). - commit dd6a315 - netfilter: nf_tables: skip bound chain on rule flush (bsc#1215095 CVE-2023-3777). - commit afb7c25 - iio: exynos-adc: request second interupt only when touchscreen mode is used (git-fixes). - iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale (git-fixes). - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds (git-fixes). - misc: fastrpc: Clean buffers on remote invocation failures (git-fixes). - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers (git-fixes). - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: aspeed: Fix i2c bus hang in slave read (git-fixes). - drm/i915/pmu: Check if pmu is closed before stopping event (git-fixes). - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() (git-fixes). - r8152: Release firmware if we have an error in probe (git-fixes). - r8152: Cancel hw_phy_work if we have an error in probe (git-fixes). - r8152: Run the unload routine if we have errors during probe (git-fixes). - r8152: Increase USB control msg timeout to 5000ms as per spec (git-fixes). - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg (git-fixes). - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() (git-fixes). - treewide: Spelling fix in comment (git-fixes). - commit e69ab42 - fix x86/mm: print the encryption features in hyperv is disabled - commit 37d6855 - s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511). - commit 2bb6835 - KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512). - commit 3976fa9 - Update patches.suse/USB-ene_usb6250-Allocate-enough-memory-for-full-obje.patch (bsc#1216051 CVE-2023-45862). Retroactively recognized as a security issue - commit 716929e - ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085 bsc#1210778). - commit 86e05f1 - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842). - commit 3b513db - blacklist.conf: added two commmits that break kabi - commit fdf2030 - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes). - scsi: pm8001: Setup IRQs on resume (git-fixes). - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (git-fixes). - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes). - scsi: qla4xxx: Add length check when parsing nlattrs (git-fixes). - scsi: be2iscsi: Add length check when parsing nlattrs (git-fixes). - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (git-fixes). - scsi: iscsi: Add length check for nlattr payload (git-fixes). - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (git-fixes). - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (git-fixes). - net: use sk_is_tcp() in more places (git-fixes). - commit 24cbf21 - x86/mm: Print the encryption features correctly when a paravisor is present (bsc#1206453). - commit d1a6274 - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes). - phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes). - phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes). - gpio: vf610: set value before the direction to avoid a glitch (git-fixes). - platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes). - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes). - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (git-fixes). - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). - USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). - mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes). - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). - Bluetooth: avoid memcmp() out of bounds warning (git-fixes). - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes). - Bluetooth: hci_event: Fix coding style (git-fixes). - Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes). - Bluetooth: vhci: Fix race when opening vhci device (git-fixes). - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes). - drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes). - HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes). - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes). - wifi: cfg80211: Fix 6GHz scan configuration (git-fixes). - wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes). - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes). - Bluetooth: Avoid redundant authentication (git-fixes). - Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes). - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-fixes). - gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes). - commit b480af6 - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes). - drm/mediatek: Correctly free sg_table in gem prime vmap (git-fixes). - drm/amd/pm: add unique_id for gc 11.0.3 (git-fixes). - commit ad38bcf - x86/sev: Disable MMIO emulation from user mode (bsc#1212649). - commit 5dae47e - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649). - commit 2b69036 - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649). - commit 816f817 - quota: Fix slow quotaoff (bsc#1216621). - commit 988e5f4 - btrfs: don't start transaction for scrub if the fs is mounted read-only (bsc#1214874). - commit cc8e6f1 - remove unnecessary WARN_ON_ONCE() (bsc#1214823). - NFSD: Never call nfsd_file_gc() in foreground paths (bsc#1215545). - commit d81dfc3 - Update patches.suse/0001-x86-sev-Disable-MMIO-emulation-from-user-mode.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0002-x86-sev-Check-IOBM-for-IOIO-exceptions-from-user-spa.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0003-x86-sev-Check-for-user-space-IOIO-pointing-to-kernel.patch (bsc#1212649 CVE-2023-46813). - commit dd6a315 - netfilter: nf_tables: skip bound chain on rule flush (bsc#1215095 CVE-2023-3777). - commit afb7c25 - iio: exynos-adc: request second interupt only when touchscreen mode is used (git-fixes). - iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale (git-fixes). - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds (git-fixes). - misc: fastrpc: Clean buffers on remote invocation failures (git-fixes). - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers (git-fixes). - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: aspeed: Fix i2c bus hang in slave read (git-fixes). - drm/i915/pmu: Check if pmu is closed before stopping event (git-fixes). - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() (git-fixes). - r8152: Release firmware if we have an error in probe (git-fixes). - r8152: Cancel hw_phy_work if we have an error in probe (git-fixes). - r8152: Run the unload routine if we have errors during probe (git-fixes). - r8152: Increase USB control msg timeout to 5000ms as per spec (git-fixes). - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg (git-fixes). - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() (git-fixes). - treewide: Spelling fix in comment (git-fixes). - commit e69ab42 - fix x86/mm: print the encryption features in hyperv is disabled - commit 37d6855 - s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511). - commit 2bb6835 - KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512). - commit 3976fa9 - Update patches.suse/USB-ene_usb6250-Allocate-enough-memory-for-full-obje.patch (bsc#1216051 CVE-2023-45862). Retroactively recognized as a security issue - commit 716929e - ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085 bsc#1210778). - commit 86e05f1 - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842). - commit 3b513db - blacklist.conf: added two commmits that break kabi - commit fdf2030 - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes). - scsi: pm8001: Setup IRQs on resume (git-fixes). - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (git-fixes). - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes). - scsi: qla4xxx: Add length check when parsing nlattrs (git-fixes). - scsi: be2iscsi: Add length check when parsing nlattrs (git-fixes). - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (git-fixes). - scsi: iscsi: Add length check for nlattr payload (git-fixes). - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (git-fixes). - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (git-fixes). - net: use sk_is_tcp() in more places (git-fixes). - commit 24cbf21 - x86/mm: Print the encryption features correctly when a paravisor is present (bsc#1206453). - commit d1a6274 - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes). - phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes). - phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes). - gpio: vf610: set value before the direction to avoid a glitch (git-fixes). - platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes). - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes). - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (git-fixes). - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). - USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). - mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes). - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). - Bluetooth: avoid memcmp() out of bounds warning (git-fixes). - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes). - Bluetooth: hci_event: Fix coding style (git-fixes). - Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes). - Bluetooth: vhci: Fix race when opening vhci device (git-fixes). - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes). - drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes). - HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes). - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes). - wifi: cfg80211: Fix 6GHz scan configuration (git-fixes). - wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes). - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes). - Bluetooth: Avoid redundant authentication (git-fixes). - Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes). - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-fixes). - gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes). - commit b480af6 - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes). - drm/mediatek: Correctly free sg_table in gem prime vmap (git-fixes). - drm/amd/pm: add unique_id for gc 11.0.3 (git-fixes). - commit ad38bcf - x86/sev: Disable MMIO emulation from user mode (bsc#1212649). - commit 5dae47e - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649). - commit 2b69036 - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649). - commit 816f817 - quota: Fix slow quotaoff (bsc#1216621). - commit 988e5f4 - btrfs: don't start transaction for scrub if the fs is mounted read-only (bsc#1214874). - commit cc8e6f1 - remove unnecessary WARN_ON_ONCE() (bsc#1214823). - NFSD: Never call nfsd_file_gc() in foreground paths (bsc#1215545). - commit d81dfc3 - Update patches.suse/0001-x86-sev-Disable-MMIO-emulation-from-user-mode.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0002-x86-sev-Check-IOBM-for-IOIO-exceptions-from-user-spa.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0003-x86-sev-Check-for-user-space-IOIO-pointing-to-kernel.patch (bsc#1212649 CVE-2023-46813). - commit dd6a315 - netfilter: nf_tables: skip bound chain on rule flush (bsc#1215095 CVE-2023-3777). - commit afb7c25 - iio: exynos-adc: request second interupt only when touchscreen mode is used (git-fixes). - iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale (git-fixes). - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds (git-fixes). - misc: fastrpc: Clean buffers on remote invocation failures (git-fixes). - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers (git-fixes). - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: aspeed: Fix i2c bus hang in slave read (git-fixes). - drm/i915/pmu: Check if pmu is closed before stopping event (git-fixes). - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() (git-fixes). - r8152: Release firmware if we have an error in probe (git-fixes). - r8152: Cancel hw_phy_work if we have an error in probe (git-fixes). - r8152: Run the unload routine if we have errors during probe (git-fixes). - r8152: Increase USB control msg timeout to 5000ms as per spec (git-fixes). - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg (git-fixes). - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() (git-fixes). - treewide: Spelling fix in comment (git-fixes). - commit e69ab42 - fix x86/mm: print the encryption features in hyperv is disabled - commit 37d6855 - s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511). - commit 2bb6835 - KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512). - commit 3976fa9 - Update patches.suse/USB-ene_usb6250-Allocate-enough-memory-for-full-obje.patch (bsc#1216051 CVE-2023-45862). Retroactively recognized as a security issue - commit 716929e - ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085 bsc#1210778). - commit 86e05f1 - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842). - commit 3b513db - blacklist.conf: added two commmits that break kabi - commit fdf2030 - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes). - scsi: pm8001: Setup IRQs on resume (git-fixes). - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (git-fixes). - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes). - scsi: qla4xxx: Add length check when parsing nlattrs (git-fixes). - scsi: be2iscsi: Add length check when parsing nlattrs (git-fixes). - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (git-fixes). - scsi: iscsi: Add length check for nlattr payload (git-fixes). - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (git-fixes). - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (git-fixes). - net: use sk_is_tcp() in more places (git-fixes). - commit 24cbf21 - x86/mm: Print the encryption features correctly when a paravisor is present (bsc#1206453). - commit d1a6274 - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes). - phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes). - phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes). - gpio: vf610: set value before the direction to avoid a glitch (git-fixes). - platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes). - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes). - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (git-fixes). - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). - USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). - mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes). - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). - Bluetooth: avoid memcmp() out of bounds warning (git-fixes). - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes). - Bluetooth: hci_event: Fix coding style (git-fixes). - Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes). - Bluetooth: vhci: Fix race when opening vhci device (git-fixes). - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes). - drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes). - HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes). - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes). - wifi: cfg80211: Fix 6GHz scan configuration (git-fixes). - wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes). - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes). - Bluetooth: Avoid redundant authentication (git-fixes). - Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes). - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-fixes). - gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes). - commit b480af6 - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes). - drm/mediatek: Correctly free sg_table in gem prime vmap (git-fixes). - drm/amd/pm: add unique_id for gc 11.0.3 (git-fixes). - commit ad38bcf - x86/sev: Disable MMIO emulation from user mode (bsc#1212649). - commit 5dae47e - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649). - commit 2b69036 - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649). - commit 816f817 - quota: Fix slow quotaoff (bsc#1216621). - commit 988e5f4 - btrfs: don't start transaction for scrub if the fs is mounted read-only (bsc#1214874). - commit cc8e6f1 - remove unnecessary WARN_ON_ONCE() (bsc#1214823). - NFSD: Never call nfsd_file_gc() in foreground paths (bsc#1215545). - commit d81dfc3 - Update patches.suse/0001-x86-sev-Disable-MMIO-emulation-from-user-mode.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0002-x86-sev-Check-IOBM-for-IOIO-exceptions-from-user-spa.patch (bsc#1212649 CVE-2023-46813). - Update patches.suse/0003-x86-sev-Check-for-user-space-IOIO-pointing-to-kernel.patch (bsc#1212649 CVE-2023-46813). - commit dd6a315 - netfilter: nf_tables: skip bound chain on rule flush (bsc#1215095 CVE-2023-3777). - commit afb7c25 - iio: exynos-adc: request second interupt only when touchscreen mode is used (git-fixes). - iio: adc: xilinx-xadc: Correct temperature offset/scale for UltraScale (git-fixes). - iio: adc: xilinx-xadc: Don't clobber preset voltage/temperature thresholds (git-fixes). - misc: fastrpc: Clean buffers on remote invocation failures (git-fixes). - i2c: stm32f7: Fix PEC handling in case of SMBUS transfers (git-fixes). - i2c: muxes: i2c-mux-gpmux: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-demux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: muxes: i2c-mux-pinctrl: Use of_get_i2c_adapter_by_node() (git-fixes). - i2c: aspeed: Fix i2c bus hang in slave read (git-fixes). - drm/i915/pmu: Check if pmu is closed before stopping event (git-fixes). - firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() (git-fixes). - r8152: Release firmware if we have an error in probe (git-fixes). - r8152: Cancel hw_phy_work if we have an error in probe (git-fixes). - r8152: Run the unload routine if we have errors during probe (git-fixes). - r8152: Increase USB control msg timeout to 5000ms as per spec (git-fixes). - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg (git-fixes). - net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() (git-fixes). - treewide: Spelling fix in comment (git-fixes). - commit e69ab42 - fix x86/mm: print the encryption features in hyperv is disabled - commit 37d6855 - xfs: standardize inode generation formatting in ftrace output (git-fixes). - commit 81e4504 - xfs: convert buffer flags to unsigned (git-fixes). - commit 6147a1c - xfs: convert attr type flags to unsigned (git-fixes). - commit c641f4d - xfs: convert scrub type flags to unsigned (git-fixes). - commit c3c7c82 - xfs: convert bmap extent type flags to unsigned (git-fixes). - commit 30fead3 - xfs: convert bmapi flags to unsigned (git-fixes). - commit 1ec6360 - xfs: convert AGF log flags to unsigned (git-fixes). - commit 91cefbb - xfs: convert AGI log flags to unsigned (git-fixes). - commit 66d955b - xfs: convert btree buffer log flags to unsigned (git-fixes). - commit ced67a9 - xfs: convert buffer log item flags to unsigned (git-fixes). - commit d4d0c9c - xfs: convert da btree operations flags to unsigned (git-fixes). - commit 41198d9 - xfs: convert dquot flags to unsigned (git-fixes). - commit 1630213 - xfs: convert log item tracepoint flags to unsigned (git-fixes). - commit 411032a - xfs: convert inode lock flags to unsigned (git-fixes). - commit 831f7e2 - xfs: convert quota options flags to unsigned (git-fixes). - commit 7dfe466 - xfs: convert log ticket and iclog flags to unsigned (git-fixes). - commit 57245d3 - firewire: core: fix possible memory leak in create_units() (git-fixes). - commit 0ade49c - USB: serial: option: add Luat Air72*U series products (git-fixes). - USB: serial: option: add Fibocom L7xx modules (git-fixes). - USB: serial: option: don't claim interface 4 for ZTE MF290 (git-fixes). - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes). - commit 4c40fde - blacklist.conf: this is true for SLE15-SP4 not SLE15-SP5 The backport was provided in bsc#1215123 for SP5, but it has further dependencies not present in SP4, so unless requested by IBM, I'm going to skip it for git-fixes. - commit 5219b23 - powerpc: Don't clobber f0/vs0 during fp|altivec register save (bsc#1217780). - commit 46d31e2 - xfs: standardize inode generation formatting in ftrace output (git-fixes). - commit 81e4504 - xfs: convert buffer flags to unsigned (git-fixes). - commit 6147a1c - xfs: convert attr type flags to unsigned (git-fixes). - commit c641f4d - xfs: convert scrub type flags to unsigned (git-fixes). - commit c3c7c82 - xfs: convert bmap extent type flags to unsigned (git-fixes). - commit 30fead3 - xfs: convert bmapi flags to unsigned (git-fixes). - commit 1ec6360 - xfs: convert AGF log flags to unsigned (git-fixes). - commit 91cefbb - xfs: convert AGI log flags to unsigned (git-fixes). - commit 66d955b - xfs: convert btree buffer log flags to unsigned (git-fixes). - commit ced67a9 - xfs: convert buffer log item flags to unsigned (git-fixes). - commit d4d0c9c - xfs: convert da btree operations flags to unsigned (git-fixes). - commit 41198d9 - xfs: convert dquot flags to unsigned (git-fixes). - commit 1630213 - xfs: convert log item tracepoint flags to unsigned (git-fixes). - commit 411032a - xfs: convert inode lock flags to unsigned (git-fixes). - commit 831f7e2 - xfs: convert quota options flags to unsigned (git-fixes). - commit 7dfe466 - xfs: convert log ticket and iclog flags to unsigned (git-fixes). - commit 57245d3 - firewire: core: fix possible memory leak in create_units() (git-fixes). - commit 0ade49c - USB: serial: option: add Luat Air72*U series products (git-fixes). - USB: serial: option: add Fibocom L7xx modules (git-fixes). - USB: serial: option: don't claim interface 4 for ZTE MF290 (git-fixes). - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes). - commit 4c40fde - blacklist.conf: this is true for SLE15-SP4 not SLE15-SP5 The backport was provided in bsc#1215123 for SP5, but it has further dependencies not present in SP4, so unless requested by IBM, I'm going to skip it for git-fixes. - commit 5219b23 - powerpc: Don't clobber f0/vs0 during fp|altivec register save (bsc#1217780). - commit 46d31e2 - xfs: standardize inode generation formatting in ftrace output (git-fixes). - commit 81e4504 - xfs: convert buffer flags to unsigned (git-fixes). - commit 6147a1c - xfs: convert attr type flags to unsigned (git-fixes). - commit c641f4d - xfs: convert scrub type flags to unsigned (git-fixes). - commit c3c7c82 - xfs: convert bmap extent type flags to unsigned (git-fixes). - commit 30fead3 - xfs: convert bmapi flags to unsigned (git-fixes). - commit 1ec6360 - xfs: convert AGF log flags to unsigned (git-fixes). - commit 91cefbb - xfs: convert AGI log flags to unsigned (git-fixes). - commit 66d955b - xfs: convert btree buffer log flags to unsigned (git-fixes). - commit ced67a9 - xfs: convert buffer log item flags to unsigned (git-fixes). - commit d4d0c9c - xfs: convert da btree operations flags to unsigned (git-fixes). - commit 41198d9 - xfs: convert dquot flags to unsigned (git-fixes). - commit 1630213 - xfs: convert log item tracepoint flags to unsigned (git-fixes). - commit 411032a - xfs: convert inode lock flags to unsigned (git-fixes). - commit 831f7e2 - xfs: convert quota options flags to unsigned (git-fixes). - commit 7dfe466 - xfs: convert log ticket and iclog flags to unsigned (git-fixes). - commit 57245d3 - firewire: core: fix possible memory leak in create_units() (git-fixes). - commit 0ade49c - USB: serial: option: add Luat Air72*U series products (git-fixes). - USB: serial: option: add Fibocom L7xx modules (git-fixes). - USB: serial: option: don't claim interface 4 for ZTE MF290 (git-fixes). - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes). - commit 4c40fde - blacklist.conf: this is true for SLE15-SP4 not SLE15-SP5 The backport was provided in bsc#1215123 for SP5, but it has further dependencies not present in SP4, so unless requested by IBM, I'm going to skip it for git-fixes. - commit 5219b23 - powerpc: Don't clobber f0/vs0 during fp|altivec register save (bsc#1217780). - commit 46d31e2 - xfs: standardize inode generation formatting in ftrace output (git-fixes). - commit 81e4504 - xfs: convert buffer flags to unsigned (git-fixes). - commit 6147a1c - xfs: convert attr type flags to unsigned (git-fixes). - commit c641f4d - xfs: convert scrub type flags to unsigned (git-fixes). - commit c3c7c82 - xfs: convert bmap extent type flags to unsigned (git-fixes). - commit 30fead3 - xfs: convert bmapi flags to unsigned (git-fixes). - commit 1ec6360 - xfs: convert AGF log flags to unsigned (git-fixes). - commit 91cefbb - xfs: convert AGI log flags to unsigned (git-fixes). - commit 66d955b - xfs: convert btree buffer log flags to unsigned (git-fixes). - commit ced67a9 - xfs: convert buffer log item flags to unsigned (git-fixes). - commit d4d0c9c - xfs: convert da btree operations flags to unsigned (git-fixes). - commit 41198d9 - xfs: convert dquot flags to unsigned (git-fixes). - commit 1630213 - xfs: convert log item tracepoint flags to unsigned (git-fixes). - commit 411032a - xfs: convert inode lock flags to unsigned (git-fixes). - commit 831f7e2 - xfs: convert quota options flags to unsigned (git-fixes). - commit 7dfe466 - xfs: convert log ticket and iclog flags to unsigned (git-fixes). - commit 57245d3 - firewire: core: fix possible memory leak in create_units() (git-fixes). - commit 0ade49c - USB: serial: option: add Luat Air72*U series products (git-fixes). - USB: serial: option: add Fibocom L7xx modules (git-fixes). - USB: serial: option: don't claim interface 4 for ZTE MF290 (git-fixes). - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes). - commit 4c40fde - blacklist.conf: this is true for SLE15-SP4 not SLE15-SP5 The backport was provided in bsc#1215123 for SP5, but it has further dependencies not present in SP4, so unless requested by IBM, I'm going to skip it for git-fixes. - commit 5219b23 - powerpc: Don't clobber f0/vs0 during fp|altivec register save (bsc#1217780). - commit 46d31e2 - x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes). - Refresh patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch. - commit b121d1d - x86/srso: Add SRSO mitigation for Hygon processors (git-fixes). - commit 7b8dfd1 - x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes). - commit 8087b92 - x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes). - commit 7029135 - x86/alternatives: Sync core before enabling interrupts (git-fixes). - commit 4a0b72a - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning (git-fixes). - commit 3929c70 - x86/boot/compressed: Reserve more memory for page tables (git-fixes). - commit 6bf16e1 - x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes). - commit fdc98a7 - vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). - commit 8dab9cc - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes). - commit d74349c - x86/cpu: Fix amd_check_microcode() declaration (git-fixes). - Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch. - commit c22f4b4 - x86/fpu: Invalidate FPU state correctly on exec() (git-fixes). - commit 7686df9 - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes). - commit 46d60b3 - x86/purgatory: Remove LTO flags (git-fixes). - commit bbd4f84 - smb: client: fix potential OOB in smb2_dump_detail() (bsc#1217946 CVE-2023-6610). - commit cfca7f7 - swiotlb: reduce the number of areas to match actual memory pool size (git-fixes). - swiotlb: always set the number of areas before allocating the pool (git-fixes). - swiotlb: fix debugfs reporting of reserved memory pools (git-fixes). - swiotlb: fix a braino in the alignment check fix (bsc#1216559). - swiotlb: fix slot alignment checks (bsc#1216559). - swiotlb: fix the deadlock in swiotlb_do_find_slots (git-fixes). - swiotlb: reduce the swiotlb buffer size on allocation failure (git-fixes). - swiotlb: don't panic! (git-fixes). - Revert "swiotlb: panic if nslabs is too small" (git-fixes). - commit 1b89825 - io_uring/af_unix: disable sending io_uring over sockets (bsc#1218447, CVE-2023-6531). - commit fdc256b - swiotlb: use the calculated number of areas (git-fixes). - swiotlb: mark swiotlb_memblock_alloc() as __init (git-fixes). - commit b9aedb4 - Update patches.kabi/kabi-fix-zone-unaccepted-memory.patch (jsc#PED-7167 bsc#1218643). - commit f781e3d - Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces - Fix crash in vmw_context_cotables_unref when 3d support is enabled (bsc#1218738) - commit 99a9f67 - x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes). - Refresh patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch. - commit b121d1d - x86/srso: Add SRSO mitigation for Hygon processors (git-fixes). - commit 7b8dfd1 - x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes). - commit 8087b92 - x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes). - commit 7029135 - x86/alternatives: Sync core before enabling interrupts (git-fixes). - commit 4a0b72a - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning (git-fixes). - commit 3929c70 - x86/boot/compressed: Reserve more memory for page tables (git-fixes). - commit 6bf16e1 - x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes). - commit fdc98a7 - vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). - commit 8dab9cc - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes). - commit d74349c - x86/cpu: Fix amd_check_microcode() declaration (git-fixes). - Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch. - commit c22f4b4 - x86/fpu: Invalidate FPU state correctly on exec() (git-fixes). - commit 7686df9 - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes). - commit 46d60b3 - x86/purgatory: Remove LTO flags (git-fixes). - commit bbd4f84 - smb: client: fix potential OOB in smb2_dump_detail() (bsc#1217946 CVE-2023-6610). - commit cfca7f7 - swiotlb: reduce the number of areas to match actual memory pool size (git-fixes). - swiotlb: always set the number of areas before allocating the pool (git-fixes). - swiotlb: fix debugfs reporting of reserved memory pools (git-fixes). - swiotlb: fix a braino in the alignment check fix (bsc#1216559). - swiotlb: fix slot alignment checks (bsc#1216559). - swiotlb: fix the deadlock in swiotlb_do_find_slots (git-fixes). - swiotlb: reduce the swiotlb buffer size on allocation failure (git-fixes). - swiotlb: don't panic! (git-fixes). - Revert "swiotlb: panic if nslabs is too small" (git-fixes). - commit 1b89825 - io_uring/af_unix: disable sending io_uring over sockets (bsc#1218447, CVE-2023-6531). - commit fdc256b - swiotlb: use the calculated number of areas (git-fixes). - swiotlb: mark swiotlb_memblock_alloc() as __init (git-fixes). - commit b9aedb4 - Update patches.kabi/kabi-fix-zone-unaccepted-memory.patch (jsc#PED-7167 bsc#1218643). - commit f781e3d - Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces - Fix crash in vmw_context_cotables_unref when 3d support is enabled (bsc#1218738) - commit 99a9f67 - x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes). - Refresh patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch. - commit b121d1d - x86/srso: Add SRSO mitigation for Hygon processors (git-fixes). - commit 7b8dfd1 - x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes). - commit 8087b92 - x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes). - commit 7029135 - x86/alternatives: Sync core before enabling interrupts (git-fixes). - commit 4a0b72a - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning (git-fixes). - commit 3929c70 - x86/boot/compressed: Reserve more memory for page tables (git-fixes). - commit 6bf16e1 - x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes). - commit fdc98a7 - vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). - commit 8dab9cc - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes). - commit d74349c - x86/cpu: Fix amd_check_microcode() declaration (git-fixes). - Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch. - commit c22f4b4 - x86/fpu: Invalidate FPU state correctly on exec() (git-fixes). - commit 7686df9 - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes). - commit 46d60b3 - x86/purgatory: Remove LTO flags (git-fixes). - commit bbd4f84 - smb: client: fix potential OOB in smb2_dump_detail() (bsc#1217946 CVE-2023-6610). - commit cfca7f7 - swiotlb: reduce the number of areas to match actual memory pool size (git-fixes). - swiotlb: always set the number of areas before allocating the pool (git-fixes). - swiotlb: fix debugfs reporting of reserved memory pools (git-fixes). - swiotlb: fix a braino in the alignment check fix (bsc#1216559). - swiotlb: fix slot alignment checks (bsc#1216559). - swiotlb: fix the deadlock in swiotlb_do_find_slots (git-fixes). - swiotlb: reduce the swiotlb buffer size on allocation failure (git-fixes). - swiotlb: don't panic! (git-fixes). - Revert "swiotlb: panic if nslabs is too small" (git-fixes). - commit 1b89825 - io_uring/af_unix: disable sending io_uring over sockets (bsc#1218447, CVE-2023-6531). - commit fdc256b - swiotlb: use the calculated number of areas (git-fixes). - swiotlb: mark swiotlb_memblock_alloc() as __init (git-fixes). - commit b9aedb4 - Update patches.kabi/kabi-fix-zone-unaccepted-memory.patch (jsc#PED-7167 bsc#1218643). - commit f781e3d - Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces - Fix crash in vmw_context_cotables_unref when 3d support is enabled (bsc#1218738) - commit 99a9f67 - x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes). - Refresh patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch. - commit b121d1d - x86/srso: Add SRSO mitigation for Hygon processors (git-fixes). - commit 7b8dfd1 - x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes). - commit 8087b92 - x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes). - commit 7029135 - x86/alternatives: Sync core before enabling interrupts (git-fixes). - commit 4a0b72a - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning (git-fixes). - commit 3929c70 - x86/boot/compressed: Reserve more memory for page tables (git-fixes). - commit 6bf16e1 - x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes). - commit fdc98a7 - vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). - commit 8dab9cc - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes). - commit d74349c - x86/cpu: Fix amd_check_microcode() declaration (git-fixes). - Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch. - commit c22f4b4 - x86/fpu: Invalidate FPU state correctly on exec() (git-fixes). - commit 7686df9 - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes). - commit 46d60b3 - x86/purgatory: Remove LTO flags (git-fixes). - commit bbd4f84 - smb: client: fix potential OOB in smb2_dump_detail() (bsc#1217946 CVE-2023-6610). - commit cfca7f7 - swiotlb: reduce the number of areas to match actual memory pool size (git-fixes). - swiotlb: always set the number of areas before allocating the pool (git-fixes). - swiotlb: fix debugfs reporting of reserved memory pools (git-fixes). - swiotlb: fix a braino in the alignment check fix (bsc#1216559). - swiotlb: fix slot alignment checks (bsc#1216559). - swiotlb: fix the deadlock in swiotlb_do_find_slots (git-fixes). - swiotlb: reduce the swiotlb buffer size on allocation failure (git-fixes). - swiotlb: don't panic! (git-fixes). - Revert "swiotlb: panic if nslabs is too small" (git-fixes). - commit 1b89825 - io_uring/af_unix: disable sending io_uring over sockets (bsc#1218447, CVE-2023-6531). - commit fdc256b - swiotlb: use the calculated number of areas (git-fixes). - swiotlb: mark swiotlb_memblock_alloc() as __init (git-fixes). - commit b9aedb4 - Update patches.kabi/kabi-fix-zone-unaccepted-memory.patch (jsc#PED-7167 bsc#1218643). - commit f781e3d - Update: drm/vmwgfx: Keep a gem reference to user bos in surfaces - Fix crash in vmw_context_cotables_unref when 3d support is enabled (bsc#1218738) - commit 99a9f67 - fs: Fix error checking for d_hash_and_lookup() (git-fixes). - commit b1a5e63 - tracefs: Add missing lockdown check to tracefs_create_dir() (git-fixes). - commit 36d0f04 - fs: indicate request originates from old mount API (git-fixes). - commit 8ccbbb1 - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086 bsc#1219434). - commit 5f917ff - netfilter: nf_tables: check if catch-all set element is active in next generation (CVE-2024-1085 bsc#1219429). - commit 7b3f4c4 - RAS: Introduce AMD Address Translation Library (jsc#PED-7618). - commit d6ad6ba - EDAC/amd64: Use new AMD Address Translation Library (jsc#PED-7618). - commit f1baba4 - Documentation: RAS: Add index and address translation section (jsc#PED-7618). - commit d6e1334 - RAS/AMD/ATL: Add MI300 support (jsc#PED-7618). - commit 761e3c8 - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (jsc#PED-7618). - commit 83df5af - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (jsc#PED-7618). - commit a26a502 - EDAC/amd64: Add MI300 row retirement support (jsc#PED-7618). - commit fb688f3 - README.BRANCH: update branch name to cve/linux-5.14, update maintainers as requested - commit 8e34879 - Update patches.suse/Bluetooth-Fix-atomicity-violation-in-min-max-_key_si.patch (git-fixes bsc#1219608 CVE-2024-24860). - commit dedfe8a - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (git-fixes bsc#1219608 CVE-2024-24860). - commit a1186fd - Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch. Accidentally removed nfs4_get_stateowner - commit ad106c0 - README.BRANCH: Update cve/linux-5.14 maintainers Add myself to match SLE15-SP5 consumer + fix typo in branch name. - commit da26653 - vhost: use kzalloc() instead of kmalloc() followed by memset() (CVE-2024-0340, bsc#1218689). - commit 4c5a740 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix build due to incomplete line removal - commit 720d084 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix following error when building kvmsmall config by removing left over declaration: [ 216s] In file included from ../arch/x86/kernel/cpu/mce/core.c:52:0: [ 216s] ../arch/x86/include/asm/mce.h:366:1: error: duplicate 'static' [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:15: error: two or more data types in declaration specifiers [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~ [ 216s] ../arch/x86/include/asm/mce.h: In function 'mce_hygon_feature_init': [ 216s] ../arch/x86/include/asm/mce.h:366:75: error: void value not ignored as it ought to be [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~~~~~~~~~~~~~~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:50: error: control reaches end of non-void function [-Werror=return-type] [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } - commit 7015e17 - fs: Fix error checking for d_hash_and_lookup() (git-fixes). - commit b1a5e63 - tracefs: Add missing lockdown check to tracefs_create_dir() (git-fixes). - commit 36d0f04 - fs: indicate request originates from old mount API (git-fixes). - commit 8ccbbb1 - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086 bsc#1219434). - commit 5f917ff - netfilter: nf_tables: check if catch-all set element is active in next generation (CVE-2024-1085 bsc#1219429). - commit 7b3f4c4 - RAS: Introduce AMD Address Translation Library (jsc#PED-7618). - commit d6ad6ba - EDAC/amd64: Use new AMD Address Translation Library (jsc#PED-7618). - commit f1baba4 - Documentation: RAS: Add index and address translation section (jsc#PED-7618). - commit d6e1334 - RAS/AMD/ATL: Add MI300 support (jsc#PED-7618). - commit 761e3c8 - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (jsc#PED-7618). - commit 83df5af - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (jsc#PED-7618). - commit a26a502 - EDAC/amd64: Add MI300 row retirement support (jsc#PED-7618). - commit fb688f3 - README.BRANCH: update branch name to cve/linux-5.14, update maintainers as requested - commit 8e34879 - Update patches.suse/Bluetooth-Fix-atomicity-violation-in-min-max-_key_si.patch (git-fixes bsc#1219608 CVE-2024-24860). - commit dedfe8a - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (git-fixes bsc#1219608 CVE-2024-24860). - commit a1186fd - Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch. Accidentally removed nfs4_get_stateowner - commit ad106c0 - README.BRANCH: Update cve/linux-5.14 maintainers Add myself to match SLE15-SP5 consumer + fix typo in branch name. - commit da26653 - vhost: use kzalloc() instead of kmalloc() followed by memset() (CVE-2024-0340, bsc#1218689). - commit 4c5a740 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix build due to incomplete line removal - commit 720d084 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix following error when building kvmsmall config by removing left over declaration: [ 216s] In file included from ../arch/x86/kernel/cpu/mce/core.c:52:0: [ 216s] ../arch/x86/include/asm/mce.h:366:1: error: duplicate 'static' [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:15: error: two or more data types in declaration specifiers [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~ [ 216s] ../arch/x86/include/asm/mce.h: In function 'mce_hygon_feature_init': [ 216s] ../arch/x86/include/asm/mce.h:366:75: error: void value not ignored as it ought to be [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~~~~~~~~~~~~~~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:50: error: control reaches end of non-void function [-Werror=return-type] [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } - commit 7015e17 - fs: Fix error checking for d_hash_and_lookup() (git-fixes). - commit b1a5e63 - tracefs: Add missing lockdown check to tracefs_create_dir() (git-fixes). - commit 36d0f04 - fs: indicate request originates from old mount API (git-fixes). - commit 8ccbbb1 - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086 bsc#1219434). - commit 5f917ff - netfilter: nf_tables: check if catch-all set element is active in next generation (CVE-2024-1085 bsc#1219429). - commit 7b3f4c4 - RAS: Introduce AMD Address Translation Library (jsc#PED-7618). - commit d6ad6ba - EDAC/amd64: Use new AMD Address Translation Library (jsc#PED-7618). - commit f1baba4 - Documentation: RAS: Add index and address translation section (jsc#PED-7618). - commit d6e1334 - RAS/AMD/ATL: Add MI300 support (jsc#PED-7618). - commit 761e3c8 - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (jsc#PED-7618). - commit 83df5af - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (jsc#PED-7618). - commit a26a502 - EDAC/amd64: Add MI300 row retirement support (jsc#PED-7618). - commit fb688f3 - README.BRANCH: update branch name to cve/linux-5.14, update maintainers as requested - commit 8e34879 - Update patches.suse/Bluetooth-Fix-atomicity-violation-in-min-max-_key_si.patch (git-fixes bsc#1219608 CVE-2024-24860). - commit dedfe8a - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (git-fixes bsc#1219608 CVE-2024-24860). - commit a1186fd - Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch. Accidentally removed nfs4_get_stateowner - commit ad106c0 - README.BRANCH: Update cve/linux-5.14 maintainers Add myself to match SLE15-SP5 consumer + fix typo in branch name. - commit da26653 - vhost: use kzalloc() instead of kmalloc() followed by memset() (CVE-2024-0340, bsc#1218689). - commit 4c5a740 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix build due to incomplete line removal - commit 720d084 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix following error when building kvmsmall config by removing left over declaration: [ 216s] In file included from ../arch/x86/kernel/cpu/mce/core.c:52:0: [ 216s] ../arch/x86/include/asm/mce.h:366:1: error: duplicate 'static' [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:15: error: two or more data types in declaration specifiers [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~ [ 216s] ../arch/x86/include/asm/mce.h: In function 'mce_hygon_feature_init': [ 216s] ../arch/x86/include/asm/mce.h:366:75: error: void value not ignored as it ought to be [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~~~~~~~~~~~~~~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:50: error: control reaches end of non-void function [-Werror=return-type] [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } - commit 7015e17 - fs: Fix error checking for d_hash_and_lookup() (git-fixes). - commit b1a5e63 - tracefs: Add missing lockdown check to tracefs_create_dir() (git-fixes). - commit 36d0f04 - fs: indicate request originates from old mount API (git-fixes). - commit 8ccbbb1 - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086 bsc#1219434). - commit 5f917ff - netfilter: nf_tables: check if catch-all set element is active in next generation (CVE-2024-1085 bsc#1219429). - commit 7b3f4c4 - RAS: Introduce AMD Address Translation Library (jsc#PED-7618). - commit d6ad6ba - EDAC/amd64: Use new AMD Address Translation Library (jsc#PED-7618). - commit f1baba4 - Documentation: RAS: Add index and address translation section (jsc#PED-7618). - commit d6e1334 - RAS/AMD/ATL: Add MI300 support (jsc#PED-7618). - commit 761e3c8 - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (jsc#PED-7618). - commit 83df5af - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (jsc#PED-7618). - commit a26a502 - EDAC/amd64: Add MI300 row retirement support (jsc#PED-7618). - commit fb688f3 - README.BRANCH: update branch name to cve/linux-5.14, update maintainers as requested - commit 8e34879 - Update patches.suse/Bluetooth-Fix-atomicity-violation-in-min-max-_key_si.patch (git-fixes bsc#1219608 CVE-2024-24860). - commit dedfe8a - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (git-fixes bsc#1219608 CVE-2024-24860). - commit a1186fd - Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch. Accidentally removed nfs4_get_stateowner - commit ad106c0 - README.BRANCH: Update cve/linux-5.14 maintainers Add myself to match SLE15-SP5 consumer + fix typo in branch name. - commit da26653 - vhost: use kzalloc() instead of kmalloc() followed by memset() (CVE-2024-0340, bsc#1218689). - commit 4c5a740 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix build due to incomplete line removal - commit 720d084 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix following error when building kvmsmall config by removing left over declaration: [ 216s] In file included from ../arch/x86/kernel/cpu/mce/core.c:52:0: [ 216s] ../arch/x86/include/asm/mce.h:366:1: error: duplicate 'static' [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:15: error: two or more data types in declaration specifiers [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~ [ 216s] ../arch/x86/include/asm/mce.h: In function 'mce_hygon_feature_init': [ 216s] ../arch/x86/include/asm/mce.h:366:75: error: void value not ignored as it ought to be [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~~~~~~~~~~~~~~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:50: error: control reaches end of non-void function [-Werror=return-type] [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } - commit 7015e17 - power: supply: bq27xxx-i2c: Do not free non existing IRQ (git-fixes). - mmc: sdhci-xenon: add timeout for PHY init complete (git-fixes). - mmc: sdhci-xenon: fix PHY init clock stability (git-fixes). - mmc: core: Fix eMMC initialization with 1-bit bus connection (git-fixes). - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes). - mtd: spinand: gigadevice: Fix the get ecc status issue (git-fixes). - nouveau: fix function cast warnings (git-fixes). - media: ir_toy: fix a memleak in irtoy_tx (git-fixes). - media: rc: bpf attach/detach requires write permission (git-fixes). - mmc: slot-gpio: Allow non-sleeping GPIO ro (git-fixes). - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (git-fixes). - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet (git-fixes). - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected (git-fixes). - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (git-fixes). - PCI: Fix 64GT/s effective data rate calculation (git-fixes). - PCI: Only override AMD USB controller if required (git-fixes). - PCI/AER: Decode Requester ID when no error info found (git-fixes). - media: ddbridge: fix an error code problem in ddb_probe (git-fixes). - mmc: mmc_spi: remove custom DMA mapped buffers (git-fixes). - mmc: core: Use mrq.sbc in close-ended ffu (git-fixes). - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (git-fixes). - pstore/ram: Fix crash when setting number of cpus to an odd number (git-fixes). - PNP: ACPI: fix fortify warning (git-fixes). - regulator: core: Only increment use_count when enable_count changes (git-fixes). - PM: core: Remove unnecessary (void *) conversions (git-fixes). - serial: 8250: Remove serial_rs485 sanitization from em485 (git-fixes). - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes). - commit 9894050 - tomoyo: fix UAF write bug in tomoyo_write_control() (git-fixes). - wifi: nl80211: reject iftype change with mesh ID change (git-fixes). - usb: dwc3: gadget: Don't disconnect if not started (git-fixes). - wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes). - usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes). - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK (git-fixes). - spi: sh-msiof: avoid integer overflow in constants (git-fixes). - wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes). - wifi: cfg80211: fix missing interfaces when dumping (git-fixes). - usb: dwc3: gadget: Queue PM runtime idle on disconnect event (git-fixes). - usb: dwc3: gadget: Handle EP0 request dequeuing properly (git-fixes). - usb: hub: Replace hardcoded quirk value with BIT() macro (git-fixes). - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE (git-fixes). - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 (git-fixes). - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (git-fixes). - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (git-fixes). - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes). - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (git-fixes). - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes). - wifi: rt2x00: restart beacon queue when hardware reset (git-fixes). - wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes). - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes). - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (git-fixes). - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API (git-fixes). - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect (git-fixes). - commit 8b4f9a3 - usb: dwc3: gadget: Ignore End Transfer delay on teardown (git-fixes). - Refresh patches.suse/usb-dwc3-gadget-Add-1ms-delay-after-end-transfer-com.patch. - commit 251cd08 - Update patch reference for input fix (CVE-2021-46932 bsc#1220444) - commit e44e0b1 - powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1220250,CVE-2023-52451). - commit fdc7254 - serial: imx: fix tx statemachine deadlock (bsc#1220364 CVE-2023-52456). - commit cd9f92c - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457). - commit c82f528 - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Add some comments to stack representation (bsc#1220257 CVE-2023-52452). - Refresh patches.kabi/kABI-fix-bpf-Tighten-ptr_to_btf_id-checks.patch - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor logging improvement (bsc#1220257). - commit 7d03125 - btrfs: do not ASSERT() if the newly created subvolume already got read (bsc#1219126 CVE-2024-23850). - commit a2ac581 - btrfs: fix double free of anonymous device after snapshot creation failure (bsc#1219126 CVE-2024-23850). - commit 257a534 - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825 CVE-2024-26622). - commit c8e5b38 - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817 bsc#1218195). - commit 4032aa7 - netfilter: nf_tables: fix 64-bit load issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - commit e095cd0 - kabi: restore return type of dst_ops::gc() callback (CVE-2023-52340 bsc#1219295). - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340 bsc#1219295). - commit b8eec42 - tls: fix race between tx work scheduling and socket close (CVE-2024-26585 bsc#1220187). - commit 1306bff - selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - commit 8a833ce - bpf: Fix re-attachment branch in bpf_tracing_prog_attach (bsc#1220254 CVE-2024-26591). - commit fc948d3 - Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746). - commit c955133 - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746). - commit ee70608 - KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746). - commit 7f00c86 - power: supply: bq27xxx-i2c: Do not free non existing IRQ (git-fixes). - mmc: sdhci-xenon: add timeout for PHY init complete (git-fixes). - mmc: sdhci-xenon: fix PHY init clock stability (git-fixes). - mmc: core: Fix eMMC initialization with 1-bit bus connection (git-fixes). - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes). - mtd: spinand: gigadevice: Fix the get ecc status issue (git-fixes). - nouveau: fix function cast warnings (git-fixes). - media: ir_toy: fix a memleak in irtoy_tx (git-fixes). - media: rc: bpf attach/detach requires write permission (git-fixes). - mmc: slot-gpio: Allow non-sleeping GPIO ro (git-fixes). - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (git-fixes). - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet (git-fixes). - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected (git-fixes). - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (git-fixes). - PCI: Fix 64GT/s effective data rate calculation (git-fixes). - PCI: Only override AMD USB controller if required (git-fixes). - PCI/AER: Decode Requester ID when no error info found (git-fixes). - media: ddbridge: fix an error code problem in ddb_probe (git-fixes). - mmc: mmc_spi: remove custom DMA mapped buffers (git-fixes). - mmc: core: Use mrq.sbc in close-ended ffu (git-fixes). - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (git-fixes). - pstore/ram: Fix crash when setting number of cpus to an odd number (git-fixes). - PNP: ACPI: fix fortify warning (git-fixes). - regulator: core: Only increment use_count when enable_count changes (git-fixes). - PM: core: Remove unnecessary (void *) conversions (git-fixes). - serial: 8250: Remove serial_rs485 sanitization from em485 (git-fixes). - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes). - commit 9894050 - tomoyo: fix UAF write bug in tomoyo_write_control() (git-fixes). - wifi: nl80211: reject iftype change with mesh ID change (git-fixes). - usb: dwc3: gadget: Don't disconnect if not started (git-fixes). - wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes). - usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes). - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK (git-fixes). - spi: sh-msiof: avoid integer overflow in constants (git-fixes). - wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes). - wifi: cfg80211: fix missing interfaces when dumping (git-fixes). - usb: dwc3: gadget: Queue PM runtime idle on disconnect event (git-fixes). - usb: dwc3: gadget: Handle EP0 request dequeuing properly (git-fixes). - usb: hub: Replace hardcoded quirk value with BIT() macro (git-fixes). - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE (git-fixes). - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 (git-fixes). - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (git-fixes). - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (git-fixes). - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes). - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (git-fixes). - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes). - wifi: rt2x00: restart beacon queue when hardware reset (git-fixes). - wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes). - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes). - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (git-fixes). - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API (git-fixes). - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect (git-fixes). - commit 8b4f9a3 - usb: dwc3: gadget: Ignore End Transfer delay on teardown (git-fixes). - Refresh patches.suse/usb-dwc3-gadget-Add-1ms-delay-after-end-transfer-com.patch. - commit 251cd08 - Update patch reference for input fix (CVE-2021-46932 bsc#1220444) - commit e44e0b1 - powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1220250,CVE-2023-52451). - commit fdc7254 - serial: imx: fix tx statemachine deadlock (bsc#1220364 CVE-2023-52456). - commit cd9f92c - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457). - commit c82f528 - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Add some comments to stack representation (bsc#1220257 CVE-2023-52452). - Refresh patches.kabi/kABI-fix-bpf-Tighten-ptr_to_btf_id-checks.patch - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor logging improvement (bsc#1220257). - commit 7d03125 - btrfs: do not ASSERT() if the newly created subvolume already got read (bsc#1219126 CVE-2024-23850). - commit a2ac581 - btrfs: fix double free of anonymous device after snapshot creation failure (bsc#1219126 CVE-2024-23850). - commit 257a534 - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825 CVE-2024-26622). - commit c8e5b38 - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817 bsc#1218195). - commit 4032aa7 - netfilter: nf_tables: fix 64-bit load issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - commit e095cd0 - kabi: restore return type of dst_ops::gc() callback (CVE-2023-52340 bsc#1219295). - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340 bsc#1219295). - commit b8eec42 - tls: fix race between tx work scheduling and socket close (CVE-2024-26585 bsc#1220187). - commit 1306bff - selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - commit 8a833ce - bpf: Fix re-attachment branch in bpf_tracing_prog_attach (bsc#1220254 CVE-2024-26591). - commit fc948d3 - Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746). - commit c955133 - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746). - commit ee70608 - KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746). - commit 7f00c86 - power: supply: bq27xxx-i2c: Do not free non existing IRQ (git-fixes). - mmc: sdhci-xenon: add timeout for PHY init complete (git-fixes). - mmc: sdhci-xenon: fix PHY init clock stability (git-fixes). - mmc: core: Fix eMMC initialization with 1-bit bus connection (git-fixes). - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes). - mtd: spinand: gigadevice: Fix the get ecc status issue (git-fixes). - nouveau: fix function cast warnings (git-fixes). - media: ir_toy: fix a memleak in irtoy_tx (git-fixes). - media: rc: bpf attach/detach requires write permission (git-fixes). - mmc: slot-gpio: Allow non-sleeping GPIO ro (git-fixes). - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (git-fixes). - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet (git-fixes). - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected (git-fixes). - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (git-fixes). - PCI: Fix 64GT/s effective data rate calculation (git-fixes). - PCI: Only override AMD USB controller if required (git-fixes). - PCI/AER: Decode Requester ID when no error info found (git-fixes). - media: ddbridge: fix an error code problem in ddb_probe (git-fixes). - mmc: mmc_spi: remove custom DMA mapped buffers (git-fixes). - mmc: core: Use mrq.sbc in close-ended ffu (git-fixes). - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (git-fixes). - pstore/ram: Fix crash when setting number of cpus to an odd number (git-fixes). - PNP: ACPI: fix fortify warning (git-fixes). - regulator: core: Only increment use_count when enable_count changes (git-fixes). - PM: core: Remove unnecessary (void *) conversions (git-fixes). - serial: 8250: Remove serial_rs485 sanitization from em485 (git-fixes). - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes). - commit 9894050 - tomoyo: fix UAF write bug in tomoyo_write_control() (git-fixes). - wifi: nl80211: reject iftype change with mesh ID change (git-fixes). - usb: dwc3: gadget: Don't disconnect if not started (git-fixes). - wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes). - usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes). - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK (git-fixes). - spi: sh-msiof: avoid integer overflow in constants (git-fixes). - wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes). - wifi: cfg80211: fix missing interfaces when dumping (git-fixes). - usb: dwc3: gadget: Queue PM runtime idle on disconnect event (git-fixes). - usb: dwc3: gadget: Handle EP0 request dequeuing properly (git-fixes). - usb: hub: Replace hardcoded quirk value with BIT() macro (git-fixes). - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE (git-fixes). - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 (git-fixes). - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (git-fixes). - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (git-fixes). - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes). - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (git-fixes). - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes). - wifi: rt2x00: restart beacon queue when hardware reset (git-fixes). - wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes). - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes). - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (git-fixes). - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API (git-fixes). - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect (git-fixes). - commit 8b4f9a3 - usb: dwc3: gadget: Ignore End Transfer delay on teardown (git-fixes). - Refresh patches.suse/usb-dwc3-gadget-Add-1ms-delay-after-end-transfer-com.patch. - commit 251cd08 - Update patch reference for input fix (CVE-2021-46932 bsc#1220444) - commit e44e0b1 - powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1220250,CVE-2023-52451). - commit fdc7254 - serial: imx: fix tx statemachine deadlock (bsc#1220364 CVE-2023-52456). - commit cd9f92c - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457). - commit c82f528 - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Add some comments to stack representation (bsc#1220257 CVE-2023-52452). - Refresh patches.kabi/kABI-fix-bpf-Tighten-ptr_to_btf_id-checks.patch - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor logging improvement (bsc#1220257). - commit 7d03125 - btrfs: do not ASSERT() if the newly created subvolume already got read (bsc#1219126 CVE-2024-23850). - commit a2ac581 - btrfs: fix double free of anonymous device after snapshot creation failure (bsc#1219126 CVE-2024-23850). - commit 257a534 - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825 CVE-2024-26622). - commit c8e5b38 - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817 bsc#1218195). - commit 4032aa7 - netfilter: nf_tables: fix 64-bit load issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - commit e095cd0 - kabi: restore return type of dst_ops::gc() callback (CVE-2023-52340 bsc#1219295). - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340 bsc#1219295). - commit b8eec42 - tls: fix race between tx work scheduling and socket close (CVE-2024-26585 bsc#1220187). - commit 1306bff - selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - commit 8a833ce - bpf: Fix re-attachment branch in bpf_tracing_prog_attach (bsc#1220254 CVE-2024-26591). - commit fc948d3 - Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746). - commit c955133 - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746). - commit ee70608 - KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746). - commit 7f00c86 - power: supply: bq27xxx-i2c: Do not free non existing IRQ (git-fixes). - mmc: sdhci-xenon: add timeout for PHY init complete (git-fixes). - mmc: sdhci-xenon: fix PHY init clock stability (git-fixes). - mmc: core: Fix eMMC initialization with 1-bit bus connection (git-fixes). - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes). - mtd: spinand: gigadevice: Fix the get ecc status issue (git-fixes). - nouveau: fix function cast warnings (git-fixes). - media: ir_toy: fix a memleak in irtoy_tx (git-fixes). - media: rc: bpf attach/detach requires write permission (git-fixes). - mmc: slot-gpio: Allow non-sleeping GPIO ro (git-fixes). - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (git-fixes). - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet (git-fixes). - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected (git-fixes). - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (git-fixes). - PCI: Fix 64GT/s effective data rate calculation (git-fixes). - PCI: Only override AMD USB controller if required (git-fixes). - PCI/AER: Decode Requester ID when no error info found (git-fixes). - media: ddbridge: fix an error code problem in ddb_probe (git-fixes). - mmc: mmc_spi: remove custom DMA mapped buffers (git-fixes). - mmc: core: Use mrq.sbc in close-ended ffu (git-fixes). - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (git-fixes). - pstore/ram: Fix crash when setting number of cpus to an odd number (git-fixes). - PNP: ACPI: fix fortify warning (git-fixes). - regulator: core: Only increment use_count when enable_count changes (git-fixes). - PM: core: Remove unnecessary (void *) conversions (git-fixes). - serial: 8250: Remove serial_rs485 sanitization from em485 (git-fixes). - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes). - commit 9894050 - tomoyo: fix UAF write bug in tomoyo_write_control() (git-fixes). - wifi: nl80211: reject iftype change with mesh ID change (git-fixes). - usb: dwc3: gadget: Don't disconnect if not started (git-fixes). - wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes). - usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes). - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK (git-fixes). - spi: sh-msiof: avoid integer overflow in constants (git-fixes). - wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes). - wifi: cfg80211: fix missing interfaces when dumping (git-fixes). - usb: dwc3: gadget: Queue PM runtime idle on disconnect event (git-fixes). - usb: dwc3: gadget: Handle EP0 request dequeuing properly (git-fixes). - usb: hub: Replace hardcoded quirk value with BIT() macro (git-fixes). - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE (git-fixes). - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 (git-fixes). - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (git-fixes). - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (git-fixes). - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes). - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (git-fixes). - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes). - wifi: rt2x00: restart beacon queue when hardware reset (git-fixes). - wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes). - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes). - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (git-fixes). - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API (git-fixes). - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect (git-fixes). - commit 8b4f9a3 - usb: dwc3: gadget: Ignore End Transfer delay on teardown (git-fixes). - Refresh patches.suse/usb-dwc3-gadget-Add-1ms-delay-after-end-transfer-com.patch. - commit 251cd08 - Update patch reference for input fix (CVE-2021-46932 bsc#1220444) - commit e44e0b1 - powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1220250,CVE-2023-52451). - commit fdc7254 - serial: imx: fix tx statemachine deadlock (bsc#1220364 CVE-2023-52456). - commit cd9f92c - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457). - commit c82f528 - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Add some comments to stack representation (bsc#1220257 CVE-2023-52452). - Refresh patches.kabi/kABI-fix-bpf-Tighten-ptr_to_btf_id-checks.patch - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor logging improvement (bsc#1220257). - commit 7d03125 - btrfs: do not ASSERT() if the newly created subvolume already got read (bsc#1219126 CVE-2024-23850). - commit a2ac581 - btrfs: fix double free of anonymous device after snapshot creation failure (bsc#1219126 CVE-2024-23850). - commit 257a534 - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825 CVE-2024-26622). - commit c8e5b38 - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817 bsc#1218195). - commit 4032aa7 - netfilter: nf_tables: fix 64-bit load issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - commit e095cd0 - kabi: restore return type of dst_ops::gc() callback (CVE-2023-52340 bsc#1219295). - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340 bsc#1219295). - commit b8eec42 - tls: fix race between tx work scheduling and socket close (CVE-2024-26585 bsc#1220187). - commit 1306bff - selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - commit 8a833ce - bpf: Fix re-attachment branch in bpf_tracing_prog_attach (bsc#1220254 CVE-2024-26591). - commit fc948d3 - Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746). - commit c955133 - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746). - commit ee70608 - KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746). - commit 7f00c86 - blacklist.conf: add a couple of PCI git-fixes - commit 37743ca - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829). - commit 539be83 - Refresh patches.kabi/kabi-allow-extra-bugints.patch. (bsc#1222952) - commit a04a1a9 - blacklist.conf: add a couple of PCI git-fixes - commit 37743ca - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829). - commit 539be83 - Refresh patches.kabi/kabi-allow-extra-bugints.patch. (bsc#1222952) - commit a04a1a9 - blacklist.conf: add a couple of PCI git-fixes - commit 37743ca - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829). - commit 539be83 - Refresh patches.kabi/kabi-allow-extra-bugints.patch. (bsc#1222952) - commit a04a1a9 - blacklist.conf: add a couple of PCI git-fixes - commit 37743ca - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829). - commit 539be83 - Refresh patches.kabi/kabi-allow-extra-bugints.patch. (bsc#1222952) - commit a04a1a9 - Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes). - commit 9ac913a - tracing: Show size of requested perf buffer (git-fixes). - commit f8d068b - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes). - commit 9ac913a - tracing: Show size of requested perf buffer (git-fixes). - commit f8d068b - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes). - commit 9ac913a - tracing: Show size of requested perf buffer (git-fixes). - commit f8d068b - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes). - commit 9ac913a - tracing: Show size of requested perf buffer (git-fixes). - commit f8d068b - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Update patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch (git-fixes bsc#1223858). - commit e50ed21 - Update patches.suse/efi-libstub-Implement-support-for-unaccepted-memory.patch (jsc#PED-7167, bsc#1224169). - commit a57eb93 - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Update patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch (git-fixes bsc#1223858). - commit e50ed21 - Update patches.suse/efi-libstub-Implement-support-for-unaccepted-memory.patch (jsc#PED-7167, bsc#1224169). - commit a57eb93 - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Update patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch (git-fixes bsc#1223858). - commit e50ed21 - Update patches.suse/efi-libstub-Implement-support-for-unaccepted-memory.patch (jsc#PED-7167, bsc#1224169). - commit a57eb93 - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Update patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch (git-fixes bsc#1223858). - commit e50ed21 - Update patches.suse/efi-libstub-Implement-support-for-unaccepted-memory.patch (jsc#PED-7167, bsc#1224169). - commit a57eb93 - smb: client: set correct id, uid and cruid for multiuser automounts (bsc#1223011, CVE-2024-26822). - commit 04cc660 - blacklist.conf: added fix that needs code not present - commit 9671fd4 - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756). - commit 7a7f193 - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6 netrom: Fix data-races around sysctl_net_busy_read (CVE-2024-27419 bsc#1224759) - commit b538410 - Refresh patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch This fixes following build warning: Changed build warnings: * **** 1 warnings ***** * comparison of distinct pointer types lacks a cast in ../kernel/dma/swiotlb.c in swiotlb_do_find_slots (from ../include/linux/minmax.h) In file included from ../include/linux/kernel.h:17:0, ../kernel/dma/swiotlb.c: In function 'swiotlb_do_find_slots': ../include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast ../include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' ../include/linux/minmax.h:36:24: note: in expansion of macro '__safe_cmp' ../include/linux/minmax.h:52:19: note: in expansion of macro '__careful_cmp' ../kernel/dma/swiotlb.c:648:12: note: in expansion of macro 'max' - commit a52b0ca - bpf: remove unnecessary prune and jump points (bsc#1225756). - bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756). - bpf: decouple prune and jump points (bsc#1225756). - commit 574a67d - cifs: fix underflow in parse_server_interfaces() (bsc#1223084, CVE-2024-26828). - commit cade548 - Update patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch (git-fixes bsc#1223675 CVE-2024-269355). Adding the CVE references. - commit 2df316d - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548) - commit b006eef - smb: client: fix potential deadlock when releasing mids (bsc#1224020, bsc#1225548, CVE-2023-52757). - commit edc36f8 - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224020, bsc#1224549, CVE-2024-35998). - commit fbb4c17 - vhost-vdpa: fix use after free in vhost_vdpa_probe() (CVE-2023-52795 bsc#1225085). - commit 423f910 - bpf: Protect against int overflow for stack access size (bsc#1224488 CVE-2024-35905). - commit 1edb341 - kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756). - commit b5b7cd0 - Update references - commit 006ab15 - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921 bsc#1223138). - commit fb20c1d - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938). - commit 38f788d - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575 CVE-2024-35976). - commit bc0a82d - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138). - commit 68cb9bf - usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924 bsc#1224657). - commit 578815c - smb: client: set correct id, uid and cruid for multiuser automounts (bsc#1223011, CVE-2024-26822). - commit 04cc660 - blacklist.conf: added fix that needs code not present - commit 9671fd4 - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756). - commit 7a7f193 - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6 netrom: Fix data-races around sysctl_net_busy_read (CVE-2024-27419 bsc#1224759) - commit b538410 - Refresh patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch This fixes following build warning: Changed build warnings: * **** 1 warnings ***** * comparison of distinct pointer types lacks a cast in ../kernel/dma/swiotlb.c in swiotlb_do_find_slots (from ../include/linux/minmax.h) In file included from ../include/linux/kernel.h:17:0, ../kernel/dma/swiotlb.c: In function 'swiotlb_do_find_slots': ../include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast ../include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' ../include/linux/minmax.h:36:24: note: in expansion of macro '__safe_cmp' ../include/linux/minmax.h:52:19: note: in expansion of macro '__careful_cmp' ../kernel/dma/swiotlb.c:648:12: note: in expansion of macro 'max' - commit a52b0ca - bpf: remove unnecessary prune and jump points (bsc#1225756). - bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756). - bpf: decouple prune and jump points (bsc#1225756). - commit 574a67d - cifs: fix underflow in parse_server_interfaces() (bsc#1223084, CVE-2024-26828). - commit cade548 - Update patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch (git-fixes bsc#1223675 CVE-2024-269355). Adding the CVE references. - commit 2df316d - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548) - commit b006eef - smb: client: fix potential deadlock when releasing mids (bsc#1224020, bsc#1225548, CVE-2023-52757). - commit edc36f8 - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224020, bsc#1224549, CVE-2024-35998). - commit fbb4c17 - vhost-vdpa: fix use after free in vhost_vdpa_probe() (CVE-2023-52795 bsc#1225085). - commit 423f910 - bpf: Protect against int overflow for stack access size (bsc#1224488 CVE-2024-35905). - commit 1edb341 - kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756). - commit b5b7cd0 - Update references - commit 006ab15 - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921 bsc#1223138). - commit fb20c1d - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938). - commit 38f788d - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575 CVE-2024-35976). - commit bc0a82d - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138). - commit 68cb9bf - usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924 bsc#1224657). - commit 578815c - smb: client: set correct id, uid and cruid for multiuser automounts (bsc#1223011, CVE-2024-26822). - commit 04cc660 - blacklist.conf: added fix that needs code not present - commit 9671fd4 - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756). - commit 7a7f193 - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6 netrom: Fix data-races around sysctl_net_busy_read (CVE-2024-27419 bsc#1224759) - commit b538410 - Refresh patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch This fixes following build warning: Changed build warnings: * **** 1 warnings ***** * comparison of distinct pointer types lacks a cast in ../kernel/dma/swiotlb.c in swiotlb_do_find_slots (from ../include/linux/minmax.h) In file included from ../include/linux/kernel.h:17:0, ../kernel/dma/swiotlb.c: In function 'swiotlb_do_find_slots': ../include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast ../include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' ../include/linux/minmax.h:36:24: note: in expansion of macro '__safe_cmp' ../include/linux/minmax.h:52:19: note: in expansion of macro '__careful_cmp' ../kernel/dma/swiotlb.c:648:12: note: in expansion of macro 'max' - commit a52b0ca - bpf: remove unnecessary prune and jump points (bsc#1225756). - bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756). - bpf: decouple prune and jump points (bsc#1225756). - commit 574a67d - cifs: fix underflow in parse_server_interfaces() (bsc#1223084, CVE-2024-26828). - commit cade548 - Update patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch (git-fixes bsc#1223675 CVE-2024-269355). Adding the CVE references. - commit 2df316d - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548) - commit b006eef - smb: client: fix potential deadlock when releasing mids (bsc#1224020, bsc#1225548, CVE-2023-52757). - commit edc36f8 - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224020, bsc#1224549, CVE-2024-35998). - commit fbb4c17 - vhost-vdpa: fix use after free in vhost_vdpa_probe() (CVE-2023-52795 bsc#1225085). - commit 423f910 - bpf: Protect against int overflow for stack access size (bsc#1224488 CVE-2024-35905). - commit 1edb341 - kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756). - commit b5b7cd0 - Update references - commit 006ab15 - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921 bsc#1223138). - commit fb20c1d - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938). - commit 38f788d - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575 CVE-2024-35976). - commit bc0a82d - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138). - commit 68cb9bf - usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924 bsc#1224657). - commit 578815c - smb: client: set correct id, uid and cruid for multiuser automounts (bsc#1223011, CVE-2024-26822). - commit 04cc660 - blacklist.conf: added fix that needs code not present - commit 9671fd4 - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756). - commit 7a7f193 - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6 netrom: Fix data-races around sysctl_net_busy_read (CVE-2024-27419 bsc#1224759) - commit b538410 - Refresh patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch This fixes following build warning: Changed build warnings: * **** 1 warnings ***** * comparison of distinct pointer types lacks a cast in ../kernel/dma/swiotlb.c in swiotlb_do_find_slots (from ../include/linux/minmax.h) In file included from ../include/linux/kernel.h:17:0, ../kernel/dma/swiotlb.c: In function 'swiotlb_do_find_slots': ../include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast ../include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' ../include/linux/minmax.h:36:24: note: in expansion of macro '__safe_cmp' ../include/linux/minmax.h:52:19: note: in expansion of macro '__careful_cmp' ../kernel/dma/swiotlb.c:648:12: note: in expansion of macro 'max' - commit a52b0ca - bpf: remove unnecessary prune and jump points (bsc#1225756). - bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756). - bpf: decouple prune and jump points (bsc#1225756). - commit 574a67d - cifs: fix underflow in parse_server_interfaces() (bsc#1223084, CVE-2024-26828). - commit cade548 - Update patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch (git-fixes bsc#1223675 CVE-2024-269355). Adding the CVE references. - commit 2df316d - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548) - commit b006eef - smb: client: fix potential deadlock when releasing mids (bsc#1224020, bsc#1225548, CVE-2023-52757). - commit edc36f8 - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224020, bsc#1224549, CVE-2024-35998). - commit fbb4c17 - vhost-vdpa: fix use after free in vhost_vdpa_probe() (CVE-2023-52795 bsc#1225085). - commit 423f910 - bpf: Protect against int overflow for stack access size (bsc#1224488 CVE-2024-35905). - commit 1edb341 - kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756). - commit b5b7cd0 - Update references - commit 006ab15 - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921 bsc#1223138). - commit fb20c1d - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938). - commit 38f788d - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575 CVE-2024-35976). - commit bc0a82d - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138). - commit 68cb9bf - usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924 bsc#1224657). - commit 578815c - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes) - commit 8395f97 - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes) - commit 7f0f7e9 - bnxt_re: Fix imm_data endianness (git-fixes) - commit c690ca2 - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes. - commit b60be3e - blacklist.conf: blocks list lots of 5.15-stable nfsd fixes. In the 5.15 stable series there was a full backport of nfsd. We don't won't all of that. So blacklist lots of patches that we don't want. - commit 0cfb63d - hfsplus: fix uninit-value in copy_name (git-fixes). - commit 383d5d6 - nvme-pci: add missing condition check for existence of mapped data (git-fixes). - nvme-pci: Fix the instructions for disabling power management (git-fixes). - nvmet-auth: fix nvmet_auth hash error handling (git-fixes). - nvme: fixup comment for nvme RDMA Provider Type (git-fixes). - nvmet: always initialize cqe.result (git-fixes). - nvme: avoid double free special payload (git-fixes). - nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes). - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes). - nvme-multipath: find NUMA path only for online numa-node (git-fixes). - nvme-auth: allow mixing of secret and hash lengths (git-fixes). - nvme-auth: use transformed key size to create resp (git-fixes). - nvme-auth: alloc nvme_dhchap_key as single buffer (git-fixes). - commit 3284c90 - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857). - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857). - scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857). - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857). - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857). - scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857). - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857). - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857). - commit 21ebef1 - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850). - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850). - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850). - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850). - scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850). - scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850). - scsi: qla2xxx: Complete command early within lock (bsc#1228850). - scsi: qla2xxx: Fix flash read failure (bsc#1228850). - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850). - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850). - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850). - scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850). - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850). - scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850). - scsi: qla2xxx: Indent help text (bsc#1228850). - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850). - scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850). - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850). - commit ce7acc0 - kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users. - commit b8cf562 - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808) - commit 8f44f81 - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729). - commit 02e87a9 - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869). - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869). - KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings (bsc#1194869). - KVM: PPC: Book3S HV: remove extraneous asterisk from rm_host_ipi_action() comment (bsc#1194869). - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting (bsc#1194869). - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST (bsc#1194869). - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots (bsc#1194869). - commit cc22863 - ASoC: topology: Fix route memory corruption (CVE-2024-41069 bsc#1228644). - commit 586db1a - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756 CVE-2024-42161). - commit 8359d86 - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494). - commit 81484ec - ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes). - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes). - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes). - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes). - drm/nouveau: prime: fix refcount underflow (git-fixes). - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera (stable-fixes). - ALSA: usb-audio: Move HD Webcam quirk to the right place (git-fixes). - ALSA: usb-audio: Fix microphone sound on HD webcam (stable-fixes). - drm/amd/display: Check for NULL pointer (stable-fixes). - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes). - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 (git-fixes). - drm/etnaviv: don't block scheduler when GPU is still active (stable-fixes). - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() (git-fixes). - drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format (stable-fixes). - commit b91fd99 - Drop doubly defined References in sound patches - commit 46ad1df - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes). - commit df5839d - Refresh patches.kabi/xhci-restre-deleted-trb-fields-for-tracing.patch. Fix KABI restoration also in tracing event message format. - commit 3bd4a56 - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes) - commit 8395f97 - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes) - commit 7f0f7e9 - bnxt_re: Fix imm_data endianness (git-fixes) - commit c690ca2 - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes. - commit b60be3e - blacklist.conf: blocks list lots of 5.15-stable nfsd fixes. In the 5.15 stable series there was a full backport of nfsd. We don't won't all of that. So blacklist lots of patches that we don't want. - commit 0cfb63d - hfsplus: fix uninit-value in copy_name (git-fixes). - commit 383d5d6 - nvme-pci: add missing condition check for existence of mapped data (git-fixes). - nvme-pci: Fix the instructions for disabling power management (git-fixes). - nvmet-auth: fix nvmet_auth hash error handling (git-fixes). - nvme: fixup comment for nvme RDMA Provider Type (git-fixes). - nvmet: always initialize cqe.result (git-fixes). - nvme: avoid double free special payload (git-fixes). - nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes). - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes). - nvme-multipath: find NUMA path only for online numa-node (git-fixes). - nvme-auth: allow mixing of secret and hash lengths (git-fixes). - nvme-auth: use transformed key size to create resp (git-fixes). - nvme-auth: alloc nvme_dhchap_key as single buffer (git-fixes). - commit 3284c90 - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857). - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857). - scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857). - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857). - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857). - scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857). - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857). - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857). - commit 21ebef1 - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850). - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850). - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850). - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850). - scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850). - scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850). - scsi: qla2xxx: Complete command early within lock (bsc#1228850). - scsi: qla2xxx: Fix flash read failure (bsc#1228850). - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850). - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850). - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850). - scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850). - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850). - scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850). - scsi: qla2xxx: Indent help text (bsc#1228850). - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850). - scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850). - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850). - commit ce7acc0 - kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users. - commit b8cf562 - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808) - commit 8f44f81 - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729). - commit 02e87a9 - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869). - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869). - KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings (bsc#1194869). - KVM: PPC: Book3S HV: remove extraneous asterisk from rm_host_ipi_action() comment (bsc#1194869). - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting (bsc#1194869). - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST (bsc#1194869). - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots (bsc#1194869). - commit cc22863 - ASoC: topology: Fix route memory corruption (CVE-2024-41069 bsc#1228644). - commit 586db1a - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756 CVE-2024-42161). - commit 8359d86 - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494). - commit 81484ec - ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes). - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes). - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes). - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes). - drm/nouveau: prime: fix refcount underflow (git-fixes). - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera (stable-fixes). - ALSA: usb-audio: Move HD Webcam quirk to the right place (git-fixes). - ALSA: usb-audio: Fix microphone sound on HD webcam (stable-fixes). - drm/amd/display: Check for NULL pointer (stable-fixes). - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes). - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 (git-fixes). - drm/etnaviv: don't block scheduler when GPU is still active (stable-fixes). - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() (git-fixes). - drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format (stable-fixes). - commit b91fd99 - Drop doubly defined References in sound patches - commit 46ad1df - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes). - commit df5839d - Refresh patches.kabi/xhci-restre-deleted-trb-fields-for-tracing.patch. Fix KABI restoration also in tracing event message format. - commit 3bd4a56 - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes) - commit 8395f97 - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes) - commit 7f0f7e9 - bnxt_re: Fix imm_data endianness (git-fixes) - commit c690ca2 - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes. - commit b60be3e - blacklist.conf: blocks list lots of 5.15-stable nfsd fixes. In the 5.15 stable series there was a full backport of nfsd. We don't won't all of that. So blacklist lots of patches that we don't want. - commit 0cfb63d - hfsplus: fix uninit-value in copy_name (git-fixes). - commit 383d5d6 - nvme-pci: add missing condition check for existence of mapped data (git-fixes). - nvme-pci: Fix the instructions for disabling power management (git-fixes). - nvmet-auth: fix nvmet_auth hash error handling (git-fixes). - nvme: fixup comment for nvme RDMA Provider Type (git-fixes). - nvmet: always initialize cqe.result (git-fixes). - nvme: avoid double free special payload (git-fixes). - nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes). - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes). - nvme-multipath: find NUMA path only for online numa-node (git-fixes). - nvme-auth: allow mixing of secret and hash lengths (git-fixes). - nvme-auth: use transformed key size to create resp (git-fixes). - nvme-auth: alloc nvme_dhchap_key as single buffer (git-fixes). - commit 3284c90 - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857). - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857). - scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857). - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857). - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857). - scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857). - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857). - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857). - commit 21ebef1 - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850). - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850). - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850). - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850). - scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850). - scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850). - scsi: qla2xxx: Complete command early within lock (bsc#1228850). - scsi: qla2xxx: Fix flash read failure (bsc#1228850). - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850). - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850). - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850). - scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850). - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850). - scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850). - scsi: qla2xxx: Indent help text (bsc#1228850). - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850). - scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850). - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850). - commit ce7acc0 - kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users. - commit b8cf562 - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808) - commit 8f44f81 - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729). - commit 02e87a9 - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869). - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869). - KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings (bsc#1194869). - KVM: PPC: Book3S HV: remove extraneous asterisk from rm_host_ipi_action() comment (bsc#1194869). - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting (bsc#1194869). - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST (bsc#1194869). - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots (bsc#1194869). - commit cc22863 - ASoC: topology: Fix route memory corruption (CVE-2024-41069 bsc#1228644). - commit 586db1a - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756 CVE-2024-42161). - commit 8359d86 - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494). - commit 81484ec - ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes). - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes). - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes). - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes). - drm/nouveau: prime: fix refcount underflow (git-fixes). - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera (stable-fixes). - ALSA: usb-audio: Move HD Webcam quirk to the right place (git-fixes). - ALSA: usb-audio: Fix microphone sound on HD webcam (stable-fixes). - drm/amd/display: Check for NULL pointer (stable-fixes). - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes). - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 (git-fixes). - drm/etnaviv: don't block scheduler when GPU is still active (stable-fixes). - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() (git-fixes). - drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format (stable-fixes). - commit b91fd99 - Drop doubly defined References in sound patches - commit 46ad1df - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes). - commit df5839d - Refresh patches.kabi/xhci-restre-deleted-trb-fields-for-tracing.patch. Fix KABI restoration also in tracing event message format. - commit 3bd4a56 - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes) - commit 8395f97 - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes) - commit 7f0f7e9 - bnxt_re: Fix imm_data endianness (git-fixes) - commit c690ca2 - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes. - commit b60be3e - blacklist.conf: blocks list lots of 5.15-stable nfsd fixes. In the 5.15 stable series there was a full backport of nfsd. We don't won't all of that. So blacklist lots of patches that we don't want. - commit 0cfb63d - hfsplus: fix uninit-value in copy_name (git-fixes). - commit 383d5d6 - nvme-pci: add missing condition check for existence of mapped data (git-fixes). - nvme-pci: Fix the instructions for disabling power management (git-fixes). - nvmet-auth: fix nvmet_auth hash error handling (git-fixes). - nvme: fixup comment for nvme RDMA Provider Type (git-fixes). - nvmet: always initialize cqe.result (git-fixes). - nvme: avoid double free special payload (git-fixes). - nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes). - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes). - nvme-multipath: find NUMA path only for online numa-node (git-fixes). - nvme-auth: allow mixing of secret and hash lengths (git-fixes). - nvme-auth: use transformed key size to create resp (git-fixes). - nvme-auth: alloc nvme_dhchap_key as single buffer (git-fixes). - commit 3284c90 - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857). - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857). - scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857). - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857). - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857). - scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857). - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857). - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857). - commit 21ebef1 - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850). - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850). - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850). - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850). - scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850). - scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850). - scsi: qla2xxx: Complete command early within lock (bsc#1228850). - scsi: qla2xxx: Fix flash read failure (bsc#1228850). - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850). - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850). - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850). - scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850). - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850). - scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850). - scsi: qla2xxx: Indent help text (bsc#1228850). - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850). - scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850). - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850). - commit ce7acc0 - kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users. - commit b8cf562 - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808) - commit 8f44f81 - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729). - commit 02e87a9 - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869). - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869). - KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings (bsc#1194869). - KVM: PPC: Book3S HV: remove extraneous asterisk from rm_host_ipi_action() comment (bsc#1194869). - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting (bsc#1194869). - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST (bsc#1194869). - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots (bsc#1194869). - commit cc22863 - ASoC: topology: Fix route memory corruption (CVE-2024-41069 bsc#1228644). - commit 586db1a - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756 CVE-2024-42161). - commit 8359d86 - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494). - commit 81484ec - ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes). - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes). - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes). - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes). - drm/nouveau: prime: fix refcount underflow (git-fixes). - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera (stable-fixes). - ALSA: usb-audio: Move HD Webcam quirk to the right place (git-fixes). - ALSA: usb-audio: Fix microphone sound on HD webcam (stable-fixes). - drm/amd/display: Check for NULL pointer (stable-fixes). - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes). - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 (git-fixes). - drm/etnaviv: don't block scheduler when GPU is still active (stable-fixes). - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() (git-fixes). - drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format (stable-fixes). - commit b91fd99 - Drop doubly defined References in sound patches - commit 46ad1df - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes). - commit df5839d - Refresh patches.kabi/xhci-restre-deleted-trb-fields-for-tracing.patch. Fix KABI restoration also in tracing event message format. - commit 3bd4a56 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()" This reverts commit d77caa16c18115f0c470ecf5cdd3cdb6f9865aeb. - commit b3f74b7 - Revert "mm, kmsan: fix infinite recursion due to RCU critical section" This reverts commit 1702784a5db6b26695f0bc2c6b0cbe973db5c0f3. - commit e83daef - Revert "mm/sparsemem: fix race in accessing memory_section->usage" This reverts commit 606bd9b8228bfe004cf6ab930ffb673a535e3c55. - commit 12b6dd4 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()" This reverts commit d77caa16c18115f0c470ecf5cdd3cdb6f9865aeb. - commit b3f74b7 - Revert "mm, kmsan: fix infinite recursion due to RCU critical section" This reverts commit 1702784a5db6b26695f0bc2c6b0cbe973db5c0f3. - commit e83daef - Revert "mm/sparsemem: fix race in accessing memory_section->usage" This reverts commit 606bd9b8228bfe004cf6ab930ffb673a535e3c55. - commit 12b6dd4 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()" This reverts commit d77caa16c18115f0c470ecf5cdd3cdb6f9865aeb. - commit b3f74b7 - Revert "mm, kmsan: fix infinite recursion due to RCU critical section" This reverts commit 1702784a5db6b26695f0bc2c6b0cbe973db5c0f3. - commit e83daef - Revert "mm/sparsemem: fix race in accessing memory_section->usage" This reverts commit 606bd9b8228bfe004cf6ab930ffb673a535e3c55. - commit 12b6dd4 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()" This reverts commit d77caa16c18115f0c470ecf5cdd3cdb6f9865aeb. - commit b3f74b7 - Revert "mm, kmsan: fix infinite recursion due to RCU critical section" This reverts commit 1702784a5db6b26695f0bc2c6b0cbe973db5c0f3. - commit e83daef - Revert "mm/sparsemem: fix race in accessing memory_section->usage" This reverts commit 606bd9b8228bfe004cf6ab930ffb673a535e3c55. - commit 12b6dd4 - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223). - commit b81ed11 - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848). - commit 04f7eb0 - nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769). - commit 8283ab9 - arm64: acpi: Move get_cpu_for_acpi_id() to a header (bsc#1231120 CVE-2024-46822) - commit fb3eb08 - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822) - commit ec589da - tracing: Fix overflow in get_free_elt() (git-fixes CVE-2024-43890 bsc#1229764). - commit 867d207 - tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes). - commit 1959490 - Refresh patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch. - commit ba454fb - kthread: Fix task state in kthread worker if being frozen (bsc#1231146). - commit 2398294 - nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082). - nvme: change __nvme_submit_sync_cmd() calling conventions (bsc#1228620 CVE-2024-41082). Refresh: - patches.suse/nvme-auth-retry-command-if-DNR-bit-is-not-set.patch - commit 4effcb1 - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes). - mailbox: rockchip: fix a typo in module autoloading (git-fixes). - firmware_loader: Block path traversal (git-fixes). - iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes). - iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes). - iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes). - iio: adc: ad7606: fix oversampling gpio array (git-fixes). - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes). - Input: ilitek_ts_i2c - add report id message validation (git-fixes). - Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes). - media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes). - media: venus: fix use after free bug in venus_remove due to race condition (git-fixes). - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes). - Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" (stable-fixes). - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes). - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes). - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes). - apparmor: fix possible NULL pointer dereference (stable-fixes). - commit 0120ced - tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes). - tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes). - USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes). - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes). - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - USB: serial: kobil_sct: restore initial terminal settings (git-fixes). - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes). - rtc: at91sam9: fix OF node leak in probe() error path (git-fixes). - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes). - pinctrl: single: fix missing error code in pcs_probe() (git-fixes). - PCI: xilinx-nwl: Fix register misspelling (git-fixes). - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes). - xz: cleanup CRC32 edits from 2018 (git-fixes). - pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes). - thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes). - commit b15f073 - usb: dwc3: st: fix probed platform device ref count on probe error path (bsc#1230507 CVE-2024-46674). - commit ffd5693 - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - commit e8a76c0 - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - commit 0627e93 - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - commit 901f16d - usb: xhci: fix loss of data on Cadence xHC (git-fixes). - commit 1b1ffa2 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830 bsc#1231116). - commit 5d5e02e - cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181). - ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180). - commit 47c22dc - usbnet: fix cyclical race on disconnect with work queue (git-fixes). - Refresh patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch. - commit 1cf5de8 - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223). - commit b81ed11 - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848). - commit 04f7eb0 - nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769). - commit 8283ab9 - arm64: acpi: Move get_cpu_for_acpi_id() to a header (bsc#1231120 CVE-2024-46822) - commit fb3eb08 - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822) - commit ec589da - tracing: Fix overflow in get_free_elt() (git-fixes CVE-2024-43890 bsc#1229764). - commit 867d207 - tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes). - commit 1959490 - Refresh patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch. - commit ba454fb - kthread: Fix task state in kthread worker if being frozen (bsc#1231146). - commit 2398294 - nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082). - nvme: change __nvme_submit_sync_cmd() calling conventions (bsc#1228620 CVE-2024-41082). Refresh: - patches.suse/nvme-auth-retry-command-if-DNR-bit-is-not-set.patch - commit 4effcb1 - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes). - mailbox: rockchip: fix a typo in module autoloading (git-fixes). - firmware_loader: Block path traversal (git-fixes). - iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes). - iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes). - iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes). - iio: adc: ad7606: fix oversampling gpio array (git-fixes). - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes). - Input: ilitek_ts_i2c - add report id message validation (git-fixes). - Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes). - media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes). - media: venus: fix use after free bug in venus_remove due to race condition (git-fixes). - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes). - Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" (stable-fixes). - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes). - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes). - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes). - apparmor: fix possible NULL pointer dereference (stable-fixes). - commit 0120ced - tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes). - tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes). - USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes). - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes). - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - USB: serial: kobil_sct: restore initial terminal settings (git-fixes). - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes). - rtc: at91sam9: fix OF node leak in probe() error path (git-fixes). - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes). - pinctrl: single: fix missing error code in pcs_probe() (git-fixes). - PCI: xilinx-nwl: Fix register misspelling (git-fixes). - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes). - xz: cleanup CRC32 edits from 2018 (git-fixes). - pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes). - thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes). - commit b15f073 - usb: dwc3: st: fix probed platform device ref count on probe error path (bsc#1230507 CVE-2024-46674). - commit ffd5693 - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - commit e8a76c0 - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - commit 0627e93 - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - commit 901f16d - usb: xhci: fix loss of data on Cadence xHC (git-fixes). - commit 1b1ffa2 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830 bsc#1231116). - commit 5d5e02e - cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181). - ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180). - commit 47c22dc - usbnet: fix cyclical race on disconnect with work queue (git-fixes). - Refresh patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch. - commit 1cf5de8 - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223). - commit b81ed11 - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848). - commit 04f7eb0 - nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769). - commit 8283ab9 - arm64: acpi: Move get_cpu_for_acpi_id() to a header (bsc#1231120 CVE-2024-46822) - commit fb3eb08 - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822) - commit ec589da - tracing: Fix overflow in get_free_elt() (git-fixes CVE-2024-43890 bsc#1229764). - commit 867d207 - tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes). - commit 1959490 - Refresh patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch. - commit ba454fb - kthread: Fix task state in kthread worker if being frozen (bsc#1231146). - commit 2398294 - nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082). - nvme: change __nvme_submit_sync_cmd() calling conventions (bsc#1228620 CVE-2024-41082). Refresh: - patches.suse/nvme-auth-retry-command-if-DNR-bit-is-not-set.patch - commit 4effcb1 - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes). - mailbox: rockchip: fix a typo in module autoloading (git-fixes). - firmware_loader: Block path traversal (git-fixes). - iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes). - iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes). - iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes). - iio: adc: ad7606: fix oversampling gpio array (git-fixes). - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes). - Input: ilitek_ts_i2c - add report id message validation (git-fixes). - Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes). - media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes). - media: venus: fix use after free bug in venus_remove due to race condition (git-fixes). - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes). - Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" (stable-fixes). - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes). - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes). - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes). - apparmor: fix possible NULL pointer dereference (stable-fixes). - commit 0120ced - tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes). - tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes). - USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes). - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes). - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - USB: serial: kobil_sct: restore initial terminal settings (git-fixes). - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes). - rtc: at91sam9: fix OF node leak in probe() error path (git-fixes). - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes). - pinctrl: single: fix missing error code in pcs_probe() (git-fixes). - PCI: xilinx-nwl: Fix register misspelling (git-fixes). - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes). - xz: cleanup CRC32 edits from 2018 (git-fixes). - pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes). - thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes). - commit b15f073 - usb: dwc3: st: fix probed platform device ref count on probe error path (bsc#1230507 CVE-2024-46674). - commit ffd5693 - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - commit e8a76c0 - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - commit 0627e93 - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - commit 901f16d - usb: xhci: fix loss of data on Cadence xHC (git-fixes). - commit 1b1ffa2 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830 bsc#1231116). - commit 5d5e02e - cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181). - ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180). - commit 47c22dc - usbnet: fix cyclical race on disconnect with work queue (git-fixes). - Refresh patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch. - commit 1cf5de8 - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223). - commit b81ed11 - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848). - commit 04f7eb0 - nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769). - commit 8283ab9 - arm64: acpi: Move get_cpu_for_acpi_id() to a header (bsc#1231120 CVE-2024-46822) - commit fb3eb08 - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822) - commit ec589da - tracing: Fix overflow in get_free_elt() (git-fixes CVE-2024-43890 bsc#1229764). - commit 867d207 - tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes). - commit 1959490 - Refresh patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch. - commit ba454fb - kthread: Fix task state in kthread worker if being frozen (bsc#1231146). - commit 2398294 - nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082). - nvme: change __nvme_submit_sync_cmd() calling conventions (bsc#1228620 CVE-2024-41082). Refresh: - patches.suse/nvme-auth-retry-command-if-DNR-bit-is-not-set.patch - commit 4effcb1 - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes). - mailbox: rockchip: fix a typo in module autoloading (git-fixes). - firmware_loader: Block path traversal (git-fixes). - iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes). - iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes). - iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes). - iio: adc: ad7606: fix oversampling gpio array (git-fixes). - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes). - Input: ilitek_ts_i2c - add report id message validation (git-fixes). - Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes). - media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes). - media: venus: fix use after free bug in venus_remove due to race condition (git-fixes). - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes). - Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" (stable-fixes). - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes). - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes). - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes). - apparmor: fix possible NULL pointer dereference (stable-fixes). - commit 0120ced - tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes). - tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes). - USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes). - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes). - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - USB: serial: kobil_sct: restore initial terminal settings (git-fixes). - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes). - rtc: at91sam9: fix OF node leak in probe() error path (git-fixes). - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes). - pinctrl: single: fix missing error code in pcs_probe() (git-fixes). - PCI: xilinx-nwl: Fix register misspelling (git-fixes). - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes). - xz: cleanup CRC32 edits from 2018 (git-fixes). - pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes). - thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes). - commit b15f073 - usb: dwc3: st: fix probed platform device ref count on probe error path (bsc#1230507 CVE-2024-46674). - commit ffd5693 - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - commit e8a76c0 - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - commit 0627e93 - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - commit 901f16d - usb: xhci: fix loss of data on Cadence xHC (git-fixes). - commit 1b1ffa2 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830 bsc#1231116). - commit 5d5e02e - cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181). - ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180). - commit 47c22dc - usbnet: fix cyclical race on disconnect with work queue (git-fixes). - Refresh patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch. - commit 1cf5de8 - net/mlx5: Drain health before unregistering devlink (git-fixes). - Refresh patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch. - commit fa0f96d - vdpa/mlx5: preserve CVQ vringh index (git-fixes). - Refresh patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch. - commit dbac474 - idpf: distinguish vports by the dev_port attribute (git-fixes). - Refresh patches.suse/0001-idpf-extend-tx-watchdog-timeout.patch. - commit 3fa63a5 - net: ena: Fix potential sign extension issue (git-fixes). - Refresh patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch. - commit f3d6416 - net/mlx5: Unregister notifier on eswitch init failure (git-fixes). - igb: Fix not clearing TimeSync interrupts for 82580 (git-fixes). - net/mlx5e: Take state lock during tx timeout reporter (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer (git-fixes). - iavf: in iavf_down, disable queues when removing the driver (git-fixes). - commit c073e57 - powerpc/kexec: Fix return of uninitialized variable (bsc#1194869). - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869). - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869). - powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869). - powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869). - powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869). - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869). - powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869). - powerpc/asm: Remove UPD_CONSTR after GCC 4.9 removal (bsc#1194869). - powerpc: remove GCC version check for UPD_CONSTR (bsc#1194869). - commit 2d82b73 - arm64/sve: Discard stale CPU state when handling SVE traps (git-fixes) - commit 019ef42 - arm64: smccc: replace custom COUNT_ARGS() & CONCATENATE() (git-fixes) - commit e8b197c - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes) - commit 49b56be - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes) - commit 834680b - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes) - commit 11b60ab - kernel.h: split out COUNT_ARGS() and CONCATENATE() to args.h (git-fixes) - commit ce86139 - USB: serial: io_edgeport: fix use after free in debug printk (CVE-2024-50267 bsc#1233456) - commit 5a7c927 - kABI: Restore exported __arm_smccc_sve_check (git-fixes) - commit c8e82c2 - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (git-fixes) Refresh patches.suse/arm64-probes-Fix-uprobes-for-big-endian-kernels.patch. - commit 8fb43aa - can: j1939: j1939_session_new(): fix skb reference counting (git-fixes). - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes). - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes). - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes). - HID: wacom: fix when get product name maybe null pointer (git-fixes). - watchdog: rti: of: honor timeout-sec property (git-fixes). - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes). - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes). - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values (git-fixes). - commit 6f2f0c6 - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104 bsc#1234025). - commit 1c41c2f - idpf: fix UAFs when destroying the queues (CVE-2024-44932 bsc#1229808). - idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964 bsc#1230220). - commit 4316b61 - vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110 bsc#1234085). - commit d161a67 - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800 bsc#1230827). - commit 4fa3f93 - net/mlx5: Drain health before unregistering devlink (git-fixes). - Refresh patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch. - commit fa0f96d - vdpa/mlx5: preserve CVQ vringh index (git-fixes). - Refresh patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch. - commit dbac474 - idpf: distinguish vports by the dev_port attribute (git-fixes). - Refresh patches.suse/0001-idpf-extend-tx-watchdog-timeout.patch. - commit 3fa63a5 - net: ena: Fix potential sign extension issue (git-fixes). - Refresh patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch. - commit f3d6416 - net/mlx5: Unregister notifier on eswitch init failure (git-fixes). - igb: Fix not clearing TimeSync interrupts for 82580 (git-fixes). - net/mlx5e: Take state lock during tx timeout reporter (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer (git-fixes). - iavf: in iavf_down, disable queues when removing the driver (git-fixes). - commit c073e57 - powerpc/kexec: Fix return of uninitialized variable (bsc#1194869). - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869). - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869). - powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869). - powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869). - powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869). - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869). - powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869). - powerpc/asm: Remove UPD_CONSTR after GCC 4.9 removal (bsc#1194869). - powerpc: remove GCC version check for UPD_CONSTR (bsc#1194869). - commit 2d82b73 - arm64/sve: Discard stale CPU state when handling SVE traps (git-fixes) - commit 019ef42 - arm64: smccc: replace custom COUNT_ARGS() & CONCATENATE() (git-fixes) - commit e8b197c - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes) - commit 49b56be - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes) - commit 834680b - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes) - commit 11b60ab - kernel.h: split out COUNT_ARGS() and CONCATENATE() to args.h (git-fixes) - commit ce86139 - USB: serial: io_edgeport: fix use after free in debug printk (CVE-2024-50267 bsc#1233456) - commit 5a7c927 - kABI: Restore exported __arm_smccc_sve_check (git-fixes) - commit c8e82c2 - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (git-fixes) Refresh patches.suse/arm64-probes-Fix-uprobes-for-big-endian-kernels.patch. - commit 8fb43aa - can: j1939: j1939_session_new(): fix skb reference counting (git-fixes). - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes). - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes). - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes). - HID: wacom: fix when get product name maybe null pointer (git-fixes). - watchdog: rti: of: honor timeout-sec property (git-fixes). - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes). - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes). - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values (git-fixes). - commit 6f2f0c6 - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104 bsc#1234025). - commit 1c41c2f - idpf: fix UAFs when destroying the queues (CVE-2024-44932 bsc#1229808). - idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964 bsc#1230220). - commit 4316b61 - vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110 bsc#1234085). - commit d161a67 - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800 bsc#1230827). - commit 4fa3f93 - net/mlx5: Drain health before unregistering devlink (git-fixes). - Refresh patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch. - commit fa0f96d - vdpa/mlx5: preserve CVQ vringh index (git-fixes). - Refresh patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch. - commit dbac474 - idpf: distinguish vports by the dev_port attribute (git-fixes). - Refresh patches.suse/0001-idpf-extend-tx-watchdog-timeout.patch. - commit 3fa63a5 - net: ena: Fix potential sign extension issue (git-fixes). - Refresh patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch. - commit f3d6416 - net/mlx5: Unregister notifier on eswitch init failure (git-fixes). - igb: Fix not clearing TimeSync interrupts for 82580 (git-fixes). - net/mlx5e: Take state lock during tx timeout reporter (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer (git-fixes). - iavf: in iavf_down, disable queues when removing the driver (git-fixes). - commit c073e57 - powerpc/kexec: Fix return of uninitialized variable (bsc#1194869). - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869). - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869). - powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869). - powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869). - powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869). - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869). - powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869). - powerpc/asm: Remove UPD_CONSTR after GCC 4.9 removal (bsc#1194869). - powerpc: remove GCC version check for UPD_CONSTR (bsc#1194869). - commit 2d82b73 - arm64/sve: Discard stale CPU state when handling SVE traps (git-fixes) - commit 019ef42 - arm64: smccc: replace custom COUNT_ARGS() & CONCATENATE() (git-fixes) - commit e8b197c - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes) - commit 49b56be - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes) - commit 834680b - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes) - commit 11b60ab - kernel.h: split out COUNT_ARGS() and CONCATENATE() to args.h (git-fixes) - commit ce86139 - USB: serial: io_edgeport: fix use after free in debug printk (CVE-2024-50267 bsc#1233456) - commit 5a7c927 - kABI: Restore exported __arm_smccc_sve_check (git-fixes) - commit c8e82c2 - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (git-fixes) Refresh patches.suse/arm64-probes-Fix-uprobes-for-big-endian-kernels.patch. - commit 8fb43aa - can: j1939: j1939_session_new(): fix skb reference counting (git-fixes). - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes). - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes). - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes). - HID: wacom: fix when get product name maybe null pointer (git-fixes). - watchdog: rti: of: honor timeout-sec property (git-fixes). - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes). - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes). - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values (git-fixes). - commit 6f2f0c6 - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104 bsc#1234025). - commit 1c41c2f - idpf: fix UAFs when destroying the queues (CVE-2024-44932 bsc#1229808). - idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964 bsc#1230220). - commit 4316b61 - vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110 bsc#1234085). - commit d161a67 - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800 bsc#1230827). - commit 4fa3f93 - net/mlx5: Drain health before unregistering devlink (git-fixes). - Refresh patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch. - commit fa0f96d - vdpa/mlx5: preserve CVQ vringh index (git-fixes). - Refresh patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch. - commit dbac474 - idpf: distinguish vports by the dev_port attribute (git-fixes). - Refresh patches.suse/0001-idpf-extend-tx-watchdog-timeout.patch. - commit 3fa63a5 - net: ena: Fix potential sign extension issue (git-fixes). - Refresh patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch. - commit f3d6416 - net/mlx5: Unregister notifier on eswitch init failure (git-fixes). - igb: Fix not clearing TimeSync interrupts for 82580 (git-fixes). - net/mlx5e: Take state lock during tx timeout reporter (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer (git-fixes). - iavf: in iavf_down, disable queues when removing the driver (git-fixes). - commit c073e57 - powerpc/kexec: Fix return of uninitialized variable (bsc#1194869). - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869). - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869). - powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869). - powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869). - powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869). - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869). - powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869). - powerpc/asm: Remove UPD_CONSTR after GCC 4.9 removal (bsc#1194869). - powerpc: remove GCC version check for UPD_CONSTR (bsc#1194869). - commit 2d82b73 - arm64/sve: Discard stale CPU state when handling SVE traps (git-fixes) - commit 019ef42 - arm64: smccc: replace custom COUNT_ARGS() & CONCATENATE() (git-fixes) - commit e8b197c - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes) - commit 49b56be - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes) - commit 834680b - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes) - commit 11b60ab - kernel.h: split out COUNT_ARGS() and CONCATENATE() to args.h (git-fixes) - commit ce86139 - USB: serial: io_edgeport: fix use after free in debug printk (CVE-2024-50267 bsc#1233456) - commit 5a7c927 - kABI: Restore exported __arm_smccc_sve_check (git-fixes) - commit c8e82c2 - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (git-fixes) Refresh patches.suse/arm64-probes-Fix-uprobes-for-big-endian-kernels.patch. - commit 8fb43aa - can: j1939: j1939_session_new(): fix skb reference counting (git-fixes). - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes). - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes). - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes). - HID: wacom: fix when get product name maybe null pointer (git-fixes). - watchdog: rti: of: honor timeout-sec property (git-fixes). - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes). - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes). - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values (git-fixes). - commit 6f2f0c6 - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104 bsc#1234025). - commit 1c41c2f - idpf: fix UAFs when destroying the queues (CVE-2024-44932 bsc#1229808). - idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964 bsc#1230220). - commit 4316b61 - vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110 bsc#1234085). - commit d161a67 - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800 bsc#1230827). - commit 4fa3f93 - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Remove iscsi_ibft (bsc#1157460) - Add the brd module, used by the LTP testsuite and tiny - Add tcp_diag, needed by openslp - Add qemu_fw_cfg needed by ignition (boo#1170069). - Add hardware-specific crc32c implementations (boo#1171065) - Add usbhid and hid-generic for USB input devices (boo#1167749) - Add vxlan (bsc#1171903) - Add cifs - Create the list of crypto modules dynamically, supersedes hardcoded list of crc32 implementations (boo#1177577) - Add wireguard (boo#1179225) - Add modules which got lost when migrating away from supported.conf (bsc#1182110): * am53c974 had a typo * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress - Also add vport-* modules for Open vSwitch - Add fuse (boo#1182507) - Add squashfs for kiwi installiso support (bsc#1182341) - Add nfsd for nfs server support (boo#1186363 bsc#1089118) - Add nls_utf8 module (boo#1190797) - Add quota modules (bsc#1196585) - Add nfs layout modules - Add binfmt_misc (boo#1196373) - Add _diag modules for included socket types (boo#1204042) - Add exfat (boo#1208822) - Do not build on s390 (bsc#1210729) - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - implements jsc#PED-2658 - renamed rpmlintrc to %{name}-rpmlintrc - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - implements jsc#PED-2658 - renamed rpmlintrc to %{name}-rpmlintrc - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - implements jsc#PED-2658 - renamed rpmlintrc to %{name}-rpmlintrc - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - renamed rpmlintrc to %{name}-rpmlintrc - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - renamed rpmlintrc to %{name}-rpmlintrc - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - renamed rpmlintrc to %{name}-rpmlintrc - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - Remove old specfile constructs - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor to be used by the kernel module versions used by CUDA. The firmware targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics firmware. (bsc#1227417) - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) - For CUDA update version to 555.42.6. - Use firmware for one arch only as firmware doesn't run on the CPU and therefore should be arch-independent. This has been confirmed by NVIDIA. Since the run file attempts to run binaries if these are not installed, 'BuildRequire:' zstd. - due to maintenance process we can switch to noarch only for new products; so do this only for sle15-sp7 or later - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor to be used by the kernel module versions used by CUDA. The firmware targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics firmware. (bsc#1227417) - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) - For CUDA update version to 555.42.6. - Use firmware for one arch only as firmware doesn't run on the CPU and therefore should be arch-independent. This has been confirmed by NVIDIA. Since the run file attempts to run binaries if these are not installed, 'BuildRequire:' zstd. - due to maintenance process we can switch to noarch only for new products; so do this only for sle15-sp7 or later - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor to be used by the kernel module versions used by CUDA. The firmware targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics firmware. (bsc#1227417) - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) - For CUDA update version to 555.42.6. - Use firmware for one arch only as firmware doesn't run on the CPU and therefore should be arch-independent. This has been confirmed by NVIDIA. Since the run file attempts to run binaries if these are not installed, 'BuildRequire:' zstd. - due to maintenance process we can switch to noarch only for new products; so do this only for sle15-sp7 or later - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - Use _firmwaredir - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 525.85.05 - removed old firmware - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - update firmware to version 525.89.02 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - update firmware to version 525.105.17 - update firmware to version 525.116.03 - update firmware to version 525.116.04 - make package multiversion capable * no longer package libnvidia-ml and nvidia-smi * added "Provides: multiversion(kernel)" - update firmware to version 535.54.03 * gsp_ad10x.bin has been renamed to gsp_ga10x.bin - update firmware to version 535.86.05 - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor to be used by the kernel module versions used by CUDA. The firmware targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics firmware. (bsc#1227417) - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) - For CUDA update version to 555.42.6. - Use firmware for one arch only as firmware doesn't run on the CPU and therefore should be arch-independent. This has been confirmed by NVIDIA. Since the run file attempts to run binaries if these are not installed, 'BuildRequire:' zstd. - due to maintenance process we can switch to noarch only for new products; so do this only for sle15-sp7 or later - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor to be used by the kernel module versions used by CUDA. The firmware targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics firmware. (bsc#1227417) - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) - For CUDA update version to 555.42.6. - Use firmware for one arch only as firmware doesn't run on the CPU and therefore should be arch-independent. This has been confirmed by NVIDIA. Since the run file attempts to run binaries if these are not installed, 'BuildRequire:' zstd. - due to maintenance process we can switch to noarch only for new products; so do this only for sle15-sp7 or later - one-time rename to kernel-firmware-nvidia-gspx-G06 to workaround multiversioned package update (boo#1212724) - added conflicts to kernel-firmware-nvidia-gsp-G06 package - remove conflicts from previous change again, since this likely would break QA test for sle again ... - Obsoletes conflicting kernel-firmware-nvidia-gsp-G06 = 535.86.05 (boo#1212724) - minor cleanup in specfile - update firmware to version 535.104.05 - update firmware to version 535.113.01 - update firmware to version 535.129.03 - update firmware to version 545.29.02 - update firmware to version 545.29.06 - update firmware to version 550.54.14 - update firmware to version 550.67 - update firmware to version 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 * addresses boo#1223356 [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor to be used by the kernel module versions used by CUDA. The firmware targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics firmware. (bsc#1227417) - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) - For CUDA update version to 555.42.6. - Use firmware for one arch only as firmware doesn't run on the CPU and therefore should be arch-independent. This has been confirmed by NVIDIA. Since the run file attempts to run binaries if these are not installed, 'BuildRequire:' zstd. - due to maintenance process we can switch to noarch only for new products; so do this only for sle15-sp7 or later - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - s390/ipl: add eckd support (jsc#PED-2023). - commit 21b5156 - platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events (git-fixes). - platform/mellanox: mlxbf-pmc: Fix potential buffer overflows (git-fixes). - platform/mellanox: mlxbf-tmfifo: Drop jumbo frames (git-fixes). - platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors (git-fixes). - kselftest/runner.sh: Propagate SIGTERM to runner child (git-fixes). - commit 495d04f - s390/ipl: add eckd dump support (jsc#PED-2025). - commit 0961d1f - kabi: hide changes in enum ipl_type and struct sclp_info (jsc#PED-2023 jsc#PED-2025). - commit b6fb6b6 - s390/ipl: use octal values instead of S_* macros (jsc#PED-2023). - commit db2ef83 - s390/ipl: add DEFINE_GENERIC_LOADPARM() (jsc#PED-2023). - commit cd6d27a - s390/ipl: add loadparm parameter to eckd ipl/reipl data (jsc#PED-2023). - commit 364a30d - sctp: leave the err path free in sctp_stream_init to sctp_stream_free (CVE-2023-2177 bsc#1210643). - commit 337b7d8 - netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVE-2023-4881 bsc#1215221). - commit 0de26c1 - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (bsc#1215206, CVE-2023-1859). - commit f333aa7 - btrfs: don't hold CPU for too long when defragging a file (bsc#1214988). - commit 9b89645 - ata: libata: disallow dev-initiated LPM transitions to unsupported states (git-fixes). - i2c: aspeed: Reset the i2c controller when timeout occurs (git-fixes). - selftests: tracing: Fix to unmount tracefs for recovering environment (git-fixes). - drm/amd/display: fix the white screen issue when >= 64GB DRAM (git-fixes). - drm: gm12u320: Fix the timeout usage for usb_bulk_msg() (git-fixes). - commit 1f4e814 - blacklist.conf: Append 'parisc/agp: Annotate parisc agp init functions with __init' - commit 9eb45cc - blacklist.conf: Append 'parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()' - commit 30a9db6 - blacklist.conf: Append 'video/aperture: Only remove sysfb on the default vga pci device' - commit bfaaaff - blacklist.conf: Append 'Revert "fbcon: Use kzalloc() in fbcon_prepare_logo()"' - commit 501bd2e - Rename colliding patches before merging SLE15-SP4 - commit 6493f7c - USB: core: Change usb_get_device_descriptor() API (bsc#1213123 CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552). Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk) Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context) - commit 988a527 - Drop amdgpu patch causing spamming (bsc#1215523) Deleted: patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch. - commit c753869 - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). - commit 1e4ccee - s390/ipl: add eckd support (jsc#PED-2023). - commit 21b5156 - platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events (git-fixes). - platform/mellanox: mlxbf-pmc: Fix potential buffer overflows (git-fixes). - platform/mellanox: mlxbf-tmfifo: Drop jumbo frames (git-fixes). - platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors (git-fixes). - kselftest/runner.sh: Propagate SIGTERM to runner child (git-fixes). - commit 495d04f - s390/ipl: add eckd dump support (jsc#PED-2025). - commit 0961d1f - kabi: hide changes in enum ipl_type and struct sclp_info (jsc#PED-2023 jsc#PED-2025). - commit b6fb6b6 - s390/ipl: use octal values instead of S_* macros (jsc#PED-2023). - commit db2ef83 - s390/ipl: add DEFINE_GENERIC_LOADPARM() (jsc#PED-2023). - commit cd6d27a - s390/ipl: add loadparm parameter to eckd ipl/reipl data (jsc#PED-2023). - commit 364a30d - sctp: leave the err path free in sctp_stream_init to sctp_stream_free (CVE-2023-2177 bsc#1210643). - commit 337b7d8 - netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVE-2023-4881 bsc#1215221). - commit 0de26c1 - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (bsc#1215206, CVE-2023-1859). - commit f333aa7 - btrfs: don't hold CPU for too long when defragging a file (bsc#1214988). - commit 9b89645 - ata: libata: disallow dev-initiated LPM transitions to unsupported states (git-fixes). - i2c: aspeed: Reset the i2c controller when timeout occurs (git-fixes). - selftests: tracing: Fix to unmount tracefs for recovering environment (git-fixes). - drm/amd/display: fix the white screen issue when >= 64GB DRAM (git-fixes). - drm: gm12u320: Fix the timeout usage for usb_bulk_msg() (git-fixes). - commit 1f4e814 - blacklist.conf: Append 'parisc/agp: Annotate parisc agp init functions with __init' - commit 9eb45cc - blacklist.conf: Append 'parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()' - commit 30a9db6 - blacklist.conf: Append 'video/aperture: Only remove sysfb on the default vga pci device' - commit bfaaaff - blacklist.conf: Append 'Revert "fbcon: Use kzalloc() in fbcon_prepare_logo()"' - commit 501bd2e - Rename colliding patches before merging SLE15-SP4 - commit 6493f7c - USB: core: Change usb_get_device_descriptor() API (bsc#1213123 CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552). Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk) Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context) - commit 988a527 - Drop amdgpu patch causing spamming (bsc#1215523) Deleted: patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch. - commit c753869 - x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). - commit 1e4ccee - printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). - commit e0d3999 - blacklist.conf: printk: the changes look good but they do not fix any serious problem - commit c560ceb - blacklist.conf: workqueue: Code refactoring - commit e204334 - blacklist.conf: workqueue: compiler warning on 32-bit systems with Clang (bsc#1215877) - commit b7e65aa - tcp: Reduce chance of collisions in inet6_hashfn() (CVE-2023-1206 bsc#1212703). - commit e3ebd17 - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150). - commit 7a6be79 - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). - commit 9c5bbd7 - KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). - commit 9ff1a1e - KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). - commit 8726736 - blacklist.conf: kABi breakage (vmalloc) - commit 10bad47 - fs/smb/client: Reset password pointer to NULL (bsc#1215899 CVE-2023-5345). - commit 679511d - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). - commit 6454286 - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). - commit fe7fbfc - btrfs: fix root ref counts in error handling in btrfs_get_root_ref (bsc#1214351 CVE-2023-4389). - commit 3731029 - KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). - commit f1893aa - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754 bsc#1215467). - commit ad87dd3 - netfilter: xt_u32: validate user space input (CVE-2023-39192 bsc#1215858). - commit 292c059 - netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193 bsc#1215860). - commit 5ec24b7 - net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194 bsc#1215861). - commit 55308cb - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). - commit a62865f - printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875). - commit e0d3999 - blacklist.conf: printk: the changes look good but they do not fix any serious problem - commit c560ceb - blacklist.conf: workqueue: Code refactoring - commit e204334 - blacklist.conf: workqueue: compiler warning on 32-bit systems with Clang (bsc#1215877) - commit b7e65aa - tcp: Reduce chance of collisions in inet6_hashfn() (CVE-2023-1206 bsc#1212703). - commit e3ebd17 - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150). - commit 7a6be79 - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (git-fixes bsc#1215894). - commit 9c5bbd7 - KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895). - commit 9ff1a1e - KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes bsc#1215896). - commit 8726736 - blacklist.conf: kABi breakage (vmalloc) - commit 10bad47 - fs/smb/client: Reset password pointer to NULL (bsc#1215899 CVE-2023-5345). - commit 679511d - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (git-fixes bsc#1215911). - commit 6454286 - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes bsc#1215915). - commit fe7fbfc - btrfs: fix root ref counts in error handling in btrfs_get_root_ref (bsc#1214351 CVE-2023-4389). - commit 3731029 - KVM: s390: pv: fix external interruption loop not always detected (git-fixes bsc#1215916). - commit f1893aa - ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754 bsc#1215467). - commit ad87dd3 - netfilter: xt_u32: validate user space input (CVE-2023-39192 bsc#1215858). - commit 292c059 - netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193 bsc#1215860). - commit 5ec24b7 - net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194 bsc#1215861). - commit 55308cb - scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941). - commit a62865f - bonding: do not assume skb mac_header is set (bsc#1214754). - commit 88b9ad7 - bonding: Return pointer to data after pull on skb (bsc#1214754). - commit fbbe7cc - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes). - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (git-fixes). - mtd: rawnand: qcom: Unmap the right resource upon probe failure (git-fixes). - mtd: rawnand: pl353: Ensure program page operations are successful (git-fixes). - mtd: rawnand: arasan: Ensure program page operations are successful (git-fixes). - mtd: spinand: micron: correct bitmask for ecc status (git-fixes). - mtd: physmap-core: Restore map_rom fallback (git-fixes). - mtd: rawnand: marvell: Ensure program page operations are successful (git-fixes). - mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw (git-fixes). - mmc: core: sdio: hold retuning if sdio in 1-bit mode (git-fixes). - ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes). - ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes). - ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes). - ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes). - ASoC: pxa: fix a memory leak in probe() (git-fixes). - drm/i915: Retry gtt fault when out of fence registers (git-fixes). - commit 766bf5d - s390/cio: fix a memleak in css_alloc_subchannel (git-fixes bsc#1216510). - commit d475feb - s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511). - commit 2bb6835 - KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512). - commit 3976fa9 - Update patches.suse/USB-ene_usb6250-Allocate-enough-memory-for-full-obje.patch (bsc#1216051 CVE-2023-45862). Retroactively recognized as a security issue - commit 716929e - Refresh arm64 -rt test config files. - commit 7274c6e - ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085 bsc#1210778). - commit 86e05f1 - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842). - commit 3b513db - blacklist.conf: added two commmits that break kabi - commit fdf2030 - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes). - scsi: pm8001: Setup IRQs on resume (git-fixes). - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (git-fixes). - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes). - scsi: qla4xxx: Add length check when parsing nlattrs (git-fixes). - scsi: be2iscsi: Add length check when parsing nlattrs (git-fixes). - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (git-fixes). - scsi: iscsi: Add length check for nlattr payload (git-fixes). - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (git-fixes). - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (git-fixes). - net: use sk_is_tcp() in more places (git-fixes). - commit 24cbf21 - x86/mm: Print the encryption features correctly when a paravisor is present (bsc#1206453). - commit d1a6274 - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes). - phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes). - phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes). - gpio: vf610: set value before the direction to avoid a glitch (git-fixes). - platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes). - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes). - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (git-fixes). - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). - USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). - mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes). - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). - Bluetooth: avoid memcmp() out of bounds warning (git-fixes). - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes). - Bluetooth: hci_event: Fix coding style (git-fixes). - Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes). - Bluetooth: vhci: Fix race when opening vhci device (git-fixes). - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes). - drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes). - HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes). - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes). - wifi: cfg80211: Fix 6GHz scan configuration (git-fixes). - wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes). - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes). - Bluetooth: Avoid redundant authentication (git-fixes). - Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes). - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-fixes). - gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes). - commit b480af6 - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes). - drm/mediatek: Correctly free sg_table in gem prime vmap (git-fixes). - drm/amd/pm: add unique_id for gc 11.0.3 (git-fixes). - commit ad38bcf - x86/sev: Disable MMIO emulation from user mode (bsc#1212649). - commit 5dae47e - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649). - commit 2b69036 - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649). - commit 816f817 - btrfs: don't start transaction for scrub if the fs is mounted read-only (bsc#1214874). - commit cc8e6f1 - remove unnecessary WARN_ON_ONCE() (bsc#1214823). - NFSD: Never call nfsd_file_gc() in foreground paths (bsc#1215545). - commit d81dfc3 - bonding: do not assume skb mac_header is set (bsc#1214754). - commit 88b9ad7 - bonding: Return pointer to data after pull on skb (bsc#1214754). - commit fbbe7cc - ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes). - Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" (git-fixes). - mtd: rawnand: qcom: Unmap the right resource upon probe failure (git-fixes). - mtd: rawnand: pl353: Ensure program page operations are successful (git-fixes). - mtd: rawnand: arasan: Ensure program page operations are successful (git-fixes). - mtd: spinand: micron: correct bitmask for ecc status (git-fixes). - mtd: physmap-core: Restore map_rom fallback (git-fixes). - mtd: rawnand: marvell: Ensure program page operations are successful (git-fixes). - mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw (git-fixes). - mmc: core: sdio: hold retuning if sdio in 1-bit mode (git-fixes). - ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-fixes). - ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes). - ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes). - ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes). - ASoC: pxa: fix a memory leak in probe() (git-fixes). - drm/i915: Retry gtt fault when out of fence registers (git-fixes). - commit 766bf5d - s390/cio: fix a memleak in css_alloc_subchannel (git-fixes bsc#1216510). - commit d475feb - s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511). - commit 2bb6835 - KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes bsc#1216512). - commit 3976fa9 - Update patches.suse/USB-ene_usb6250-Allocate-enough-memory-for-full-obje.patch (bsc#1216051 CVE-2023-45862). Retroactively recognized as a security issue - commit 716929e - Refresh arm64 -rt test config files. - commit 7274c6e - ubi: Refuse attaching if mtd's erasesize is 0 (CVE-2023-31085 bsc#1210778). - commit 86e05f1 - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() (bsc#1214842). - commit 3b513db - blacklist.conf: added two commmits that break kabi - commit fdf2030 - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes). - scsi: pm8001: Setup IRQs on resume (git-fixes). - scsi: mpt3sas: Perform additional retries if doorbell read returns 0 (git-fixes). - scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (git-fixes). - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes). - scsi: qla4xxx: Add length check when parsing nlattrs (git-fixes). - scsi: be2iscsi: Add length check when parsing nlattrs (git-fixes). - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() (git-fixes). - scsi: iscsi: Add length check for nlattr payload (git-fixes). - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock (git-fixes). - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (git-fixes). - net: use sk_is_tcp() in more places (git-fixes). - commit 24cbf21 - x86/mm: Print the encryption features correctly when a paravisor is present (bsc#1206453). - commit d1a6274 - phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes). - phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes). - phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes). - gpio: vf610: set value before the direction to avoid a glitch (git-fixes). - platform/surface: platform_profile: Propagate error if profile registration fails (git-fixes). - platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-fixes). - platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e (git-fixes). - USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). - USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). - USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). - mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes). - Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name (git-fixes). - Bluetooth: avoid memcmp() out of bounds warning (git-fixes). - Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes). - Bluetooth: hci_event: Fix coding style (git-fixes). - Bluetooth: Reject connection with the device which has same BD_ADDR (git-fixes). - Bluetooth: vhci: Fix race when opening vhci device (git-fixes). - platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes). - drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes). - HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes). - HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-fixes). - wifi: cfg80211: avoid leaking stack data into trace (git-fixes). - wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-fixes). - wifi: cfg80211: Fix 6GHz scan configuration (git-fixes). - wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes). - wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes). - Bluetooth: Avoid redundant authentication (git-fixes). - Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes). - i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-fixes). - gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes). - commit b480af6 - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (git-fixes). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (git-fixes). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (git-fixes). - drm/mediatek: Correctly free sg_table in gem prime vmap (git-fixes). - drm/amd/pm: add unique_id for gc 11.0.3 (git-fixes). - commit ad38bcf - x86/sev: Disable MMIO emulation from user mode (bsc#1212649). - commit 5dae47e - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649). - commit 2b69036 - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649). - commit 816f817 - btrfs: don't start transaction for scrub if the fs is mounted read-only (bsc#1214874). - commit cc8e6f1 - remove unnecessary WARN_ON_ONCE() (bsc#1214823). - NFSD: Never call nfsd_file_gc() in foreground paths (bsc#1215545). - commit d81dfc3 - xfs: convert buffer flags to unsigned (git-fixes). - commit 6147a1c - xfs: convert attr type flags to unsigned (git-fixes). - commit c641f4d - xfs: convert scrub type flags to unsigned (git-fixes). - commit c3c7c82 - xfs: convert bmap extent type flags to unsigned (git-fixes). - commit 30fead3 - xfs: convert bmapi flags to unsigned (git-fixes). - commit 1ec6360 - xfs: convert AGF log flags to unsigned (git-fixes). - commit 91cefbb - xfs: convert AGI log flags to unsigned (git-fixes). - commit 66d955b - xfs: convert btree buffer log flags to unsigned (git-fixes). - commit ced67a9 - xfs: convert buffer log item flags to unsigned (git-fixes). - commit d4d0c9c - xfs: convert da btree operations flags to unsigned (git-fixes). - commit 41198d9 - xfs: convert dquot flags to unsigned (git-fixes). - commit 1630213 - xfs: convert log item tracepoint flags to unsigned (git-fixes). - commit 411032a - xfs: convert inode lock flags to unsigned (git-fixes). - commit 831f7e2 - xfs: convert quota options flags to unsigned (git-fixes). - commit 7dfe466 - xfs: convert log ticket and iclog flags to unsigned (git-fixes). - commit 57245d3 - firewire: core: fix possible memory leak in create_units() (git-fixes). - commit 0ade49c - USB: serial: option: add Luat Air72*U series products (git-fixes). - USB: serial: option: add Fibocom L7xx modules (git-fixes). - USB: serial: option: don't claim interface 4 for ZTE MF290 (git-fixes). - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes). - commit 4c40fde - blacklist.conf: this is true for SLE15-SP4 not SLE15-SP5 The backport was provided in bsc#1215123 for SP5, but it has further dependencies not present in SP4, so unless requested by IBM, I'm going to skip it for git-fixes. - commit 5219b23 - powerpc: Don't clobber f0/vs0 during fp|altivec register save (bsc#1217780). - commit 46d31e2 - Refresh -rt config files. - commit d71b92e - xfs: convert buffer flags to unsigned (git-fixes). - commit 6147a1c - xfs: convert attr type flags to unsigned (git-fixes). - commit c641f4d - xfs: convert scrub type flags to unsigned (git-fixes). - commit c3c7c82 - xfs: convert bmap extent type flags to unsigned (git-fixes). - commit 30fead3 - xfs: convert bmapi flags to unsigned (git-fixes). - commit 1ec6360 - xfs: convert AGF log flags to unsigned (git-fixes). - commit 91cefbb - xfs: convert AGI log flags to unsigned (git-fixes). - commit 66d955b - xfs: convert btree buffer log flags to unsigned (git-fixes). - commit ced67a9 - xfs: convert buffer log item flags to unsigned (git-fixes). - commit d4d0c9c - xfs: convert da btree operations flags to unsigned (git-fixes). - commit 41198d9 - xfs: convert dquot flags to unsigned (git-fixes). - commit 1630213 - xfs: convert log item tracepoint flags to unsigned (git-fixes). - commit 411032a - xfs: convert inode lock flags to unsigned (git-fixes). - commit 831f7e2 - xfs: convert quota options flags to unsigned (git-fixes). - commit 7dfe466 - xfs: convert log ticket and iclog flags to unsigned (git-fixes). - commit 57245d3 - firewire: core: fix possible memory leak in create_units() (git-fixes). - commit 0ade49c - USB: serial: option: add Luat Air72*U series products (git-fixes). - USB: serial: option: add Fibocom L7xx modules (git-fixes). - USB: serial: option: don't claim interface 4 for ZTE MF290 (git-fixes). - ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CVA (git-fixes). - commit 4c40fde - blacklist.conf: this is true for SLE15-SP4 not SLE15-SP5 The backport was provided in bsc#1215123 for SP5, but it has further dependencies not present in SP4, so unless requested by IBM, I'm going to skip it for git-fixes. - commit 5219b23 - powerpc: Don't clobber f0/vs0 during fp|altivec register save (bsc#1217780). - commit 46d31e2 - Refresh -rt config files. - commit d71b92e - x86/CPU/AMD: Check vendor in the AMD microcode callback (git-fixes). - commit 43e31d9 - x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes). - Refresh patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch. - commit b121d1d - x86/srso: Add SRSO mitigation for Hygon processors (git-fixes). - commit 7b8dfd1 - x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes). - commit 8087b92 - x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes). - commit 7029135 - x86/alternatives: Sync core before enabling interrupts (git-fixes). - commit 4a0b72a - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning (git-fixes). - commit 3929c70 - x86/boot/compressed: Reserve more memory for page tables (git-fixes). - commit 6bf16e1 - x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes). - commit fdc98a7 - vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). - commit 8dab9cc - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes). - commit d74349c - x86/cpu: Fix amd_check_microcode() declaration (git-fixes). - Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch. - commit c22f4b4 - x86/fpu: Invalidate FPU state correctly on exec() (git-fixes). - commit 7686df9 - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes). - commit 46d60b3 - x86/purgatory: Remove LTO flags (git-fixes). - commit bbd4f84 - smb: client: fix potential OOB in smb2_dump_detail() (bsc#1217946 CVE-2023-6610). - commit cfca7f7 - swiotlb: reduce the number of areas to match actual memory pool size (git-fixes). - swiotlb: always set the number of areas before allocating the pool (git-fixes). - swiotlb: fix debugfs reporting of reserved memory pools (git-fixes). - swiotlb: fix a braino in the alignment check fix (bsc#1216559). - swiotlb: fix slot alignment checks (bsc#1216559). - swiotlb: fix the deadlock in swiotlb_do_find_slots (git-fixes). - swiotlb: reduce the swiotlb buffer size on allocation failure (git-fixes). - swiotlb: don't panic! (git-fixes). - Revert "swiotlb: panic if nslabs is too small" (git-fixes). - commit 1b89825 - io_uring/af_unix: disable sending io_uring over sockets (bsc#1218447, CVE-2023-6531). - commit fdc256b - swiotlb: use the calculated number of areas (git-fixes). - swiotlb: mark swiotlb_memblock_alloc() as __init (git-fixes). - commit b9aedb4 - Update patches.kabi/kabi-fix-zone-unaccepted-memory.patch (jsc#PED-7167 bsc#1218643). - commit f781e3d - x86/CPU/AMD: Check vendor in the AMD microcode callback (git-fixes). - commit 43e31d9 - x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes). - Refresh patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch. - commit b121d1d - x86/srso: Add SRSO mitigation for Hygon processors (git-fixes). - commit 7b8dfd1 - x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes). - commit 8087b92 - x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes). - commit 7029135 - x86/alternatives: Sync core before enabling interrupts (git-fixes). - commit 4a0b72a - gfs2: Silence "suspicious RCU usage in gfs2_permission" warning (git-fixes). - commit 3929c70 - x86/boot/compressed: Reserve more memory for page tables (git-fixes). - commit 6bf16e1 - x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes). - commit fdc98a7 - vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). - commit 8dab9cc - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes). - commit d74349c - x86/cpu: Fix amd_check_microcode() declaration (git-fixes). - Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch. - commit c22f4b4 - x86/fpu: Invalidate FPU state correctly on exec() (git-fixes). - commit 7686df9 - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes). - commit 46d60b3 - x86/purgatory: Remove LTO flags (git-fixes). - commit bbd4f84 - smb: client: fix potential OOB in smb2_dump_detail() (bsc#1217946 CVE-2023-6610). - commit cfca7f7 - swiotlb: reduce the number of areas to match actual memory pool size (git-fixes). - swiotlb: always set the number of areas before allocating the pool (git-fixes). - swiotlb: fix debugfs reporting of reserved memory pools (git-fixes). - swiotlb: fix a braino in the alignment check fix (bsc#1216559). - swiotlb: fix slot alignment checks (bsc#1216559). - swiotlb: fix the deadlock in swiotlb_do_find_slots (git-fixes). - swiotlb: reduce the swiotlb buffer size on allocation failure (git-fixes). - swiotlb: don't panic! (git-fixes). - Revert "swiotlb: panic if nslabs is too small" (git-fixes). - commit 1b89825 - io_uring/af_unix: disable sending io_uring over sockets (bsc#1218447, CVE-2023-6531). - commit fdc256b - swiotlb: use the calculated number of areas (git-fixes). - swiotlb: mark swiotlb_memblock_alloc() as __init (git-fixes). - commit b9aedb4 - Update patches.kabi/kabi-fix-zone-unaccepted-memory.patch (jsc#PED-7167 bsc#1218643). - commit f781e3d - fs: Fix error checking for d_hash_and_lookup() (git-fixes). - commit b1a5e63 - tracefs: Add missing lockdown check to tracefs_create_dir() (git-fixes). - commit 36d0f04 - fs: indicate request originates from old mount API (git-fixes). - commit 8ccbbb1 - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086 bsc#1219434). - commit 5f917ff - netfilter: nf_tables: check if catch-all set element is active in next generation (CVE-2024-1085 bsc#1219429). - commit 7b3f4c4 - RAS: Introduce AMD Address Translation Library (jsc#PED-7618). - commit d6ad6ba - EDAC/amd64: Use new AMD Address Translation Library (jsc#PED-7618). - commit f1baba4 - Documentation: RAS: Add index and address translation section (jsc#PED-7618). - commit d6e1334 - RAS/AMD/ATL: Add MI300 support (jsc#PED-7618). - commit 761e3c8 - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (jsc#PED-7618). - commit 83df5af - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (jsc#PED-7618). - commit a26a502 - EDAC/amd64: Add MI300 row retirement support (jsc#PED-7618). - commit fb688f3 - README.BRANCH: update branch name to cve/linux-5.14, update maintainers as requested - commit 8e34879 - Update patches.suse/Bluetooth-Fix-atomicity-violation-in-min-max-_key_si.patch (git-fixes bsc#1219608 CVE-2024-24860). - commit dedfe8a - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (git-fixes bsc#1219608 CVE-2024-24860). - commit a1186fd - Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch. Accidentally removed nfs4_get_stateowner - commit ad106c0 - README.BRANCH: Update cve/linux-5.14 maintainers Add myself to match SLE15-SP5 consumer + fix typo in branch name. - commit da26653 - vhost: use kzalloc() instead of kmalloc() followed by memset() (CVE-2024-0340, bsc#1218689). - commit 4c5a740 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix build due to incomplete line removal - commit 720d084 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix following error when building kvmsmall config by removing left over declaration: [ 216s] In file included from ../arch/x86/kernel/cpu/mce/core.c:52:0: [ 216s] ../arch/x86/include/asm/mce.h:366:1: error: duplicate 'static' [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:15: error: two or more data types in declaration specifiers [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~ [ 216s] ../arch/x86/include/asm/mce.h: In function 'mce_hygon_feature_init': [ 216s] ../arch/x86/include/asm/mce.h:366:75: error: void value not ignored as it ought to be [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~~~~~~~~~~~~~~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:50: error: control reaches end of non-void function [-Werror=return-type] [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } - commit 7015e17 - fs: Fix error checking for d_hash_and_lookup() (git-fixes). - commit b1a5e63 - tracefs: Add missing lockdown check to tracefs_create_dir() (git-fixes). - commit 36d0f04 - fs: indicate request originates from old mount API (git-fixes). - commit 8ccbbb1 - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-1086 bsc#1219434). - commit 5f917ff - netfilter: nf_tables: check if catch-all set element is active in next generation (CVE-2024-1085 bsc#1219429). - commit 7b3f4c4 - RAS: Introduce AMD Address Translation Library (jsc#PED-7618). - commit d6ad6ba - EDAC/amd64: Use new AMD Address Translation Library (jsc#PED-7618). - commit f1baba4 - Documentation: RAS: Add index and address translation section (jsc#PED-7618). - commit d6e1334 - RAS/AMD/ATL: Add MI300 support (jsc#PED-7618). - commit 761e3c8 - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (jsc#PED-7618). - commit 83df5af - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (jsc#PED-7618). - commit a26a502 - EDAC/amd64: Add MI300 row retirement support (jsc#PED-7618). - commit fb688f3 - README.BRANCH: update branch name to cve/linux-5.14, update maintainers as requested - commit 8e34879 - Update patches.suse/Bluetooth-Fix-atomicity-violation-in-min-max-_key_si.patch (git-fixes bsc#1219608 CVE-2024-24860). - commit dedfe8a - Bluetooth: Fix atomicity violation in {min,max}_key_size_set (git-fixes bsc#1219608 CVE-2024-24860). - commit a1186fd - Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch. Accidentally removed nfs4_get_stateowner - commit ad106c0 - README.BRANCH: Update cve/linux-5.14 maintainers Add myself to match SLE15-SP5 consumer + fix typo in branch name. - commit da26653 - vhost: use kzalloc() instead of kmalloc() followed by memset() (CVE-2024-0340, bsc#1218689). - commit 4c5a740 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix build due to incomplete line removal - commit 720d084 - Refresh patches.suse/EDAC-amd64-Use-new-AMD-Address-Translation-Library.patch. Fix following error when building kvmsmall config by removing left over declaration: [ 216s] In file included from ../arch/x86/kernel/cpu/mce/core.c:52:0: [ 216s] ../arch/x86/include/asm/mce.h:366:1: error: duplicate 'static' [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:15: error: two or more data types in declaration specifiers [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~ [ 216s] ../arch/x86/include/asm/mce.h: In function 'mce_hygon_feature_init': [ 216s] ../arch/x86/include/asm/mce.h:366:75: error: void value not ignored as it ought to be [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } [ 216s] ^~~~~~~~~~~~~~~~~~~~~~~ [ 216s] ../arch/x86/include/asm/mce.h:366:50: error: control reaches end of non-void function [-Werror=return-type] [ 216s] static inline void mce_hygon_feature_init(struct cpuinfo_x86 *c) { return mce_amd_feature_init(c); } - commit 7015e17 - power: supply: bq27xxx-i2c: Do not free non existing IRQ (git-fixes). - mmc: sdhci-xenon: add timeout for PHY init complete (git-fixes). - mmc: sdhci-xenon: fix PHY init clock stability (git-fixes). - mmc: core: Fix eMMC initialization with 1-bit bus connection (git-fixes). - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes). - mtd: spinand: gigadevice: Fix the get ecc status issue (git-fixes). - nouveau: fix function cast warnings (git-fixes). - media: ir_toy: fix a memleak in irtoy_tx (git-fixes). - media: rc: bpf attach/detach requires write permission (git-fixes). - mmc: slot-gpio: Allow non-sleeping GPIO ro (git-fixes). - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (git-fixes). - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet (git-fixes). - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected (git-fixes). - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (git-fixes). - PCI: Fix 64GT/s effective data rate calculation (git-fixes). - PCI: Only override AMD USB controller if required (git-fixes). - PCI/AER: Decode Requester ID when no error info found (git-fixes). - media: ddbridge: fix an error code problem in ddb_probe (git-fixes). - mmc: mmc_spi: remove custom DMA mapped buffers (git-fixes). - mmc: core: Use mrq.sbc in close-ended ffu (git-fixes). - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (git-fixes). - pstore/ram: Fix crash when setting number of cpus to an odd number (git-fixes). - PNP: ACPI: fix fortify warning (git-fixes). - regulator: core: Only increment use_count when enable_count changes (git-fixes). - PM: core: Remove unnecessary (void *) conversions (git-fixes). - serial: 8250: Remove serial_rs485 sanitization from em485 (git-fixes). - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes). - commit 9894050 - tomoyo: fix UAF write bug in tomoyo_write_control() (git-fixes). - wifi: nl80211: reject iftype change with mesh ID change (git-fixes). - usb: dwc3: gadget: Don't disconnect if not started (git-fixes). - wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes). - usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes). - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK (git-fixes). - spi: sh-msiof: avoid integer overflow in constants (git-fixes). - wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes). - wifi: cfg80211: fix missing interfaces when dumping (git-fixes). - usb: dwc3: gadget: Queue PM runtime idle on disconnect event (git-fixes). - usb: dwc3: gadget: Handle EP0 request dequeuing properly (git-fixes). - usb: hub: Replace hardcoded quirk value with BIT() macro (git-fixes). - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE (git-fixes). - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 (git-fixes). - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (git-fixes). - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (git-fixes). - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes). - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (git-fixes). - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes). - wifi: rt2x00: restart beacon queue when hardware reset (git-fixes). - wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes). - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes). - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (git-fixes). - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API (git-fixes). - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect (git-fixes). - commit 8b4f9a3 - usb: dwc3: gadget: Ignore End Transfer delay on teardown (git-fixes). - Refresh patches.suse/usb-dwc3-gadget-Add-1ms-delay-after-end-transfer-com.patch. - commit 251cd08 - Update patch reference for input fix (CVE-2021-46932 bsc#1220444) - commit e44e0b1 - powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1220250,CVE-2023-52451). - commit fdc7254 - serial: imx: fix tx statemachine deadlock (bsc#1220364 CVE-2023-52456). - commit cd9f92c - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457). - commit c82f528 - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Add some comments to stack representation (bsc#1220257 CVE-2023-52452). - Refresh patches.kabi/kABI-fix-bpf-Tighten-ptr_to_btf_id-checks.patch - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor logging improvement (bsc#1220257). - commit 7d03125 - btrfs: do not ASSERT() if the newly created subvolume already got read (bsc#1219126 CVE-2024-23850). - commit a2ac581 - btrfs: fix double free of anonymous device after snapshot creation failure (bsc#1219126 CVE-2024-23850). - commit 257a534 - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825 CVE-2024-26622). - commit c8e5b38 - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817 bsc#1218195). - commit 4032aa7 - netfilter: nf_tables: fix 64-bit load issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - commit e095cd0 - kabi: restore return type of dst_ops::gc() callback (CVE-2023-52340 bsc#1219295). - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340 bsc#1219295). - commit b8eec42 - tls: fix race between tx work scheduling and socket close (CVE-2024-26585 bsc#1220187). - commit 1306bff - selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - commit 8a833ce - bpf: Fix re-attachment branch in bpf_tracing_prog_attach (bsc#1220254 CVE-2024-26591). - commit fc948d3 - Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746). - commit c955133 - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746). - commit ee70608 - KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746). - commit 7f00c86 - power: supply: bq27xxx-i2c: Do not free non existing IRQ (git-fixes). - mmc: sdhci-xenon: add timeout for PHY init complete (git-fixes). - mmc: sdhci-xenon: fix PHY init clock stability (git-fixes). - mmc: core: Fix eMMC initialization with 1-bit bus connection (git-fixes). - net: usb: dm9601: fix wrong return value in dm9601_mdio_read (git-fixes). - mtd: spinand: gigadevice: Fix the get ecc status issue (git-fixes). - nouveau: fix function cast warnings (git-fixes). - media: ir_toy: fix a memleak in irtoy_tx (git-fixes). - media: rc: bpf attach/detach requires write permission (git-fixes). - mmc: slot-gpio: Allow non-sleeping GPIO ro (git-fixes). - regulator: pwm-regulator: Add validity checks in continuous .get_voltage (git-fixes). - platform/x86: touchscreen_dmi: Add info for the TECLAST X16 Plus tablet (git-fixes). - spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected (git-fixes). - PCI: switchtec: Fix stdev_release() crash after surprise hot remove (git-fixes). - PCI: Fix 64GT/s effective data rate calculation (git-fixes). - PCI: Only override AMD USB controller if required (git-fixes). - PCI/AER: Decode Requester ID when no error info found (git-fixes). - media: ddbridge: fix an error code problem in ddb_probe (git-fixes). - mmc: mmc_spi: remove custom DMA mapped buffers (git-fixes). - mmc: core: Use mrq.sbc in close-ended ffu (git-fixes). - PCI: Add no PM reset quirk for NVIDIA Spectrum devices (git-fixes). - pstore/ram: Fix crash when setting number of cpus to an odd number (git-fixes). - PNP: ACPI: fix fortify warning (git-fixes). - regulator: core: Only increment use_count when enable_count changes (git-fixes). - PM: core: Remove unnecessary (void *) conversions (git-fixes). - serial: 8250: Remove serial_rs485 sanitization from em485 (git-fixes). - PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() (git-fixes). - commit 9894050 - tomoyo: fix UAF write bug in tomoyo_write_control() (git-fixes). - wifi: nl80211: reject iftype change with mesh ID change (git-fixes). - usb: dwc3: gadget: Don't disconnect if not started (git-fixes). - wifi: mac80211: adding missing drv_mgd_complete_tx() call (git-fixes). - usb: f_mass_storage: forbid async queue when shutdown happen (git-fixes). - usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK (git-fixes). - spi: sh-msiof: avoid integer overflow in constants (git-fixes). - wifi: mac80211: fix race condition on enabling fast-xmit (git-fixes). - wifi: cfg80211: fix missing interfaces when dumping (git-fixes). - usb: dwc3: gadget: Queue PM runtime idle on disconnect event (git-fixes). - usb: dwc3: gadget: Handle EP0 request dequeuing properly (git-fixes). - usb: hub: Replace hardcoded quirk value with BIT() macro (git-fixes). - tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE (git-fixes). - watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 (git-fixes). - wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update (git-fixes). - wifi: cfg80211: free beacon_ies when overridden from hidden BSS (git-fixes). - wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() (git-fixes). - wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices (git-fixes). - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (git-fixes). - wifi: rt2x00: restart beacon queue when hardware reset (git-fixes). - wifi: iwlwifi: mvm: avoid baid size integer overflow (git-fixes). - wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() (git-fixes). - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range (git-fixes). - usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API (git-fixes). - usb: dwc3: gadget: Submit endxfer command if delayed during disconnect (git-fixes). - commit 8b4f9a3 - usb: dwc3: gadget: Ignore End Transfer delay on teardown (git-fixes). - Refresh patches.suse/usb-dwc3-gadget-Add-1ms-delay-after-end-transfer-com.patch. - commit 251cd08 - Update patch reference for input fix (CVE-2021-46932 bsc#1220444) - commit e44e0b1 - powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1220250,CVE-2023-52451). - commit fdc7254 - serial: imx: fix tx statemachine deadlock (bsc#1220364 CVE-2023-52456). - commit cd9f92c - serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457). - commit c82f528 - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor cleanup around stack bounds (bsc#1220257 CVE-2023-52452). - bpf: Fix accesses to uninit stack slots (bsc#1220257 CVE-2023-52452). - bpf: Add some comments to stack representation (bsc#1220257 CVE-2023-52452). - Refresh patches.kabi/kABI-fix-bpf-Tighten-ptr_to_btf_id-checks.patch - bpf: Guard stack limits against 32bit overflow (git-fixes). - bpf: Fix verification of indirect var-off stack access (git-fixes). - bpf: Minor logging improvement (bsc#1220257). - commit 7d03125 - btrfs: do not ASSERT() if the newly created subvolume already got read (bsc#1219126 CVE-2024-23850). - commit a2ac581 - btrfs: fix double free of anonymous device after snapshot creation failure (bsc#1219126 CVE-2024-23850). - commit 257a534 - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825 CVE-2024-26622). - commit c8e5b38 - netfilter: nft_set_pipapo: skip inactive elements during set walk (CVE-2023-6817 bsc#1218195). - commit 4032aa7 - netfilter: nf_tables: fix 64-bit load issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607 bsc#1218915). - commit e095cd0 - kabi: restore return type of dst_ops::gc() callback (CVE-2023-52340 bsc#1219295). - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340 bsc#1219295). - commit b8eec42 - tls: fix race between tx work scheduling and socket close (CVE-2024-26585 bsc#1220187). - commit 1306bff - selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255 CVE-2024-26589). - commit 8a833ce - bpf: Fix re-attachment branch in bpf_tracing_prog_attach (bsc#1220254 CVE-2024-26591). - commit fc948d3 - Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746). - commit c955133 - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746). - commit ee70608 - KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746). - commit 7f00c86 - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883 cve-2023-52500). - commit fc88013 - ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes). - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes). - ASoC: amd: acp: fix for acp_init function error handling (git-fixes). - ASoC: rt711-sdw: fix locking sequence (git-fixes). - ASoC: rt711-sdca: fix locking sequence (git-fixes). - ASoC: rt5682-sdw: fix locking sequence (git-fixes). - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes). - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes). - drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes). - drm/display: fix typo (git-fixes). - drm/panfrost: fix power transition timeout warnings (git-fixes). - commit 56ef24f - blacklist.conf: add a couple of PCI git-fixes - commit 37743ca - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883 cve-2023-52500). - commit fc88013 - ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes). - ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes). - ASoC: amd: acp: fix for acp_init function error handling (git-fixes). - ASoC: rt711-sdw: fix locking sequence (git-fixes). - ASoC: rt711-sdca: fix locking sequence (git-fixes). - ASoC: rt5682-sdw: fix locking sequence (git-fixes). - ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes). - ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes). - drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes). - drm/display: fix typo (git-fixes). - drm/panfrost: fix power transition timeout warnings (git-fixes). - commit 56ef24f - blacklist.conf: add a couple of PCI git-fixes - commit 37743ca - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - README.BRANCH: Add Petr Tesarik - commit ac60b6d - mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829). - commit 539be83 - Refresh patches.kabi/kabi-allow-extra-bugints.patch. (bsc#1222952) - commit a04a1a9 - arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on (git-fixes) - commit b828266 - blacklist.conf: ("arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card") - commit 4b90502 - arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes) - commit a61527a - arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes) - commit 22061fc - net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes). - RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes). - Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory (git-fixes). - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (git-fixes). - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (git-fixes). - scsi: storvsc: Fix ring buffer size calculation (git-fixes). - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (git-fixes). - commit 82617ea - nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044 CVE-2023-52591). - commit a849be1 - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit aa8204a - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (bsc#1219264 CVE-2024-0841). - commit fe3c052 - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (git-fixes). - commit eb744cd - blacklist.conf: We don't have annotate_noendbr in this kernel So shut up the warning. - commit f6d75ac - stackdepot: rename pool_index to pool_index_plus_1 (git-fixes). - commit 4edf006 - mm,page_owner: Defer enablement of static branch (bsc#1222366). - commit aa158b4 - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (bsc#1222619). - commit 3d3186c - blacklist.conf: Add d9b3ce8769e3 mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats - commit 3201b4c - blacklist.conf: Add f7ec1cd5cc7e getrusage: use sig->stats_lock rather than lock_task_sighand() and its prereqs - commit 0650209 - Refresh patches.kabi/PCI-Add-locking-to-RMW-PCI-Express-Capability-Regist.patch. Drop a bogus hunk. It was introduced by mistake. Fixes: acf0d9920aee - commit 3a754ef - Refresh patches.kabi/kabi-allow-extra-bugints.patch. Properly check whether the feature we are patching in the alternatives is a feature or a bug. This was broken because in apply_alternative() boot_cpu_has is used and if we have an alternative that depends on a bug bit (such as X86_BUG_SYSRET_SS_ATTRS) the boot_cpu_has will erroneously check if this bit is set in the feature ints rather than the bug ints. While at it ensure that static_cpu_has isn't called with extended bugs features as those aren't supported right now. - commit 793068f - README.BRANCH: Add Petr Tesarik - commit ac60b6d - mm/vmalloc: huge vmalloc backing pages should be split rather than compound (bsc#1217829). - commit 539be83 - Refresh patches.kabi/kabi-allow-extra-bugints.patch. (bsc#1222952) - commit a04a1a9 - tracing: Show size of requested perf buffer (git-fixes). - commit f8d068b - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Delete patches.suse/Revert-drm-qxl-simplify-qxl_fence_wait.patch and add the commit to blacklist.conf. - commit e221716 - tracing: Show size of requested perf buffer (git-fixes). - commit f8d068b - tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes). - commit a272f90 - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes). - commit 118cfcd - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Delete patches.suse/Revert-drm-qxl-simplify-qxl_fence_wait.patch and add the commit to blacklist.conf. - commit e221716 - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Delete patches.suse/Revert-drm-qxl-simplify-qxl_fence_wait.patch and add the commit to blacklist.conf. - commit e221716 - Update patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch (git-fixes bsc#1223858). - commit e50ed21 - Add two patches to match SLE15-SP5: patches.suse/Revert-drm-qxl-simplify-qxl_fence_wait.patch patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch - commit f92ae49 - Update patches.suse/efi-libstub-Implement-support-for-unaccepted-memory.patch (jsc#PED-7167, bsc#1224169). - commit a57eb93 - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes). - commit e007447 - ring-buffer: Only update pages_touched when a new page is touched (git-fixes). - commit b42aba1 - blacklist.conf: add a not-relevant module-loader patch - commit 90c64db - Update patches.suse/IB-core-Fix-a-nested-dead-lock-as-part-of-ODP-flow.patch (git-fixes CVE-2022-48675 bsc#1223894). - Update patches.suse/drm-gma500-Fix-BUG-sleeping-function-called-from-inv.patch (git-fixes CVE-2022-48634 bsc#1223501). - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505a4e7ccdac38e ("drm/i915: Move context management under GEM") bsc#1223505). - Update patches.suse/i2c-mlxbf-prevent-stack-overflow-in-mlxbf_i2c_smbus_.patch (git-fixes CVE-2022-48632 bsc#1223481). - Update patches.suse/ice-Fix-crash-by-keep-old-cfg-when-update-TCs-more-t.patch (git-fixes CVE-2022-48652 bsc#1223520). - Update patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup (git-fixes CVE-2022-48636 bsc#1223512). - commit 523501c - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693) - commit b0c9830 - net: sparx5: Fix use after free inside sparx5_del_mact_entry (bsc#1223052 CVE-2024-26856). - commit fc5c6ad - igc: avoid returning frame twice in XDP_REDIRECT (bsc#1223061 CVE-2024-26853). - commit 021db33 - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (bsc#1222368 CVE-2024-26673). - commit 785b7d0 - Update patches.suse/drm-i915-gem-Really-move-i915_gem_context.link-under.patch (CVE-2022-48662 bsc#1223505). Unbreak metadata (References: collides with our internal tracking, switch to Fixes: when referencing a commit). - commit cd38265 - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (CVE-2024-0639 bsc#1218917). - commit 517d4f7 - packet: annotate data-races around ignore_outgoing (CVE-2024-26862 bsc#1223111). - commit 6e591e7 - Update patches.suse/ALSA-emu10k1-Fix-out-of-bounds-access-in-snd_emu10k1.patch (git-fixes CVE-2022-48702 bsc#1223923). - Update patches.suse/ALSA-usb-audio-Fix-an-out-of-bounds-bug-in-__snd_usb.patch (git-fixes CVE-2022-48701 bsc#1223921). - Update patches.suse/RDMA-irdma-Fix-drain-SQ-hang-with-no-completion.patch (jsc#SLE-18383 CVE-2022-48694 bsc#1223964). - Update patches.suse/RDMA-srp-Set-scmnd-result-only-when-scmnd-is-not-NUL.patch (git-fixes CVE-2022-48692 bsc#1223962). - Update patches.suse/cgroup-Add-missing-cpus_read_lock-to-cgroup_attach_task_all.patch (bsc#1196869 CVE-2022-48671 bsc#1223929). - Update patches.suse/drm-radeon-add-a-force-flush-to-delay-work-when-rade.patch (git-fixes CVE-2022-48704 bsc#1223932). - Update patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch (jsc#SLE-18378 CVE-2022-48688 bsc#1223953). - Update patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952). - Update patches.suse/net-smc-Fix-possible-access-to-freed-memory-in-link-clear (git-fixes CVE-2022-48673 bsc#1223934). - Update patches.suse/nvme-tcp-fix-uaf-when-detecting-digest-errors.patch (bsc#1200313 bsc#1201489 CVE-2022-48686 bsc#1223948). - Update patches.suse/nvmet-fix-a-use-after-free.patch (git-fixes CVE-2022-48697 bsc#1223922). - Update patches.suse/of-fdt-fix-off-by-one-error-in-unflatten_dt_nodes.patch (git-fixes CVE-2022-48672 bsc#1223931). - Update patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch (git-fixes CVE-2022-48695 bsc#1223941). - Update patches.suse/soc-brcmstb-pm-arm-Fix-refcount-leak-and-__iomem-lea.patch (git-fixes CVE-2022-48693 bsc#1223963). - Update patches.suse/thermal-int340x_thermal-handle-data_vault-when-the-v.patch (bsc#1201308 CVE-2022-48703 bsc#1223924). - Update patches.suse/vfio-type1-Unpin-zero-pages.patch (git-fixes CVE-2022-48700 bsc#1223957). - commit c8677b5 - Update patches.suse/ice-Fix-DMA-mappings-leak.patch (jsc#PED-376 CVE-2022-48690 bsc#1223960). - commit 7e1bf3d - Update patches.suse/1576-drm-amd-display-fix-memory-leak-when-using-debugfs_l.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 jsc#PED-2849 CVE-2022-48698 bsc#1223956). - commit a0e3008 - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes). - commit 8f3269f - netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes). - commit 87e8a80 - Delete patches.suse/Revert-drm-qxl-simplify-qxl_fence_wait.patch and add the commit to blacklist.conf. - commit e221716 - Update patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch (git-fixes bsc#1223858). - commit e50ed21 - Add two patches to match SLE15-SP5: patches.suse/Revert-drm-qxl-simplify-qxl_fence_wait.patch patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch - commit f92ae49 - Update patches.suse/efi-libstub-Implement-support-for-unaccepted-memory.patch (jsc#PED-7167, bsc#1224169). - commit a57eb93 - smb: client: set correct id, uid and cruid for multiuser automounts (bsc#1223011, CVE-2024-26822). - commit 04cc660 - blacklist.conf: added fix that needs code not present - commit 9671fd4 - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756). - commit 7a7f193 - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6 netrom: Fix data-races around sysctl_net_busy_read (CVE-2024-27419 bsc#1224759) - commit b538410 - Refresh patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch This fixes following build warning: Changed build warnings: * **** 1 warnings ***** * comparison of distinct pointer types lacks a cast in ../kernel/dma/swiotlb.c in swiotlb_do_find_slots (from ../include/linux/minmax.h) In file included from ../include/linux/kernel.h:17:0, ../kernel/dma/swiotlb.c: In function 'swiotlb_do_find_slots': ../include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast ../include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' ../include/linux/minmax.h:36:24: note: in expansion of macro '__safe_cmp' ../include/linux/minmax.h:52:19: note: in expansion of macro '__careful_cmp' ../kernel/dma/swiotlb.c:648:12: note: in expansion of macro 'max' - commit a52b0ca - bpf: remove unnecessary prune and jump points (bsc#1225756). - bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756). - bpf: decouple prune and jump points (bsc#1225756). - commit 574a67d - cifs: fix underflow in parse_server_interfaces() (bsc#1223084, CVE-2024-26828). - commit cade548 - Update patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch (git-fixes bsc#1223675 CVE-2024-269355). Adding the CVE references. - commit 2df316d - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548) - commit b006eef - smb: client: fix potential deadlock when releasing mids (bsc#1224020, bsc#1225548, CVE-2023-52757). - commit edc36f8 - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224020, bsc#1224549, CVE-2024-35998). - commit fbb4c17 - vhost-vdpa: fix use after free in vhost_vdpa_probe() (CVE-2023-52795 bsc#1225085). - commit 423f910 - bpf: Protect against int overflow for stack access size (bsc#1224488 CVE-2024-35905). - commit 1edb341 - kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756). - commit b5b7cd0 - Update references - commit 006ab15 - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921 bsc#1223138). - commit fb20c1d - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938). - commit 38f788d - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575 CVE-2024-35976). - commit bc0a82d - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138). - commit 68cb9bf - usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924 bsc#1224657). - commit 578815c - smb: client: set correct id, uid and cruid for multiuser automounts (bsc#1223011, CVE-2024-26822). - commit 04cc660 - blacklist.conf: added fix that needs code not present - commit 9671fd4 - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756). - commit 7a7f193 - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6 netrom: Fix data-races around sysctl_net_busy_read (CVE-2024-27419 bsc#1224759) - commit b538410 - Refresh patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch This fixes following build warning: Changed build warnings: * **** 1 warnings ***** * comparison of distinct pointer types lacks a cast in ../kernel/dma/swiotlb.c in swiotlb_do_find_slots (from ../include/linux/minmax.h) In file included from ../include/linux/kernel.h:17:0, ../kernel/dma/swiotlb.c: In function 'swiotlb_do_find_slots': ../include/linux/minmax.h:20:28: warning: comparison of distinct pointer types lacks a cast ../include/linux/minmax.h:26:4: note: in expansion of macro '__typecheck' ../include/linux/minmax.h:36:24: note: in expansion of macro '__safe_cmp' ../include/linux/minmax.h:52:19: note: in expansion of macro '__careful_cmp' ../kernel/dma/swiotlb.c:648:12: note: in expansion of macro 'max' - commit a52b0ca - bpf: remove unnecessary prune and jump points (bsc#1225756). - bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756). - bpf: decouple prune and jump points (bsc#1225756). - commit 574a67d - cifs: fix underflow in parse_server_interfaces() (bsc#1223084, CVE-2024-26828). - commit cade548 - Update patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch (git-fixes bsc#1223675 CVE-2024-269355). Adding the CVE references. - commit 2df316d - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548) - commit b006eef - smb: client: fix potential deadlock when releasing mids (bsc#1224020, bsc#1225548, CVE-2023-52757). - commit edc36f8 - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224020, bsc#1224549, CVE-2024-35998). - commit fbb4c17 - vhost-vdpa: fix use after free in vhost_vdpa_probe() (CVE-2023-52795 bsc#1225085). - commit 423f910 - bpf: Protect against int overflow for stack access size (bsc#1224488 CVE-2024-35905). - commit 1edb341 - kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756). - commit b5b7cd0 - Update references - commit 006ab15 - inet: inet_defrag: prevent sk release while still in use (CVE-2024-26921 bsc#1223138). - commit fb20c1d - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938). - commit 38f788d - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575 CVE-2024-35976). - commit bc0a82d - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138). - commit 68cb9bf - usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924 bsc#1224657). - commit 578815c - iommu: Return right value in iommu_sva_bind_device() (git-fixes). - iommu/amd: Fix sysfs leak in iommu init (git-fixes). - commit 89e035d - iommu: mtk: fix module autoloading (git-fixes). - commit 8d5ca45 - smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103, CVE-2024-39468). - commit ef9e40f - arm64: mm: Don't remap pgtables for allocate vs populate (jsc#PED-8690). - arm64: mm: Batch dsb and isb when populating pgtables (jsc#PED-8690). - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block (jsc#PED-8690). - arm64: mm: don't acquire mutex when rewriting swapper (jsc#PED-8690). - commit 911eabe - net/9p: fix uninit-value in p9_client_rpc() (CVE-2024-39301 bsc#1226994). - commit b325415 - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1) (git-fixes). - gpio: davinci: Validate the obtained number of IRQs (git-fixes). - commit dc60c09 - i2c: testunit: discard write requests while old command is running (git-fixes). - i2c: testunit: don't erase registers after STOP (git-fixes). - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() (git-fixes). - mmc: sdhci: Do not invert write-protect twice (git-fixes). - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos (git-fixes). - commit 958e336 - ata: ahci: Clean up sysfs file on error (git-fixes). - ata: libata-core: Fix double free on error (git-fixes). - ata: libata-core: Fix null pointer dereference on error (git-fixes). - kbuild: Install dtb files as 0644 in Makefile.dtbinst (git-fixes). - iio: chemical: bme680: Fix sensor data read operation (git-fixes). - iio: chemical: bme680: Fix overflows in compensate() functions (git-fixes). - iio: chemical: bme680: Fix calibration data variable (git-fixes). - iio: chemical: bme680: Fix pressure value output (git-fixes). - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF (git-fixes). - iio: adc: ad7266: Fix variable checking bug (git-fixes). - tty: mcf: MCF54418 has 10 UARTS (git-fixes). - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock (git-fixes). - usb: musb: da8xx: fix a resource leak in probe() (git-fixes). - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (git-fixes). - usb: gadget: printer: fix races against disable (git-fixes). - commit 201a936 - net: ena: Fix redundant device NUMA node override (jsc#PED-8690). - commit 629130c - tcp: do not accept ACK of bytes we never sent (CVE-2023-52881 bsc#1225611). - commit ab5f35b - Update patches.suse/1203-drm-mxsfb-Fix-NULL-pointer-dereference.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 CVE-2022-48718 bsc#1226616). - Update patches.suse/1250-drm-amd-display-Wrap-dcn301_calculate_wm_and_dlg-for.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 CVE-2022-48766 bsc#1226704). - Update patches.suse/1327-drm-msm-Fix-null-ptr-access-msm_ioctl_gem_submit.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 CVE-2021-47610 bsc#1226581). - Update patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch (stable-fixes CVE-2024-38600 bsc#1226864). - Update patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch (git-fixes CVE-2024-38605 bsc#1226740). - Update patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch (git-fixes CVE-2024-38388 bsc#1226890). - Update patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch (stable-fixes git-fixes CVE-2024-38618 bsc#1226754). - Update patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch (git-fixes CVE-2024-38550 bsc#1226633). - Update patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch (git-fixes CVE-2023-52884 bsc#1226764). - Update patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch (git-fixes CVE-2024-36975 bsc#1226520). - Update patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch (git-fixes CVE-2024-36967 bsc#1226131). - Update patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch (git-fixes CVE-2024-38591 bsc#1226738). - Update patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch (git-fixes CVE-2024-38590 bsc#1226839). - Update patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch (git-fixes CVE-2024-38544 bsc#1226597). - Update patches.suse/block-fix-memory-leak-in-disk_register_independent_a.patch (jsc#PED-1183 CVE-2022-48753 bsc#1226693). - Update patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch (git-fixes CVE-2024-38540 bsc#1226582). - Update patches.suse/bpf-Guard-against-accessing-NULL-pt_regs-in-bpf_get_.patch (jsc#PED-1377 CVE-2022-48770 bsc#1226730). - Update patches.suse/bpf-Use-VM_MAP-instead-of-VM_ALLOC-for-ringbuf.patch (jsc#PED-1377 CVE-2022-48714 bsc#1226622). - Update patches.suse/btrfs-fix-use-after-free-after-failure-to-create-a-s.patch (git-fixes CVE-2022-48733 bsc#1226718). - Update patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch (git-fixes CVE-2024-38573 bsc#1226739). - Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch (git-fixes CVE-2024-38579 bsc#1226637). - Update patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch (stable-fixes CVE-2024-36969 bsc#1226155). - Update patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch (git-fixes CVE-2024-38552 bsc#1226767). - Update patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch (stable-fixes CVE-2024-39471 bsc#1227096). - Update patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch (stable-fixes CVE-2024-38581 bsc#1226657). - Update patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch (git-fixes CVE-2024-38548). - Update patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch (git-fixes CVE-2024-38549 bsc#1226735). - Update patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch (git-fixes CVE-2024-38390 bsc#1226891). - Update patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch (git-fixes CVE-2024-38546 bsc#1226593). - Update patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch (git-fixes CVE-2024-36960 bsc#1225872). - Update patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch (git-fixes CVE-2024-33619 bsc#1226768). - Update patches.suse/io-wq-check-for-wq-exit-after-adding-new-worker-task.patch (bsc#1205205 CVE-2021-47577 bsc#1226538). - Update patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch (git-fixes CVE-2024-38599 bsc#1226848). - Update patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch (git-fixes CVE-2024-38547 bsc#1226632). - Update patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch (stable-fixes CVE-2022-48772 bsc#1226976). - Update patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch (git-fixes CVE-2024-38621 bsc#1226895). - Update patches.suse/net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch (git-fixes CVE-2022-48748 bsc#1226647). - Update patches.suse/net-sched-sch_ets-don-t-remove-idle-classes-from-the.patch (bsc#1207361 CVE-2021-47595 bsc#1226552). - Update patches.suse/netfilter-complete-validation-of-user-input.patch (CVE-2024-35896 bsc#1224662 git-fixes CVE-2024-35962 bsc#1224583). - Update patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch (git-fixes CVE-2024-38381 bsc#1226878). - Update patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch (stable-fixes CVE-2024-38582 bsc#1226658). - Update patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch (git-fixes CVE-2024-38583 bsc#1226777). - Update patches.suse/powerpc64-bpf-Limit-ldbrx-to-processors-compliant-wi.patch (jsc#PED-1377 CVE-2022-48755 bsc#1226706). - Update patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch (git-fixes CVE-2024-36965 bsc#1226149). - Update patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch (bsc#1222893 CVE-2024-38601 bsc#1226876). - Update patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch (git-fixes CVE-2024-36025 bsc#1225704). - Update patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch (git-fixes CVE-2024-38634 bsc#1226868). - Update patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch (git-fixes CVE-2024-38633 bsc#1226867). - Update patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch (stable-fixes CVE-2024-38635 bsc#1226863). - Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch (git-fixes CVE-2024-38587 bsc#1226780). - Update patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch (bsc#1224331 CVE-2024-35814 bsc#1224602). - Update patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch (git-fixes CVE-2024-38571 bsc#1226737). - Update patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-TPM-SPI-xfer-buffer.patch (bsc#1225535 CVE-2024-36477 bsc#1226840). - Update patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch (git-fixes CVE-2024-38619 bsc#1226861). - Update patches.suse/vduse-check-that-offset-is-within-bounds-in-get_conf.patch (jsc#PED-1549 CVE-2021-47604 bsc#1226566). - Update patches.suse/vduse-fix-memory-corruption-in-vduse_dev_ioctl.patch (jsc#PED-1549 CVE-2021-47605 bsc#1226579). - Update patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch (git-fixes CVE-2024-38630 bsc#1226908). - Update patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch (git-fixes CVE-2024-38565 bsc#1226747). - Update patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch (git-fixes CVE-2024-38567 bsc#1226769). - Update patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch (git-fixes CVE-2024-38616 bsc#1226852). - commit efd69a4 - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (CVE-2024-36904 bsc#1225732). - commit 975b193 - X.509: Fix the parser of extended key usage for length (bsc#1218820). - commit c5d6d23 - Update patches.suse/0001-dm-btree-remove-fix-use-after-free-in-rebalance_chil.patch (git-fixes CVE-2021-47600 bsc#1226575). - Update patches.suse/ALSA-hda-Fix-UAF-of-leds-class-devs-at-unbinding.patch (bsc#1195349 CVE-2022-48735 bsc#1226719). - Update patches.suse/ARM-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch (git-fixes CVE-2021-47618 bsc#1226644). - Update patches.suse/ASoC-hdmi-codec-Fix-OOB-memory-accesses.patch (git-fixes CVE-2022-48739 bsc#1226675). - Update patches.suse/ASoC-max9759-fix-underflow-in-speaker_gain_control_p.patch (git-fixes CVE-2022-48717 bsc#1226679). - Update patches.suse/ASoC-ops-Reject-out-of-bounds-values-in-snd_soc_put_-4cf28e9ae6e2.patch (git-fixes CVE-2022-48736 bsc#1226721). - Update patches.suse/ASoC-ops-Reject-out-of-bounds-values-in-snd_soc_put_-4f1e50d6a9cf.patch (git-fixes CVE-2022-48737 bsc#1226762). - Update patches.suse/ASoC-ops-Reject-out-of-bounds-values-in-snd_soc_put_.patch (git-fixes CVE-2022-48738 bsc#1226674). - Update patches.suse/Bluetooth-refactor-malicious-adv-data-check.patch (git-fixes CVE-2021-47620 bsc#1226669). - Update patches.suse/IB-hfi1-Fix-AIP-early-init-panic.patch (git-fixes CVE-2022-48728 bsc#1226691). - Update patches.suse/IB-hfi1-Fix-panic-with-larger-ipoib-send_queue_size.patch (jsc#SLE-19242 CVE-2022-48729 bsc#1226710). - Update patches.suse/KVM-LAPIC-Also-cancel-preemption-timer-during-SET_LA.patch (git-fixes CVE-2022-48765 bsc#1226697). - Update patches.suse/KVM-arm64-Avoid-consuming-a-stale-esr-value-when-SEr.patch (git-fixes CVE-2022-48727 bsc#1226690). - Update patches.suse/KVM-x86-Forcibly-leave-nested-virt-when-SMM-state-is.patch (git-fixes CVE-2022-48763 bsc#1226628). - Update patches.suse/PCI-pciehp-Fix-infinite-loop-in-IRQ-handler-upon-pow.patch (git-fixes CVE-2021-47617 bsc#1226614). - Update patches.suse/RDMA-Fix-use-after-free-in-rxe_queue_cleanup.patch (jsc#SLE-19249 CVE-2021-47616 bsc#1226603). - Update patches.suse/RDMA-irdma-Fix-a-user-after-free-in-add_pble_prm.patch (jsc#SLE-18383 CVE-2021-47614 bsc#1226601). - Update patches.suse/RDMA-mlx5-Fix-releasing-unallocated-memory-in-dereg-.patch (jsc#SLE-19253 CVE-2021-47615 bsc#1226602). - Update patches.suse/RDMA-siw-Fix-refcounting-leak-in-siw_create_qp.patch (jsc#SLE-19249 CVE-2022-48725 bsc#1226618). - Update patches.suse/RDMA-ucma-Protect-mc-during-concurrent-multicast-lea.patch (git-fixes CVE-2022-48726 bsc#1226686). - Update patches.suse/USB-core-Fix-hang-in-usb_kill_urb-by-adding-memory-b.patch (git-fixes CVE-2022-48760 bsc#1226712). - Update patches.suse/USB-core-Make-do_proc_control-and-do_proc_bulk-killa.patch (git-fixes CVE-2021-47582 bsc#1226559). - Update patches.suse/audit-improve-robustness-of-the-audit-queue-handling.patch (git-fixes CVE-2021-47603 bsc#1226577). - Update patches.suse/block-Fix-wrong-offset-in-bio_truncate.patch (bsc#1202780 CVE-2022-48747 bsc#1226643). - Update patches.suse/bpf-Fix-kernel-address-leakage-in-atomic-cmpxchg-s-r.patch (git-fixes CVE-2021-47607 bsc#1226580). - Update patches.suse/bpf-Fix-kernel-address-leakage-in-atomic-fetch.patch (bsc#1193883 bsc#1194826 CVE-2022-0264 CVE-2021-47608 bsc#1226569). - Update patches.suse/bpf-Protect-against-int-overflow-for-stack-access-si.patch (bsc#1224488 CVE-2024-35905). - Update patches.suse/btrfs-fix-deadlock-between-quota-disable-and-qgroup-.patch (bsc#1199295 CVE-2022-48734 bsc#1226626). - Update patches.suse/btrfs-fix-memory-leak-in-__add_inode_ref.patch (bsc#1197915 CVE-2021-47585 bsc#1226556). - Update patches.suse/ceph-properly-put-ceph_string-reference-after-async-create-attempt.patch (bsc#1195341 CVE-2022-48767 bsc#1226715). - Update patches.suse/dma-buf-heaps-Fix-potential-spectre-v1-gadget.patch (git-fixes CVE-2022-48730 bsc#1226713). - Update patches.suse/drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch (git-fixes CVE-2022-48749 bsc#1226650). - Update patches.suse/drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch (git-fixes CVE-2022-48756 bsc#1226698). - Update patches.suse/drm-nouveau-fix-off-by-one-in-BIOS-boundary-checking.patch (git-fixes CVE-2022-48732 bsc#1226716). - Update patches.suse/drm-vc4-kms-Add-missing-drm_crtc_commit_put.patch (git-fixes CVE-2021-47534). - Update patches.suse/drm-vmwgfx-Fix-stale-file-descriptors-on-failed-user.patch (CVE-2022-22942 bsc#1195065 CVE-2022-48771 bsc#1226732). - Update patches.suse/efi-runtime-avoid-EFIv2-runtime-services-on-Apple-x8.patch (git-fixes CVE-2022-48769 bsc#1226629). - Update patches.suse/ext4-fix-error-handling-in-ext4_fc_record_modified_i.patch (bsc#1202767 CVE-2022-48712 bsc#1226673). - Update patches.suse/firmware-arm_scpi-Fix-string-overflow-in-SCPI-genpd-.patch (git-fixes CVE-2021-47609 bsc#1226562). - Update patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch (git-fixes CVE-2023-52766). - Update patches.suse/i40e-Fix-queues-reservation-for-XDP.patch (git-fixes CVE-2021-47619 bsc#1226645). - Update patches.suse/igbvf-fix-double-free-in-igbvf_probe.patch (jsc#SLE-18379 CVE-2021-47589 bsc#1226557). - Update patches.suse/inet_diag-fix-kernel-infoleak-for-UDP-sockets.patch (git-fixes CVE-2021-47597 bsc#1226553). - Update patches.suse/iocost-Fix-divide-by-zero-on-donation-from-low-hweig.patch (bsc#1198014 CVE-2021-47584 bsc#1226564). - Update patches.suse/iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping (git-fixes CVE-2022-48724 bsc#1226624). - Update patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-.patch (stable-5.14.15 CVE-2021-43389 CVE-2021-3896 bsc#1191958 CVE-2021-4439 bsc#1226670). - Update patches.suse/mac80211-track-only-QoS-data-frames-for-admission-co.patch (git-fixes CVE-2021-47602 bsc#1226554). - Update patches.suse/mac80211-validate-extended-element-ID-is-present.patch (git-fixes CVE-2021-47611 bsc#1226583). - Update patches.suse/media-mxl111sf-change-mutex_init-location.patch (git-fixes CVE-2021-47583 bsc#1226563). - Update patches.suse/net-amd-xgbe-Fix-skb-data-length-underflow.patch (git-fixes CVE-2022-48743 bsc#1226705). - Update patches.suse/net-hns3-fix-use-after-free-bug-in-hclgevf_send_mbx_.patch (bsc#1190336 CVE-2021-47596 bsc#1226558). - Update patches.suse/net-ieee802154-ca8210-Stop-leaking-skb-s.patch (git-fixes CVE-2022-48722 bsc#1226619). - Update patches.suse/net-macsec-Fix-offload-support-for-NETDEV_UNREGISTER.patch (git-fixes CVE-2022-48720 bsc#1226683). - Update patches.suse/net-mlx5-Use-del_timer_sync-in-fw-reset-flow-of-halt.patch (git-fixes CVE-2022-48745 bsc#1226702). - Update patches.suse/net-mlx5e-Avoid-field-overflowing-memcpy.patch (git-fixes CVE-2022-48744 bsc#1226696). - Update patches.suse/net-mlx5e-Fix-handling-of-wrong-devices-during-bond-.patch (git-fixes CVE-2022-48746 bsc#1226703). - Update patches.suse/net-smc-Forward-wakeup-to-smc-socket-waitqueue-after-fallback (git-fixes CVE-2022-48721 bsc#1226685). - Update patches.suse/net-smc-Transitional-solution-for-clcsock-race-issue (git-fixes CVE-2022-48751 bsc#1226653). - Update patches.suse/net-stmmac-dwmac-rk-fix-oob-read-in-rk_gmac_setup.patch (git-fixes CVE-2021-47586 bsc#1226561). - Update patches.suse/net-stmmac-fix-tc-flower-deletion-for-VLAN-priority-.patch (git-fixes CVE-2021-47592 bsc#1226572). - Update patches.suse/net-systemport-Add-global-locking-for-descriptor-lif.patch (git-fixes CVE-2021-47587 bsc#1226567). - Update patches.suse/nfc-fix-segfault-in-nfc_genl_dump_devices_done.patch (git-fixes CVE-2021-47612 bsc#1226585). - Update patches.suse/of-module-prevent-NULL-pointer-dereference-in-vsnprintf.patch (bsc#1226587 CVE-2024-38541 CVE-2024-35878 bsc#1224671). - Update patches.suse/perf-x86-intel-pt-Fix-crash-with-stop-filters-in-single-range-mode.patch (git fixes CVE-2022-48713). - Update patches.suse/phylib-fix-potential-use-after-free.patch (git-fixes CVE-2022-48754 bsc#1226692). - Update patches.suse/powerpc-perf-Fix-power_pmu_disable-to-call-clear_pmi.patch (bsc#1156395 CVE-2022-48752 bsc#1226709). - Update patches.suse/rpmsg-char-Fix-race-between-the-release-of-rpmsg_ctr.patch (git-fixes CVE-2022-48759 bsc#1226711). - Update patches.suse/scsi-bnx2fc-Flush-destroy_work-queue-before-calling-bnx2fc_interface_put (git-fixes bsc#1196746 CVE-2022-48758 bsc#1226708). - Update patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe (git-fixes bsc#1196746 CVE-2022-48715 bsc#1226621). - Update patches.suse/scsi-scsi_debug-Don-t-call-kcalloc-if-size-arg-is-zero.patch (git-fixes CVE-2021-47578 bsc#1226539). - Update patches.suse/scsi-scsi_debug-Fix-type-in-min_t-to-avoid-stack-OOB.patch (git-fixes CVE-2021-47580 bsc#1226550). - Update patches.suse/scsi-scsi_debug-Sanity-check-block-descriptor-length-in-resp_mode_select.patch (git-fixes CVE-2021-47576 bsc#1226537). - Update patches.suse/selinux-fix-double-free-of-cond_list-on-error-paths.patch (git-fixes CVE-2022-48740 bsc#1226699). - Update patches.suse/spi-uniphier-fix-reference-count-leak-in-uniphier_sp.patch (git-fixes CVE-2022-48723 bsc#1226617). - Update patches.suse/tee-amdtee-fix-an-IS_ERR-vs-NULL-bug.patch (jsc#SLE-21844 CVE-2021-47601 bsc#1226576). - Update patches.suse/tipc-improve-size-validations-for-received-domain-re.patch (bsc#1195254 CVE-2022-0435 CVE-2022-48711 bsc#1226672). - Update patches.suse/tracing-histogram-Fix-a-potential-memory-leak-for-kstrdup.patch (git-fixes CVE-2022-48768 bsc#1226720). - Update patches.suse/usb-xhci-plat-fix-crash-when-suspend-if-remote-wake-.patch (git-fixes CVE-2022-48761 bsc#1226701). - Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch (git-fixes CVE-2023-52800). - commit cc322a0 - mtd: rawnand: rockchip: ensure NVDDR timings are rejected (git-fixes). - mtd: rawnand: Bypass a couple of sanity checks during NAND identification (git-fixes). - mtd: rawnand: Ensure ECC configuration is propagated to upper layers (git-fixes). - commit 69e8827 - kernel-doc: fix struct_group_tagged() parsing (git-fixes). - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg (git-fixes). - commit d600a63 - kbuild: do not include include/config/auto.conf from shell scripts (bsc#1227274). - commit c743753 - btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101 CVE-2024-37354). - commit 899b45b - btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted (bsc#1221282). - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282 CVE-2024-26644 bsc#1222072). - commit 7829d14 - hsr: Prevent use after free in prp_create_tagged_frame() (CVE-2023-52846 bsc#1225098). - commit 74c7662 - iommu: Return right value in iommu_sva_bind_device() (git-fixes). - iommu/amd: Fix sysfs leak in iommu init (git-fixes). - commit 89e035d - iommu: mtk: fix module autoloading (git-fixes). - commit 8d5ca45 - smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103, CVE-2024-39468). - commit ef9e40f - arm64: mm: Don't remap pgtables for allocate vs populate (jsc#PED-8690). - arm64: mm: Batch dsb and isb when populating pgtables (jsc#PED-8690). - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block (jsc#PED-8690). - arm64: mm: don't acquire mutex when rewriting swapper (jsc#PED-8690). - commit 911eabe - net/9p: fix uninit-value in p9_client_rpc() (CVE-2024-39301 bsc#1226994). - commit b325415 - gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1) (git-fixes). - gpio: davinci: Validate the obtained number of IRQs (git-fixes). - commit dc60c09 - i2c: testunit: discard write requests while old command is running (git-fixes). - i2c: testunit: don't erase registers after STOP (git-fixes). - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() (git-fixes). - mmc: sdhci: Do not invert write-protect twice (git-fixes). - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos (git-fixes). - commit 958e336 - ata: ahci: Clean up sysfs file on error (git-fixes). - ata: libata-core: Fix double free on error (git-fixes). - ata: libata-core: Fix null pointer dereference on error (git-fixes). - kbuild: Install dtb files as 0644 in Makefile.dtbinst (git-fixes). - iio: chemical: bme680: Fix sensor data read operation (git-fixes). - iio: chemical: bme680: Fix overflows in compensate() functions (git-fixes). - iio: chemical: bme680: Fix calibration data variable (git-fixes). - iio: chemical: bme680: Fix pressure value output (git-fixes). - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF (git-fixes). - iio: adc: ad7266: Fix variable checking bug (git-fixes). - tty: mcf: MCF54418 has 10 UARTS (git-fixes). - usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock (git-fixes). - usb: musb: da8xx: fix a resource leak in probe() (git-fixes). - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (git-fixes). - usb: gadget: printer: fix races against disable (git-fixes). - commit 201a936 - net: ena: Fix redundant device NUMA node override (jsc#PED-8690). - commit 629130c - tcp: do not accept ACK of bytes we never sent (CVE-2023-52881 bsc#1225611). - commit ab5f35b - Update patches.suse/1203-drm-mxsfb-Fix-NULL-pointer-dereference.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 CVE-2022-48718 bsc#1226616). - Update patches.suse/1250-drm-amd-display-Wrap-dcn301_calculate_wm_and_dlg-for.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 CVE-2022-48766 bsc#1226704). - Update patches.suse/1327-drm-msm-Fix-null-ptr-access-msm_ioctl_gem_submit.patch (jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 CVE-2021-47610 bsc#1226581). - Update patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch (stable-fixes CVE-2024-38600 bsc#1226864). - Update patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch (git-fixes CVE-2024-38605 bsc#1226740). - Update patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch (git-fixes CVE-2024-38388 bsc#1226890). - Update patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch (stable-fixes git-fixes CVE-2024-38618 bsc#1226754). - Update patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch (git-fixes CVE-2024-38550 bsc#1226633). - Update patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch (git-fixes CVE-2023-52884 bsc#1226764). - Update patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch (git-fixes CVE-2024-36975 bsc#1226520). - Update patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch (git-fixes CVE-2024-36967 bsc#1226131). - Update patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch (git-fixes CVE-2024-38591 bsc#1226738). - Update patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch (git-fixes CVE-2024-38590 bsc#1226839). - Update patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch (git-fixes CVE-2024-38544 bsc#1226597). - Update patches.suse/block-fix-memory-leak-in-disk_register_independent_a.patch (jsc#PED-1183 CVE-2022-48753 bsc#1226693). - Update patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch (git-fixes CVE-2024-38540 bsc#1226582). - Update patches.suse/bpf-Guard-against-accessing-NULL-pt_regs-in-bpf_get_.patch (jsc#PED-1377 CVE-2022-48770 bsc#1226730). - Update patches.suse/bpf-Use-VM_MAP-instead-of-VM_ALLOC-for-ringbuf.patch (jsc#PED-1377 CVE-2022-48714 bsc#1226622). - Update patches.suse/btrfs-fix-use-after-free-after-failure-to-create-a-s.patch (git-fixes CVE-2022-48733 bsc#1226718). - Update patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch (git-fixes CVE-2024-38573 bsc#1226739). - Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch (git-fixes CVE-2024-38579 bsc#1226637). - Update patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch (stable-fixes CVE-2024-36969 bsc#1226155). - Update patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch (git-fixes CVE-2024-38552 bsc#1226767). - Update patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch (stable-fixes CVE-2024-39471 bsc#1227096). - Update patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch (stable-fixes CVE-2024-38581 bsc#1226657). - Update patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch (git-fixes CVE-2024-38548). - Update patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch (git-fixes CVE-2024-38549 bsc#1226735). - Update patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch (git-fixes CVE-2024-38390 bsc#1226891). - Update patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch (git-fixes CVE-2024-38546 bsc#1226593). - Update patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch (git-fixes CVE-2024-36960 bsc#1225872). - Update patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch (git-fixes CVE-2024-33619 bsc#1226768). - Update patches.suse/io-wq-check-for-wq-exit-after-adding-new-worker-task.patch (bsc#1205205 CVE-2021-47577 bsc#1226538). - Update patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch (git-fixes CVE-2024-38599 bsc#1226848). - Update patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch (git-fixes CVE-2024-38547 bsc#1226632). - Update patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch (stable-fixes CVE-2022-48772 bsc#1226976). - Update patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch (git-fixes CVE-2024-38621 bsc#1226895). - Update patches.suse/net-bridge-vlan-fix-memory-leak-in-__allowed_ingress.patch (git-fixes CVE-2022-48748 bsc#1226647). - Update patches.suse/net-sched-sch_ets-don-t-remove-idle-classes-from-the.patch (bsc#1207361 CVE-2021-47595 bsc#1226552). - Update patches.suse/netfilter-complete-validation-of-user-input.patch (CVE-2024-35896 bsc#1224662 git-fixes CVE-2024-35962 bsc#1224583). - Update patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch (git-fixes CVE-2024-38381 bsc#1226878). - Update patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch (stable-fixes CVE-2024-38582 bsc#1226658). - Update patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch (git-fixes CVE-2024-38583 bsc#1226777). - Update patches.suse/powerpc64-bpf-Limit-ldbrx-to-processors-compliant-wi.patch (jsc#PED-1377 CVE-2022-48755 bsc#1226706). - Update patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch (git-fixes CVE-2024-36965 bsc#1226149). - Update patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch (bsc#1222893 CVE-2024-38601 bsc#1226876). - Update patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch (git-fixes CVE-2024-36025 bsc#1225704). - Update patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch (git-fixes CVE-2024-38634 bsc#1226868). - Update patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch (git-fixes CVE-2024-38633 bsc#1226867). - Update patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch (stable-fixes CVE-2024-38635 bsc#1226863). - Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch (git-fixes CVE-2024-38587 bsc#1226780). - Update patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch (bsc#1224331 CVE-2024-35814 bsc#1224602). - Update patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch (git-fixes CVE-2024-38571 bsc#1226737). - Update patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-TPM-SPI-xfer-buffer.patch (bsc#1225535 CVE-2024-36477 bsc#1226840). - Update patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch (git-fixes CVE-2024-38619 bsc#1226861). - Update patches.suse/vduse-check-that-offset-is-within-bounds-in-get_conf.patch (jsc#PED-1549 CVE-2021-47604 bsc#1226566). - Update patches.suse/vduse-fix-memory-corruption-in-vduse_dev_ioctl.patch (jsc#PED-1549 CVE-2021-47605 bsc#1226579). - Update patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch (git-fixes CVE-2024-38630 bsc#1226908). - Update patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch (git-fixes CVE-2024-38565 bsc#1226747). - Update patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch (git-fixes CVE-2024-38567 bsc#1226769). - Update patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch (git-fixes CVE-2024-38616 bsc#1226852). - commit efd69a4 - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (CVE-2024-36904 bsc#1225732). - commit 975b193 - X.509: Fix the parser of extended key usage for length (bsc#1218820). - commit c5d6d23 - Update patches.suse/0001-dm-btree-remove-fix-use-after-free-in-rebalance_chil.patch (git-fixes CVE-2021-47600 bsc#1226575). - Update patches.suse/ALSA-hda-Fix-UAF-of-leds-class-devs-at-unbinding.patch (bsc#1195349 CVE-2022-48735 bsc#1226719). - Update patches.suse/ARM-9170-1-fix-panic-when-kasan-and-kprobe-are-enabl.patch (git-fixes CVE-2021-47618 bsc#1226644). - Update patches.suse/ASoC-hdmi-codec-Fix-OOB-memory-accesses.patch (git-fixes CVE-2022-48739 bsc#1226675). - Update patches.suse/ASoC-max9759-fix-underflow-in-speaker_gain_control_p.patch (git-fixes CVE-2022-48717 bsc#1226679). - Update patches.suse/ASoC-ops-Reject-out-of-bounds-values-in-snd_soc_put_-4cf28e9ae6e2.patch (git-fixes CVE-2022-48736 bsc#1226721). - Update patches.suse/ASoC-ops-Reject-out-of-bounds-values-in-snd_soc_put_-4f1e50d6a9cf.patch (git-fixes CVE-2022-48737 bsc#1226762). - Update patches.suse/ASoC-ops-Reject-out-of-bounds-values-in-snd_soc_put_.patch (git-fixes CVE-2022-48738 bsc#1226674). - Update patches.suse/Bluetooth-refactor-malicious-adv-data-check.patch (git-fixes CVE-2021-47620 bsc#1226669). - Update patches.suse/IB-hfi1-Fix-AIP-early-init-panic.patch (git-fixes CVE-2022-48728 bsc#1226691). - Update patches.suse/IB-hfi1-Fix-panic-with-larger-ipoib-send_queue_size.patch (jsc#SLE-19242 CVE-2022-48729 bsc#1226710). - Update patches.suse/KVM-LAPIC-Also-cancel-preemption-timer-during-SET_LA.patch (git-fixes CVE-2022-48765 bsc#1226697). - Update patches.suse/KVM-arm64-Avoid-consuming-a-stale-esr-value-when-SEr.patch (git-fixes CVE-2022-48727 bsc#1226690). - Update patches.suse/KVM-x86-Forcibly-leave-nested-virt-when-SMM-state-is.patch (git-fixes CVE-2022-48763 bsc#1226628). - Update patches.suse/PCI-pciehp-Fix-infinite-loop-in-IRQ-handler-upon-pow.patch (git-fixes CVE-2021-47617 bsc#1226614). - Update patches.suse/RDMA-Fix-use-after-free-in-rxe_queue_cleanup.patch (jsc#SLE-19249 CVE-2021-47616 bsc#1226603). - Update patches.suse/RDMA-irdma-Fix-a-user-after-free-in-add_pble_prm.patch (jsc#SLE-18383 CVE-2021-47614 bsc#1226601). - Update patches.suse/RDMA-mlx5-Fix-releasing-unallocated-memory-in-dereg-.patch (jsc#SLE-19253 CVE-2021-47615 bsc#1226602). - Update patches.suse/RDMA-siw-Fix-refcounting-leak-in-siw_create_qp.patch (jsc#SLE-19249 CVE-2022-48725 bsc#1226618). - Update patches.suse/RDMA-ucma-Protect-mc-during-concurrent-multicast-lea.patch (git-fixes CVE-2022-48726 bsc#1226686). - Update patches.suse/USB-core-Fix-hang-in-usb_kill_urb-by-adding-memory-b.patch (git-fixes CVE-2022-48760 bsc#1226712). - Update patches.suse/USB-core-Make-do_proc_control-and-do_proc_bulk-killa.patch (git-fixes CVE-2021-47582 bsc#1226559). - Update patches.suse/audit-improve-robustness-of-the-audit-queue-handling.patch (git-fixes CVE-2021-47603 bsc#1226577). - Update patches.suse/block-Fix-wrong-offset-in-bio_truncate.patch (bsc#1202780 CVE-2022-48747 bsc#1226643). - Update patches.suse/bpf-Fix-kernel-address-leakage-in-atomic-cmpxchg-s-r.patch (git-fixes CVE-2021-47607 bsc#1226580). - Update patches.suse/bpf-Fix-kernel-address-leakage-in-atomic-fetch.patch (bsc#1193883 bsc#1194826 CVE-2022-0264 CVE-2021-47608 bsc#1226569). - Update patches.suse/bpf-Protect-against-int-overflow-for-stack-access-si.patch (bsc#1224488 CVE-2024-35905). - Update patches.suse/btrfs-fix-deadlock-between-quota-disable-and-qgroup-.patch (bsc#1199295 CVE-2022-48734 bsc#1226626). - Update patches.suse/btrfs-fix-memory-leak-in-__add_inode_ref.patch (bsc#1197915 CVE-2021-47585 bsc#1226556). - Update patches.suse/ceph-properly-put-ceph_string-reference-after-async-create-attempt.patch (bsc#1195341 CVE-2022-48767 bsc#1226715). - Update patches.suse/dma-buf-heaps-Fix-potential-spectre-v1-gadget.patch (git-fixes CVE-2022-48730 bsc#1226713). - Update patches.suse/drm-msm-dpu-invalid-parameter-check-in-dpu_setup_dsp.patch (git-fixes CVE-2022-48749 bsc#1226650). - Update patches.suse/drm-msm-dsi-invalid-parameter-check-in-msm_dsi_phy_e.patch (git-fixes CVE-2022-48756 bsc#1226698). - Update patches.suse/drm-nouveau-fix-off-by-one-in-BIOS-boundary-checking.patch (git-fixes CVE-2022-48732 bsc#1226716). - Update patches.suse/drm-vc4-kms-Add-missing-drm_crtc_commit_put.patch (git-fixes CVE-2021-47534). - Update patches.suse/drm-vmwgfx-Fix-stale-file-descriptors-on-failed-user.patch (CVE-2022-22942 bsc#1195065 CVE-2022-48771 bsc#1226732). - Update patches.suse/efi-runtime-avoid-EFIv2-runtime-services-on-Apple-x8.patch (git-fixes CVE-2022-48769 bsc#1226629). - Update patches.suse/ext4-fix-error-handling-in-ext4_fc_record_modified_i.patch (bsc#1202767 CVE-2022-48712 bsc#1226673). - Update patches.suse/firmware-arm_scpi-Fix-string-overflow-in-SCPI-genpd-.patch (git-fixes CVE-2021-47609 bsc#1226562). - Update patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch (git-fixes CVE-2023-52766). - Update patches.suse/i40e-Fix-queues-reservation-for-XDP.patch (git-fixes CVE-2021-47619 bsc#1226645). - Update patches.suse/igbvf-fix-double-free-in-igbvf_probe.patch (jsc#SLE-18379 CVE-2021-47589 bsc#1226557). - Update patches.suse/inet_diag-fix-kernel-infoleak-for-UDP-sockets.patch (git-fixes CVE-2021-47597 bsc#1226553). - Update patches.suse/iocost-Fix-divide-by-zero-on-donation-from-low-hweig.patch (bsc#1198014 CVE-2021-47584 bsc#1226564). - Update patches.suse/iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping (git-fixes CVE-2022-48724 bsc#1226624). - Update patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-.patch (stable-5.14.15 CVE-2021-43389 CVE-2021-3896 bsc#1191958 CVE-2021-4439 bsc#1226670). - Update patches.suse/mac80211-track-only-QoS-data-frames-for-admission-co.patch (git-fixes CVE-2021-47602 bsc#1226554). - Update patches.suse/mac80211-validate-extended-element-ID-is-present.patch (git-fixes CVE-2021-47611 bsc#1226583). - Update patches.suse/media-mxl111sf-change-mutex_init-location.patch (git-fixes CVE-2021-47583 bsc#1226563). - Update patches.suse/net-amd-xgbe-Fix-skb-data-length-underflow.patch (git-fixes CVE-2022-48743 bsc#1226705). - Update patches.suse/net-hns3-fix-use-after-free-bug-in-hclgevf_send_mbx_.patch (bsc#1190336 CVE-2021-47596 bsc#1226558). - Update patches.suse/net-ieee802154-ca8210-Stop-leaking-skb-s.patch (git-fixes CVE-2022-48722 bsc#1226619). - Update patches.suse/net-macsec-Fix-offload-support-for-NETDEV_UNREGISTER.patch (git-fixes CVE-2022-48720 bsc#1226683). - Update patches.suse/net-mlx5-Use-del_timer_sync-in-fw-reset-flow-of-halt.patch (git-fixes CVE-2022-48745 bsc#1226702). - Update patches.suse/net-mlx5e-Avoid-field-overflowing-memcpy.patch (git-fixes CVE-2022-48744 bsc#1226696). - Update patches.suse/net-mlx5e-Fix-handling-of-wrong-devices-during-bond-.patch (git-fixes CVE-2022-48746 bsc#1226703). - Update patches.suse/net-smc-Forward-wakeup-to-smc-socket-waitqueue-after-fallback (git-fixes CVE-2022-48721 bsc#1226685). - Update patches.suse/net-smc-Transitional-solution-for-clcsock-race-issue (git-fixes CVE-2022-48751 bsc#1226653). - Update patches.suse/net-stmmac-dwmac-rk-fix-oob-read-in-rk_gmac_setup.patch (git-fixes CVE-2021-47586 bsc#1226561). - Update patches.suse/net-stmmac-fix-tc-flower-deletion-for-VLAN-priority-.patch (git-fixes CVE-2021-47592 bsc#1226572). - Update patches.suse/net-systemport-Add-global-locking-for-descriptor-lif.patch (git-fixes CVE-2021-47587 bsc#1226567). - Update patches.suse/nfc-fix-segfault-in-nfc_genl_dump_devices_done.patch (git-fixes CVE-2021-47612 bsc#1226585). - Update patches.suse/of-module-prevent-NULL-pointer-dereference-in-vsnprintf.patch (bsc#1226587 CVE-2024-38541 CVE-2024-35878 bsc#1224671). - Update patches.suse/perf-x86-intel-pt-Fix-crash-with-stop-filters-in-single-range-mode.patch (git fixes CVE-2022-48713). - Update patches.suse/phylib-fix-potential-use-after-free.patch (git-fixes CVE-2022-48754 bsc#1226692). - Update patches.suse/powerpc-perf-Fix-power_pmu_disable-to-call-clear_pmi.patch (bsc#1156395 CVE-2022-48752 bsc#1226709). - Update patches.suse/rpmsg-char-Fix-race-between-the-release-of-rpmsg_ctr.patch (git-fixes CVE-2022-48759 bsc#1226711). - Update patches.suse/scsi-bnx2fc-Flush-destroy_work-queue-before-calling-bnx2fc_interface_put (git-fixes bsc#1196746 CVE-2022-48758 bsc#1226708). - Update patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe (git-fixes bsc#1196746 CVE-2022-48715 bsc#1226621). - Update patches.suse/scsi-scsi_debug-Don-t-call-kcalloc-if-size-arg-is-zero.patch (git-fixes CVE-2021-47578 bsc#1226539). - Update patches.suse/scsi-scsi_debug-Fix-type-in-min_t-to-avoid-stack-OOB.patch (git-fixes CVE-2021-47580 bsc#1226550). - Update patches.suse/scsi-scsi_debug-Sanity-check-block-descriptor-length-in-resp_mode_select.patch (git-fixes CVE-2021-47576 bsc#1226537). - Update patches.suse/selinux-fix-double-free-of-cond_list-on-error-paths.patch (git-fixes CVE-2022-48740 bsc#1226699). - Update patches.suse/spi-uniphier-fix-reference-count-leak-in-uniphier_sp.patch (git-fixes CVE-2022-48723 bsc#1226617). - Update patches.suse/tee-amdtee-fix-an-IS_ERR-vs-NULL-bug.patch (jsc#SLE-21844 CVE-2021-47601 bsc#1226576). - Update patches.suse/tipc-improve-size-validations-for-received-domain-re.patch (bsc#1195254 CVE-2022-0435 CVE-2022-48711 bsc#1226672). - Update patches.suse/tracing-histogram-Fix-a-potential-memory-leak-for-kstrdup.patch (git-fixes CVE-2022-48768 bsc#1226720). - Update patches.suse/usb-xhci-plat-fix-crash-when-suspend-if-remote-wake-.patch (git-fixes CVE-2022-48761 bsc#1226701). - Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch (git-fixes CVE-2023-52800). - commit cc322a0 - mtd: rawnand: rockchip: ensure NVDDR timings are rejected (git-fixes). - mtd: rawnand: Bypass a couple of sanity checks during NAND identification (git-fixes). - mtd: rawnand: Ensure ECC configuration is propagated to upper layers (git-fixes). - commit 69e8827 - kernel-doc: fix struct_group_tagged() parsing (git-fixes). - lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg (git-fixes). - commit d600a63 - kbuild: do not include include/config/auto.conf from shell scripts (bsc#1227274). - commit c743753 - btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101 CVE-2024-37354). - commit 899b45b - btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted (bsc#1221282). - btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (bsc#1221282 CVE-2024-26644 bsc#1222072). - commit 7829d14 - hsr: Prevent use after free in prp_create_tagged_frame() (CVE-2023-52846 bsc#1225098). - commit 74c7662 - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes) - commit 8395f97 - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes) - commit 7f0f7e9 - bnxt_re: Fix imm_data endianness (git-fixes) - commit c690ca2 - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes. - commit b60be3e - blacklist.conf: blocks list lots of 5.15-stable nfsd fixes. In the 5.15 stable series there was a full backport of nfsd. We don't won't all of that. So blacklist lots of patches that we don't want. - commit 0cfb63d - hfsplus: fix uninit-value in copy_name (git-fixes). - commit 383d5d6 - nvme-pci: add missing condition check for existence of mapped data (git-fixes). - nvme-pci: Fix the instructions for disabling power management (git-fixes). - nvmet-auth: fix nvmet_auth hash error handling (git-fixes). - nvme: fixup comment for nvme RDMA Provider Type (git-fixes). - nvmet: always initialize cqe.result (git-fixes). - nvme: avoid double free special payload (git-fixes). - nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes). - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes). - nvme-multipath: find NUMA path only for online numa-node (git-fixes). - nvme-auth: allow mixing of secret and hash lengths (git-fixes). - nvme-auth: use transformed key size to create resp (git-fixes). - nvme-auth: alloc nvme_dhchap_key as single buffer (git-fixes). - commit 3284c90 - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857). - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857). - scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857). - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857). - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857). - scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857). - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857). - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857). - commit 21ebef1 - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850). - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850). - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850). - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850). - scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850). - scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850). - scsi: qla2xxx: Complete command early within lock (bsc#1228850). - scsi: qla2xxx: Fix flash read failure (bsc#1228850). - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850). - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850). - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850). - scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850). - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850). - scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850). - scsi: qla2xxx: Indent help text (bsc#1228850). - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850). - scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850). - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850). - commit ce7acc0 - kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users. - commit b8cf562 - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808) - commit 8f44f81 - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729). - commit 02e87a9 - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869). - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869). - KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings (bsc#1194869). - KVM: PPC: Book3S HV: remove extraneous asterisk from rm_host_ipi_action() comment (bsc#1194869). - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting (bsc#1194869). - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST (bsc#1194869). - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots (bsc#1194869). - commit cc22863 - ASoC: topology: Fix route memory corruption (CVE-2024-41069 bsc#1228644). - commit 586db1a - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756 CVE-2024-42161). - commit 8359d86 - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494). - commit 81484ec - ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes). - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes). - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes). - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes). - drm/nouveau: prime: fix refcount underflow (git-fixes). - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera (stable-fixes). - ALSA: usb-audio: Move HD Webcam quirk to the right place (git-fixes). - ALSA: usb-audio: Fix microphone sound on HD webcam (stable-fixes). - drm/amd/display: Check for NULL pointer (stable-fixes). - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes). - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 (git-fixes). - drm/etnaviv: don't block scheduler when GPU is still active (stable-fixes). - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() (git-fixes). - drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format (stable-fixes). - commit b91fd99 - Drop doubly defined References in sound patches - commit 46ad1df - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes). - commit df5839d - Refresh patches.kabi/xhci-restre-deleted-trb-fields-for-tracing.patch. Fix KABI restoration also in tracing event message format. - commit 3bd4a56 - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes) - commit 8395f97 - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes) - commit 7f0f7e9 - bnxt_re: Fix imm_data endianness (git-fixes) - commit c690ca2 - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both when checking config changes. - commit b60be3e - blacklist.conf: blocks list lots of 5.15-stable nfsd fixes. In the 5.15 stable series there was a full backport of nfsd. We don't won't all of that. So blacklist lots of patches that we don't want. - commit 0cfb63d - hfsplus: fix uninit-value in copy_name (git-fixes). - commit 383d5d6 - nvme-pci: add missing condition check for existence of mapped data (git-fixes). - nvme-pci: Fix the instructions for disabling power management (git-fixes). - nvmet-auth: fix nvmet_auth hash error handling (git-fixes). - nvme: fixup comment for nvme RDMA Provider Type (git-fixes). - nvmet: always initialize cqe.result (git-fixes). - nvme: avoid double free special payload (git-fixes). - nvmet: fix a possible leak when destroy a ctrl during qp establishment (git-fixes). - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset (git-fixes). - nvme-multipath: find NUMA path only for online numa-node (git-fixes). - nvme-auth: allow mixing of secret and hash lengths (git-fixes). - nvme-auth: use transformed key size to create resp (git-fixes). - nvme-auth: alloc nvme_dhchap_key as single buffer (git-fixes). - commit 3284c90 - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857). - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian macro usages (bsc#1228857). - scsi: lpfc: Fix incorrect request len mbox field when setting trunking via sysfs (bsc#1228857). - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (bsc#1228857). - scsi: lpfc: Fix handling of fully recovered fabric node in dev_loss callbk (bsc#1228857). - scsi: lpfc: Relax PRLI issue conditions after GID_FT response (bsc#1228857). - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if in PRLI_ISSUE state (bsc#1228857). - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI port is inactive (bsc#1228857). - commit 21ebef1 - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850). - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850). - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850). - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850). - scsi: qla2xxx: Fix optrom version displayed in FDMI (bsc#1228850). - scsi: qla2xxx: During vport delete send async logout explicitly (bsc#1228850). - scsi: qla2xxx: Complete command early within lock (bsc#1228850). - scsi: qla2xxx: Fix flash read failure (bsc#1228850). - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds (bsc#1228850). - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850). - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850). - scsi: qla2xxx: Unable to act on RSCN for port online (bsc#1228850). - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple' (bsc#1228850). - scsi: qla2xxx: Fix debugfs output for fw_resource_count (bsc#1228850). - scsi: qla2xxx: Indent help text (bsc#1228850). - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850). - scsi: qla2xxx: Avoid possible run-time warning with long model_num (bsc#1228850). - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850). - commit ce7acc0 - kabi/severity: add nvme common code The nvme common code is also allowed to change the data structures, there are only internal users. - commit b8cf562 - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808) - commit 8f44f81 - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729). - commit 02e87a9 - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap() (bsc#1194869). - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 (bsc#1194869). - KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings (bsc#1194869). - KVM: PPC: Book3S HV: remove extraneous asterisk from rm_host_ipi_action() comment (bsc#1194869). - KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting (bsc#1194869). - KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST (bsc#1194869). - KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots (bsc#1194869). - commit cc22863 - ASoC: topology: Fix route memory corruption (CVE-2024-41069 bsc#1228644). - commit 586db1a - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756 CVE-2024-42161). - commit 8359d86 - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494). - commit 81484ec - ALSA: usb-audio: Correct surround channels in UAC1 channel map (git-fixes). - ALSA: hda: conexant: Fix headset auto detect fail in the polling mode (git-fixes). - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes). - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes). - drm/nouveau: prime: fix refcount underflow (git-fixes). - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera (stable-fixes). - ALSA: usb-audio: Move HD Webcam quirk to the right place (git-fixes). - ALSA: usb-audio: Fix microphone sound on HD webcam (stable-fixes). - drm/amd/display: Check for NULL pointer (stable-fixes). - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell (stable-fixes). - drm/i915/gt: Do not consider preemption during execlists_dequeue for gen8 (git-fixes). - drm/etnaviv: don't block scheduler when GPU is still active (stable-fixes). - drm/mipi-dsi: Fix theoretical int overflow in mipi_dsi_dcs_write_seq() (git-fixes). - drm/mipi-dsi: Fix mipi_dsi_dcs_write_seq() macro definition format (stable-fixes). - commit b91fd99 - Drop doubly defined References in sound patches - commit 46ad1df - PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN (git-fixes). - commit df5839d - Refresh patches.kabi/xhci-restre-deleted-trb-fields-for-tracing.patch. Fix KABI restoration also in tracing event message format. - commit 3bd4a56 - mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes). - commit d77caa1 - blacklist.conf: 0cac183b98d8 drm/amdkfd: range check cp bad op exception interrupts - commit a1d8500 - iommu/amd: Convert comma to semicolon (git-fixes). - commit f13afd4 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes). - commit d77caa1 - blacklist.conf: 0cac183b98d8 drm/amdkfd: range check cp bad op exception interrupts - commit a1d8500 - iommu/amd: Convert comma to semicolon (git-fixes). - commit f13afd4 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()" This reverts commit d77caa16c18115f0c470ecf5cdd3cdb6f9865aeb. - commit b3f74b7 - Revert "mm, kmsan: fix infinite recursion due to RCU critical section" This reverts commit 1702784a5db6b26695f0bc2c6b0cbe973db5c0f3. - commit e83daef - Revert "mm/sparsemem: fix race in accessing memory_section->usage" This reverts commit 606bd9b8228bfe004cf6ab930ffb673a535e3c55. - commit 12b6dd4 - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798) - commit 7d81a29 - Update patches.suse/ASoC-ops-Shift-tested-values-in-snd_soc_put_volsw-by.patch (git-fixes CVE-2022-48917 bsc#1229637). - Update patches.suse/Bluetooth-hci_qca-Fix-driver-shutdown-on-closed-serd.patch (git-fixes CVE-2022-48878 bsc#1229554). - Update patches.suse/CDC-NCM-avoid-overflow-in-sanity-checking.patch (git-fixes CVE-2022-48938 bsc#1229664). - Update patches.suse/KVM-x86-mmu-make-apf-token-non-zero-to-fix-bug.patch (git-fixes CVE-2022-48943 bsc#1229645). - Update patches.suse/RDMA-cma-Do-not-change-route.addr.src_addr-outside-s.patch (git-fixes CVE-2022-48925 bsc#1229630). - Update patches.suse/RDMA-ib_srp-Fix-a-deadlock.patch (git-fixes CVE-2022-48930 bsc#1229624). - Update patches.suse/USB-gadgetfs-Fix-race-between-mounting-and-unmountin.patch (CVE-2022-4382 bsc#1206258 CVE-2022-48869 bsc#1229507). - Update patches.suse/auxdisplay-lcd2s-Fix-memory-leak-in-remove.patch (git-fixes CVE-2022-48907 bsc#1229608). - Update patches.suse/blktrace-fix-use-after-free-for-struct-blk_trace.patch (bsc#1198017 CVE-2022-48913 bsc#1229643). - Update patches.suse/bpf-Fix-crash-due-to-out-of-bounds-access-into-reg2b.patch (git-fixes bsc#1194111 bsc#1194765 bsc#1196261 CVE-2021-4204 CVE-2022-0500 CVE-2022-23222 CVE-2022-48929 bsc#1229625). - Update patches.suse/btrfs-fix-race-between-quota-rescan-and-disable-lead.patch (bsc#1207158 CVE-2023-52896 bsc#1229533). - Update patches.suse/btrfs-fix-relocation-crash-due-to-premature-return-f.patch (bsc#1203360 CVE-2022-48903 bsc#1229613). - Update patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch (bsc#1228801 CVE-2024-43853 bsc#1229292). - Update patches.suse/cifs-fix-double-free-race-when-mount-fails-in-cifs_get_root-.patch (bsc#1193629 CVE-2022-48919 bsc#1229657). - Update patches.suse/configfs-fix-a-race-in-configfs_-un-register_subsyst.patch (git-fixes CVE-2022-48931 bsc#1229623). - Update patches.suse/dmaengine-idxd-Let-probe-fail-when-workqueue-cannot-.patch (git-fixes CVE-2022-48868 bsc#1229506). - Update patches.suse/drm-msm-another-fix-for-the-headless-Adreno-GPU.patch (git-fixes CVE-2023-52911 bsc#1229522). - Update patches.suse/drm-msm-dp-do-not-complete-dp_aux_cmd_fifo_tx-if-irq.patch (git-fixes CVE-2022-48898 bsc#1229537). - Update patches.suse/drm-virtio-Fix-GEM-handle-creation-UAF.patch (git-fixes CVE-2022-48899 bsc#1229536). - Update patches.suse/gsmi-fix-null-deref-in-gsmi_get_variable.patch (git-fixes CVE-2023-52893 bsc#1229535). - Update patches.suse/hwmon-Handle-failure-to-register-sensor-with-thermal.patch (git-fixes CVE-2022-48942 bsc#1229612). - Update patches.suse/ibmvnic-free-reset-work-item-when-flushing.patch (bsc#1196516 ltc#196391 CVE-2022-48905 bsc#1229604). - Update patches.suse/ice-fix-concurrent-reset-and-removal-of-VFs.patch (git-fixes CVE-2022-48941 bsc#1229614). - Update patches.suse/iio-adc-men_z188_adc-Fix-a-resource-leak-in-an-error.patch (git-fixes CVE-2022-48928 bsc#1229626). - Update patches.suse/iio-adc-tsc2046-fix-memory-corruption-by-preventing-.patch (git-fixes CVE-2022-48927 bsc#1229628). - Update patches.suse/io_uring-add-a-schedule-point-in-io_add_buffers.patch (git-fixes CVE-2022-48937 bsc#1229617). - Update patches.suse/iommu-amd-Fix-I-O-page-table-memory-leak (git-fixes CVE-2022-48904 bsc#1229603). - Update patches.suse/iommu-vt-d-fix-double-list_add-when-enabling-vmd-in-scalable-mode (bsc#1196894 CVE-2022-48916 bsc#1229638). - Update patches.suse/iwlwifi-mvm-check-debugfs_dir-ptr-before-use.patch (git-fixes CVE-2022-48918 bsc#1229636). - Update patches.suse/ixgbe-fix-pci-device-refcount-leak.patch (jsc#SLE-18384 CVE-2022-48896 bsc#1229540). - Update patches.suse/misc-fastrpc-Don-t-remove-map-on-creater_process-and.patch (git-fixes CVE-2022-48873 bsc#1229512). - Update patches.suse/misc-fastrpc-Fix-use-after-free-race-condition-for-m.patch (git-fixes CVE-2022-48872 bsc#1229510). - Update patches.suse/net-mlx5-DR-Fix-slab-out-of-bounds-in-mlx5_cmd_dr_cr.patch (jsc#SLE-19253 CVE-2022-48932 bsc#1229622). - Update patches.suse/net-smc-fix-connection-leak (git-fixes CVE-2022-48909 bsc#1229611). - Update patches.suse/nfc-pn533-Wait-for-out_urb-s-completion-in-pn533_usb.patch (git-fixes CVE-2023-52907 bsc#1229526). - Update patches.suse/nfp-flower-Fix-a-potential-leak-in-nfp_tunnel_add_sh.patch (git-fixes CVE-2022-48934 bsc#1229620). - Update patches.suse/nilfs2-fix-general-protection-fault-in-nilfs_btree_i.patch (git-fixes CVE-2023-52900 bsc#1229581). - Update patches.suse/octeontx2-pf-Fix-resource-leakage-in-VF-driver-unbin.patch (git-fixes CVE-2023-52905 bsc#1229528). - Update patches.suse/platform-surface-aggregator-Add-missing-call-to-ssam.patch (git-fixes CVE-2022-48880 bsc#1229557). - Update patches.suse/regulator-da9211-Use-irq-handler-when-ready.patch (git-fixes CVE-2022-48891 bsc#1229565). - Update patches.suse/sched-fair-Fix-fault-in-reweight_entity.patch (git fixes (sched/core) CVE-2022-48921 bsc#1229635). - Update patches.suse/scsi-storvsc-Fix-swiotlb-bounce-buffer-leak-in-confi.patch (bsc#1206006 CVE-2022-48890 bsc#1229544). - Update patches.suse/spi-spi-zynq-qspi-Fix-a-NULL-pointer-dereference-in-.patch (git-fixes CVE-2021-4441 bsc#1229598). - Update patches.suse/thermal-core-Fix-TZ_GET_TRIP-NULL-pointer-dereferenc.patch (git-fixes CVE-2022-48915 bsc#1229639). - Update patches.suse/thermal-int340x-fix-memory-leak-in-int3400_notify.patch (git-fixes CVE-2022-48924 bsc#1229631). - Update patches.suse/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch (git-fixes CVE-2022-48870 bsc#1229508). - Update patches.suse/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-o.patch (git-fixes CVE-2022-48871 bsc#1229509). - Update patches.suse/usb-gadget-f_ncm-fix-potential-NULL-ptr-deref-in-ncm.patch (git-fixes CVE-2023-52894 bsc#1229566). - Update patches.suse/usb-gadget-rndis-add-spinlock-for-rndis-response-lis.patch (git-fixes CVE-2022-48926 bsc#1229629). - Update patches.suse/usb-xhci-Check-endpoint-is-valid-before-dereferencin.patch (git-fixes CVE-2023-52901 bsc#1229531). - Update patches.suse/wifi-mac80211-sdata-can-be-NULL-during-AMPDU-start.patch (git-fixes CVE-2022-48875 bsc#1229516). - Update patches.suse/xen-netfront-destroy-queues-before-real_num_tx_queue.patch (git-fixes CVE-2022-48914 bsc#1229642). - Update patches.suse/xhci-Fix-null-pointer-dereference-when-host-dies.patch (git-fixes CVE-2023-52898 bsc#1229568). - commit 5c5e4d7 - Update patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch (git-fixes CVE-2024-35902 bsc#1224496). - Update patches.suse/ALSA-usb-audio-Fix-possible-NULL-pointer-dereference.patch (git-fixes CVE-2023-52904 bsc#1229529). - Update patches.suse/ASoC-Intel-sof-nau8825-fix-module-alias-overflow.patch (git-fixes CVE-2022-48889 bsc#1229545). - Update patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch (git-fixes CVE-2024-43818 bsc#1229296). - Update patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch (git-fixes CVE-2024-42302 bsc#1229366). - Update patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch (git-fixes CVE-2024-43823 bsc#1229303). - Update patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch (git-fixes CVE-2024-43872 bsc#1229489). - Update patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch (git-fixes CVE-2024-42285 bsc#1229381). - Update patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch (bsc#1208783 CVE-2024-42274 bsc#1229417). - Update patches.suse/bpf-Add-schedule-points-in-batch-ops.patch (jsc#PED-1377 CVE-2022-48939 bsc#1229616). - Update patches.suse/bpf-Fix-crash-due-to-incorrect-copy_map_value.patch (jsc#PED-1377 CVE-2022-48940 bsc#1229615). - Update patches.suse/btrfs-prevent-copying-too-big-compressed-lzo-segment.patch (git-fixes CVE-2022-48923 bsc#1229662). - Update patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch (git-fixes CVE-2024-43871 bsc#1229490). - Update patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch (git-fixes CVE-2024-43856 bsc#1229346). - Update patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch (stable-fixes CVE-2024-43903 bsc#1229781). - Update patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch (stable-fixes CVE-2024-43895 bsc#1229755). - Update patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch (stable-fixes CVE-2024-43905 bsc#1229784). - Update patches.suse/drm-amdgpu-Fix-potential-NULL-dereference.patch (bsc#1206843 CVE-2023-52908 bsc#1229525). - Update patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch (stable-fixes CVE-2024-43908 bsc#1229788). - Update patches.suse/drm-amdgpu-Fixed-bug-on-error-when-unloading-amdgpu.patch (bsc#1206843 CVE-2023-52912 bsc#1229588). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch (stable-fixes CVE-2024-43909 bsc#1229789). - Update patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch (stable-fixes CVE-2024-43907 bsc#1229787). - Update patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch (git-fixes CVE-2024-43894 bsc#1229746). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch (git-fixes CVE-2024-42310 bsc#1229358). - Update patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch (git-fixes CVE-2024-42309 bsc#1229359). - Update patches.suse/drm-i915-Fix-potential-context-UAFs.patch (git-fixes CVE-2023-52913 bsc#1229521). - Update patches.suse/drm-i915-gt-Cleanup-partial-engine-discovery-failure.patch (git-fixes CVE-2022-48893 bsc#1229576). - Update patches.suse/drm-msm-dpu-Fix-memory-leak-in-msm_mdss_parse_data_b.patch (git-fixes CVE-2022-48888 bsc#1229546). - Update patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch (git-fixes CVE-2024-43867 bsc#1229493). - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch (git-fixes CVE-2024-43829 bsc#1229341). - Update patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch (git-fixes CVE-2024-43863 bsc#1229497). - Update patches.suse/drm-vmwgfx-Remove-rcu-locks-from-user-resources.patch (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457 bsc#1213632 CVE-2022-48887 bsc#1229547). - Update patches.suse/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch (References: CVE-2021-47546 bsc#1227937 CVE-2024-40980). - Update patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch (git-fixes CVE-2024-42315 bsc#1229354). - Update patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch (git-fixes CVE-2024-31076 bsc#1226765). - Update patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch (git-fixes CVE-2024-42311 bsc#1229413). - Update patches.suse/ice-Add-check-for-kzalloc.patch (jsc#PED-376 CVE-2022-48886 bsc#1229548). - Update patches.suse/ice-Fix-potential-memory-leak-in-ice_gnss_tty_write.patch (jsc#PED-376 CVE-2022-48885 bsc#1229564). - Update patches.suse/iommu-iova-Fix-alloc-iova-overflows-issue.patch (git-fixes CVE-2023-52910 bsc#1229523). - Update patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch (git-fixes CVE-2024-43858 bsc#1229414). - Update patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch (git-fixes CVE-2024-42292 bsc#1229373). - Update patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch (git-fixes CVE-2024-43830 bsc#1229305). - Update patches.suse/lib-objagg-Fix-general-protection-fault.patch (git-fixes CVE-2024-43846 bsc#1229360). - Update patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch (git-fixes CVE-2024-42313 bsc#1229356). - Update patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch (git-fixes CVE-2024-43892 bsc#1229761). - Update patches.suse/net-ipv6-ensure-we-call-ipv6_mc_down-at-most-once.patch (git-fixes CVE-2022-48910 bsc#1229632). - Update patches.suse/net-ks8851-Fix-deadlock-with-the-SPI-chip-variant.patch (git-fixes CVE-2024-41036 bsc#1228496). - Update patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch (CVE-2024-35971 bsc#1224578 CVE-2024-36962 bsc#1225827). - Update patches.suse/net-mlx5-Fix-command-stats-access-after-free.patch (jsc#PED-1549 CVE-2022-48884 bsc#1229562). - Update patches.suse/net-mlx5e-Fix-macsec-possible-null-dereference-when-.patch (jsc#PED-1549 CVE-2022-48882 bsc#1229558). - Update patches.suse/net-mlx5e-IPoIB-Block-PKEY-interfaces-with-less-rx-q.patch (jsc#PED-1549 CVE-2022-48883 bsc#1229560). - Update patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch (git-fixes CVE-2024-43861 bsc#1229500). - Update patches.suse/nfsd-fix-handling-of-cached-open-files-in-nfsd4_open.patch (git-fixes CVE-2023-52909 bsc#1229524). - Update patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch (git-fixes CVE-2024-42276 bsc#1229410). - Update patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch (git-fixes CVE-2024-43889 bsc#1229743). - Update patches.suse/platform-x86-amd-Fix-refcount-leak-in-amd_pmc_probe.patch (bsc#1210644 CVE-2022-48881 bsc#1229559). - Update patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch (bsc#1194869 CVE-2024-41065 bsc#1228636). - Update patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch (git-fixes bsc#1229190 CVE-2024-42320 bsc#1229349). - Update patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch (bsc#1228857 CVE-2024-43816 bsc#1229318). - Update patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch (bsc#1228850 CVE-2024-42287 bsc#1229392). - Update patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch (bsc#1228850 CVE-2024-42289 bsc#1229399). - Update patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch (bsc#1228850 CVE-2024-42288 bsc#1229398). - Update patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch (bsc#1228850 CVE-2024-42286 bsc#1229395). - Update patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch (git-fixes CVE-2024-43879 bsc#1229482). - Update patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch (git-fixes CVE-2024-43842 bsc#1229317). - commit 777a4e3 - xfs: Fix the owner setting issue for rmap query in xfs fsmap (git-fixes). - commit 264a4ea - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code (git-fixes). - commit b060763 - xfs: Fix missing interval for missing_owner in xfs fsmap (git-fixes). - commit 3005438 - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes). - commit f65ae14 - ocfs2: use coarse time for new created files (git-fixes). - commit 82dc1eb - net: usb: qmi_wwan: fix memory leak for not ip packets (CVE-2024-43861 bsc#1229500). - commit 3e796c3 - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576 CVE-2024-41062). - commit 07bd1e3 - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (git-fixes). - commit b02e597 - Bluetooth: L2CAP: Fix deadlock (git-fixes). - commit 717d839 - usb: vhci-hcd: Do not drop references before new references are gained (CVE-2024-43883 bsc#1229707). - commit 44d7bae - vdpa: ifcvf: Do proper cleanup if IFCVF init fails (bsc#1225524 CVE-2022-48706). - commit 023b108 - efi/unaccepted: touch soft lockup during memory accept (bsc#1225773 CVE-2024-36936). - commit 29d2eb8 - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes). - commit 6d0732e - fuse: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454 CVE-2024-44947). - commit ddfd2d7 - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()" This reverts commit d77caa16c18115f0c470ecf5cdd3cdb6f9865aeb. - commit b3f74b7 - Revert "mm, kmsan: fix infinite recursion due to RCU critical section" This reverts commit 1702784a5db6b26695f0bc2c6b0cbe973db5c0f3. - commit e83daef - Revert "mm/sparsemem: fix race in accessing memory_section->usage" This reverts commit 606bd9b8228bfe004cf6ab930ffb673a535e3c55. - commit 12b6dd4 - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223). - commit b81ed11 - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848). - commit 04f7eb0 - nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769). - commit 8283ab9 - arm64: acpi: Move get_cpu_for_acpi_id() to a header (bsc#1231120 CVE-2024-46822) - commit fb3eb08 - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822) - commit ec589da - tracing: Fix overflow in get_free_elt() (git-fixes CVE-2024-43890 bsc#1229764). - commit 867d207 - tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes). - commit 1959490 - Refresh patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch. - commit ba454fb - kthread: Fix task state in kthread worker if being frozen (bsc#1231146). - commit 2398294 - nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082). - nvme: change __nvme_submit_sync_cmd() calling conventions (bsc#1228620 CVE-2024-41082). Refresh: - patches.suse/nvme-auth-retry-command-if-DNR-bit-is-not-set.patch - commit 4effcb1 - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes). - mailbox: rockchip: fix a typo in module autoloading (git-fixes). - firmware_loader: Block path traversal (git-fixes). - iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes). - iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes). - iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes). - iio: adc: ad7606: fix oversampling gpio array (git-fixes). - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes). - Input: ilitek_ts_i2c - add report id message validation (git-fixes). - Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes). - media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes). - media: venus: fix use after free bug in venus_remove due to race condition (git-fixes). - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes). - Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" (stable-fixes). - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes). - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes). - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes). - apparmor: fix possible NULL pointer dereference (stable-fixes). - commit 0120ced - tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes). - tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes). - USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes). - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes). - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - USB: serial: kobil_sct: restore initial terminal settings (git-fixes). - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes). - rtc: at91sam9: fix OF node leak in probe() error path (git-fixes). - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes). - pinctrl: single: fix missing error code in pcs_probe() (git-fixes). - PCI: xilinx-nwl: Fix register misspelling (git-fixes). - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes). - xz: cleanup CRC32 edits from 2018 (git-fixes). - pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes). - thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes). - commit b15f073 - usb: dwc3: st: fix probed platform device ref count on probe error path (bsc#1230507 CVE-2024-46674). - commit ffd5693 - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - commit e8a76c0 - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - commit 0627e93 - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - commit 901f16d - usb: xhci: fix loss of data on Cadence xHC (git-fixes). - commit 1b1ffa2 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830 bsc#1231116). - commit 5d5e02e - cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181). - ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180). - commit 47c22dc - usbnet: fix cyclical race on disconnect with work queue (git-fixes). - Refresh patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch. - commit 1cf5de8 - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223). - commit b81ed11 - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848). - commit 04f7eb0 - nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769). - commit 8283ab9 - arm64: acpi: Move get_cpu_for_acpi_id() to a header (bsc#1231120 CVE-2024-46822) - commit fb3eb08 - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822) - commit ec589da - tracing: Fix overflow in get_free_elt() (git-fixes CVE-2024-43890 bsc#1229764). - commit 867d207 - tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes). - commit 1959490 - Refresh patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch. - commit ba454fb - kthread: Fix task state in kthread worker if being frozen (bsc#1231146). - commit 2398294 - nvme-fabrics: use reserved tag for reg read/write command (bsc#1228620 CVE-2024-41082). - nvme: change __nvme_submit_sync_cmd() calling conventions (bsc#1228620 CVE-2024-41082). Refresh: - patches.suse/nvme-auth-retry-command-if-DNR-bit-is-not-set.patch - commit 4effcb1 - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes). - mailbox: rockchip: fix a typo in module autoloading (git-fixes). - firmware_loader: Block path traversal (git-fixes). - iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes). - iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes). - iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes). - iio: adc: ad7606: fix oversampling gpio array (git-fixes). - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes). - Input: ilitek_ts_i2c - add report id message validation (git-fixes). - Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes). - media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes). - media: venus: fix use after free bug in venus_remove due to race condition (git-fixes). - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes). - Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" (stable-fixes). - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes). - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes). - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes). - apparmor: fix possible NULL pointer dereference (stable-fixes). - commit 0120ced - tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes). - tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes). - USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes). - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes). - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - USB: serial: kobil_sct: restore initial terminal settings (git-fixes). - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes). - rtc: at91sam9: fix OF node leak in probe() error path (git-fixes). - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes). - pinctrl: single: fix missing error code in pcs_probe() (git-fixes). - PCI: xilinx-nwl: Fix register misspelling (git-fixes). - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes). - xz: cleanup CRC32 edits from 2018 (git-fixes). - pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes). - thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes). - commit b15f073 - usb: dwc3: st: fix probed platform device ref count on probe error path (bsc#1230507 CVE-2024-46674). - commit ffd5693 - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes). - commit e8a76c0 - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes). - commit 0627e93 - usb: cdnsp: Fix incorrect usb_request status (git-fixes). - commit 901f16d - usb: xhci: fix loss of data on Cadence xHC (git-fixes). - commit 1b1ffa2 - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830 bsc#1231116). - commit 5d5e02e - cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181). - ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180). - commit 47c22dc - usbnet: fix cyclical race on disconnect with work queue (git-fixes). - Refresh patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch. - commit 1cf5de8 - tracing/hwlat: Fix a race during cpuhp processing (git-fixes). - commit da4b9b4 - fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks (git-fixes). - commit 7b587c7 - fgraph: Change the name of cpuhp state to "fgraph:online" (git-fixes). - fgraph: Fix missing unlock in register_ftrace_graph() (git-fixes). - commit 25b5fcd - uprobe: avoid out-of-bounds memory access of fetching args (git-fixes). - uprobes: encapsulate preparation of uprobe args buffer (git-fixes). - tracing/uprobes: Use trace_event_buffer_reserve() helper (git-fixes). - commit c9bed4e - tracing: Consider the NULL character when validating the event length (git-fixes). - commit a6be5ae - bpf,perf: Fix perf_event_detach_bpf_prog error handling (git-fixes). - commit 23dff14 - scsi: lpfc: Update lpfc version to 14.4.0.5 (bsc#1232757). - scsi: lpfc: Support loopback tests with VMID enabled (bsc#1232757). - scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to KERN_WARNING (bsc#1232757). - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1232757). - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (bsc#1232757). - scsi: lpfc: Update phba link state conditional before sending CMF_SYNC_WQE (bsc#1232757). - scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd() (bsc#1232757). - scsi: lpfc: Remove trailing space after \n newline (bsc#1232757). - commit acff620 - net/xen-netback: prevent UAF in xenvif_flush_hash() (CVE-2024-49936 bsc#1232424). - commit 05a71d8 - module: abort module loading when sysfs setup suffer errors (git-fixes). - Refresh patches.suse/add-suse-supported-flag.patch. - commit 38f1b15 - uprobes: fix kernel info leak via "[uprobes]" vma (bsc#1232104 CVE-2024-49975). - commit 98e2376 - Drop HD-audio conexant patch that caused a regression on Thinkpad (bsc#1228269) - commit 147923a - ext4: fix timer use-after-free on failed mount (CVE-2024-49960 bsc#1232395). - tipc: guard against string buffer overrun (CVE-2024-49995 bsc#1232432). - commit 7dec126 - Update patches.suse/scsi-lpfc-Restrict-support-for-32-byte-CDBs-to-specific-HBAs.patch (git-fixes bsc#1232757 bsc#1228119). - commit ba604a8 - octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957 bsc#1225762). - commit 82a42a7 - vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174 CVE-2024-47748). - commit 51b6257 - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (CVE-2024-49991 bsc#1232282). - commit 6ba5342 - ipv6: avoid use-after-free in ip6_fragment() (CVE-2022-48956 bsc#1231893). - commit c192a62 - blk-mq: setup queue ->tag_set before initializing hctx (CVE-2024-50081 bsc#1232501). - commit 47f15a1 - driver core: bus: Fix double free in driver API bus_register() (CVE-2024-50055 bsc#1232329). - commit 90fa355 - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979 CVE-2022-48960) - commit e22014e - tracing/hwlat: Fix a race during cpuhp processing (git-fixes). - commit da4b9b4 - fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks (git-fixes). - commit 7b587c7 - fgraph: Change the name of cpuhp state to "fgraph:online" (git-fixes). - fgraph: Fix missing unlock in register_ftrace_graph() (git-fixes). - commit 25b5fcd - uprobe: avoid out-of-bounds memory access of fetching args (git-fixes). - uprobes: encapsulate preparation of uprobe args buffer (git-fixes). - tracing/uprobes: Use trace_event_buffer_reserve() helper (git-fixes). - commit c9bed4e - tracing: Consider the NULL character when validating the event length (git-fixes). - commit a6be5ae - bpf,perf: Fix perf_event_detach_bpf_prog error handling (git-fixes). - commit 23dff14 - scsi: lpfc: Update lpfc version to 14.4.0.5 (bsc#1232757). - scsi: lpfc: Support loopback tests with VMID enabled (bsc#1232757). - scsi: lpfc: Revise TRACE_EVENT log flag severities from KERN_ERR to KERN_WARNING (bsc#1232757). - scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instance (bsc#1232757). - scsi: lpfc: Fix kref imbalance on fabric ndlps from dev_loss_tmo handler (bsc#1232757). - scsi: lpfc: Update phba link state conditional before sending CMF_SYNC_WQE (bsc#1232757). - scsi: lpfc: Add ELS_RSP cmd to the list of WQEs to flush in lpfc_els_flush_cmd() (bsc#1232757). - scsi: lpfc: Remove trailing space after \n newline (bsc#1232757). - commit acff620 - net/xen-netback: prevent UAF in xenvif_flush_hash() (CVE-2024-49936 bsc#1232424). - commit 05a71d8 - module: abort module loading when sysfs setup suffer errors (git-fixes). - Refresh patches.suse/add-suse-supported-flag.patch. - commit 38f1b15 - uprobes: fix kernel info leak via "[uprobes]" vma (bsc#1232104 CVE-2024-49975). - commit 98e2376 - Drop HD-audio conexant patch that caused a regression on Thinkpad (bsc#1228269) - commit 147923a - ext4: fix timer use-after-free on failed mount (CVE-2024-49960 bsc#1232395). - tipc: guard against string buffer overrun (CVE-2024-49995 bsc#1232432). - commit 7dec126 - Update patches.suse/scsi-lpfc-Restrict-support-for-32-byte-CDBs-to-specific-HBAs.patch (git-fixes bsc#1232757 bsc#1228119). - commit ba604a8 - octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957 bsc#1225762). - commit 82a42a7 - vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174 CVE-2024-47748). - commit 51b6257 - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (CVE-2024-49991 bsc#1232282). - commit 6ba5342 - ipv6: avoid use-after-free in ip6_fragment() (CVE-2022-48956 bsc#1231893). - commit c192a62 - blk-mq: setup queue ->tag_set before initializing hctx (CVE-2024-50081 bsc#1232501). - commit 47f15a1 - driver core: bus: Fix double free in driver API bus_register() (CVE-2024-50055 bsc#1232329). - commit 90fa355 - net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979 CVE-2022-48960) - commit e22014e - net/mlx5: Drain health before unregistering devlink (git-fixes). - Refresh patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch. - commit fa0f96d - vdpa/mlx5: preserve CVQ vringh index (git-fixes). - Refresh patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch. - commit dbac474 - idpf: distinguish vports by the dev_port attribute (git-fixes). - Refresh patches.suse/0001-idpf-extend-tx-watchdog-timeout.patch. - commit 3fa63a5 - net: ena: Fix potential sign extension issue (git-fixes). - Refresh patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch. - commit f3d6416 - net/mlx5: Unregister notifier on eswitch init failure (git-fixes). - igb: Fix not clearing TimeSync interrupts for 82580 (git-fixes). - net/mlx5e: Take state lock during tx timeout reporter (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer (git-fixes). - iavf: in iavf_down, disable queues when removing the driver (git-fixes). - commit c073e57 - powerpc/kexec: Fix return of uninitialized variable (bsc#1194869). - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869). - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869). - powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869). - powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869). - powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869). - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869). - powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869). - powerpc/asm: Remove UPD_CONSTR after GCC 4.9 removal (bsc#1194869). - powerpc: remove GCC version check for UPD_CONSTR (bsc#1194869). - commit 2d82b73 - arm64/sve: Discard stale CPU state when handling SVE traps (git-fixes) - commit 019ef42 - arm64: smccc: replace custom COUNT_ARGS() & CONCATENATE() (git-fixes) - commit e8b197c - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes) - commit 49b56be - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes) - commit 834680b - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes) - commit 11b60ab - kernel.h: split out COUNT_ARGS() and CONCATENATE() to args.h (git-fixes) - commit ce86139 - USB: serial: io_edgeport: fix use after free in debug printk (CVE-2024-50267 bsc#1233456) - commit 5a7c927 - kABI: Restore exported __arm_smccc_sve_check (git-fixes) - commit c8e82c2 - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (git-fixes) Refresh patches.suse/arm64-probes-Fix-uprobes-for-big-endian-kernels.patch. - commit 8fb43aa - can: j1939: j1939_session_new(): fix skb reference counting (git-fixes). - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes). - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes). - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes). - HID: wacom: fix when get product name maybe null pointer (git-fixes). - watchdog: rti: of: honor timeout-sec property (git-fixes). - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes). - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes). - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values (git-fixes). - commit 6f2f0c6 - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104 bsc#1234025). - commit 1c41c2f - idpf: fix UAFs when destroying the queues (CVE-2024-44932 bsc#1229808). - idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964 bsc#1230220). - commit 4316b61 - vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110 bsc#1234085). - commit d161a67 - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800 bsc#1230827). - commit 4fa3f93 - net/mlx5: Drain health before unregistering devlink (git-fixes). - Refresh patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch. - commit fa0f96d - vdpa/mlx5: preserve CVQ vringh index (git-fixes). - Refresh patches.suse/vdpa-mlx5-Allow-CVQ-size-changes.patch. - commit dbac474 - idpf: distinguish vports by the dev_port attribute (git-fixes). - Refresh patches.suse/0001-idpf-extend-tx-watchdog-timeout.patch. - commit 3fa63a5 - net: ena: Fix potential sign extension issue (git-fixes). - Refresh patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch. - commit f3d6416 - net/mlx5: Unregister notifier on eswitch init failure (git-fixes). - igb: Fix not clearing TimeSync interrupts for 82580 (git-fixes). - net/mlx5e: Take state lock during tx timeout reporter (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors (git-fixes). - net/mlx5e: Correct snprintf truncation handling for fw_version buffer (git-fixes). - iavf: in iavf_down, disable queues when removing the driver (git-fixes). - commit c073e57 - powerpc/kexec: Fix return of uninitialized variable (bsc#1194869). - powerpc/pseries: Fix KVM guest detection for disabling hardlockup detector (bsc#1194869). - powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore (bsc#1194869). - powerpc/mm/fault: Fix kfence page fault reporting (bsc#1194869). - powerpc/powernv: Free name on error in opal_event_init() (bsc#1194869). - powerpc/atomic: Use YZ constraints for DS-form instructions (bsc#1194869). - powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL (bsc#1194869). - powerpc/mm: Fix boot crash with FLATMEM (bsc#1194869). - powerpc/asm: Remove UPD_CONSTR after GCC 4.9 removal (bsc#1194869). - powerpc: remove GCC version check for UPD_CONSTR (bsc#1194869). - commit 2d82b73 - arm64/sve: Discard stale CPU state when handling SVE traps (git-fixes) - commit 019ef42 - arm64: smccc: replace custom COUNT_ARGS() & CONCATENATE() (git-fixes) - commit e8b197c - arm64: smccc: Remove broken support for SMCCCv1.3 SVE discard hint (git-fixes) - commit 49b56be - arm64: fix .data.rel.ro size assertion when CONFIG_LTO_CLANG (git-fixes) - commit 834680b - arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled (git-fixes) - commit 11b60ab - kernel.h: split out COUNT_ARGS() and CONCATENATE() to args.h (git-fixes) - commit ce86139 - USB: serial: io_edgeport: fix use after free in debug printk (CVE-2024-50267 bsc#1233456) - commit 5a7c927 - kABI: Restore exported __arm_smccc_sve_check (git-fixes) - commit c8e82c2 - arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning (git-fixes) Refresh patches.suse/arm64-probes-Fix-uprobes-for-big-endian-kernels.patch. - commit 8fb43aa - can: j1939: j1939_session_new(): fix skb reference counting (git-fixes). - can: ems_usb: ems_usb_rx_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics (git-fixes). - can: ifi_canfd: ifi_canfd_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: m_can: m_can_handle_lec_err(): fix {rx,tx}_errors statistics (git-fixes). - can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL (git-fixes). - can: c_can: c_can_handle_bus_err(): update statistics if skb allocation fails (git-fixes). - HID: wacom: fix when get product name maybe null pointer (git-fixes). - watchdog: rti: of: honor timeout-sec property (git-fixes). - watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() (git-fixes). - iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call (git-fixes). - HID: wacom: Interpret tilt data from Intuos Pro BT as signed values (git-fixes). - commit 6f2f0c6 - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104 bsc#1234025). - commit 1c41c2f - idpf: fix UAFs when destroying the queues (CVE-2024-44932 bsc#1229808). - idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964 bsc#1230220). - commit 4316b61 - vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110 bsc#1234085). - commit d161a67 - sch/netem: fix use after free in netem_dequeue (CVE-2024-46800 bsc#1230827). - commit 4fa3f93 - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Remove build dependency doxygen, python-Cheetah, python-Sphinx, python-libxml2, python-lxml, most of which are python 2 programs. Consequently remove -doc subpackage. Users are encouraged to use online documentation. (bsc#1066461) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Remove build dependency doxygen, python-Cheetah, python-Sphinx, python-libxml2, python-lxml, most of which are python 2 programs. Consequently remove -doc subpackage. Users are encouraged to use online documentation. (bsc#1066461) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Remove build dependency doxygen, python-Cheetah, python-Sphinx, python-libxml2, python-lxml, most of which are python 2 programs. Consequently remove -doc subpackage. Users are encouraged to use online documentation. (bsc#1066461) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Remove build dependency doxygen, python-Cheetah, python-Sphinx, python-libxml2, python-lxml, most of which are python 2 programs. Consequently remove -doc subpackage. Users are encouraged to use online documentation. (bsc#1066461) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Fix vulnerabilities in GSS message token handling, add patch 0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch * CVE-2024-37370, bsc#1227186 * CVE-2024-37371, bsc#1227187 - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Fix vulnerabilities in GSS message token handling, add patch 0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch * CVE-2024-37370, bsc#1227186 * CVE-2024-37371, bsc#1227187 - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Fix vulnerabilities in GSS message token handling, add patch 0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch * CVE-2024-37370, bsc#1227186 * CVE-2024-37371, bsc#1227187 - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added support for /etc/krb5.conf.d/ for configuration snippets - Upgrade to 1.15.3 * Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. * Fix a KDC PKINIT memory leak. * Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. * Fix a null dereference when the KDC sends a large TGS reply. * Fix "kdestroy -A" with the KCM credential cache type. * Fix the handling of capaths "." values. * Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). - BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package so it is avaiable for krb5-client as well. - Upgrade to 1.16.1 * kdc client cert matching on client principal entry * Allow ktutil addent command to ignore key version and use non-default salt string. * add kpropd pidfile support * enable "encrypted_challenge_indicator" realm option on tickets obtained using FAST encrypted challenge pre-authentication. * dates through 2106 accepted * KDC support for trivially renewable tickets * stop caching referral and alternate cross-realm TGTs to prevent duplicate credential cache entries - Upgrade to 1.16.3 * Fix a regression in the MEMORY credential cache type which could cause client programs to crash. * MEMORY credential caches will not be listed in the global collection, with the exception of the default credential cache if it is of type MEMORY. * Remove an incorrect assertion in the KDC which could be used to cause a crash [CVE-2018-20217]. * Fix bugs with concurrent use of MEMORY ccache handles. * Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. * Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. * Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. * Make cross-realm S4U2Self requests work on the client when no default_realm is configured. * Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs. - Use systemd-tmpfiles to create files under /var/lib/kerberos, required by transactional updates; (bsc#1100126); - Rename patches: * krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch * krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch * krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch * krb5-1.6.3-gssapi_improve_errormessages.dif to 0004-krb5-1.6.3-gssapi_improve_errormessages.patch * krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch * krb5-1.12-api.patch => 0006-krb5-1.12-api.patch * krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch * krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch * krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch - Move LDAP schema files from /usr/share/doc/packages/krb5 to /usr/share/kerberos/ldap; (bsc#1134217); - Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947); (bsc#1144047); - Update logrotate script, call systemd to reload the services instead of init-scripts. (boo#1169357) - Fix prefix reported by krb5-config, libraries and headers are not installed under /usr/lib/mit prefix. (bsc#1174079) - Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196); (bsc#1178512); - Added patches: * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185163); - Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222); (bsc#1188571); - Added patches: * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Fix KDC null pointer dereference via a FAST inner body that lacks a server field; (CVE-2021-37750); (bsc#1189929); - Added patches: * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Update to 1.19.2 * Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222); * Fix a memory leak when gss_inquire_cred() is called without a credential handle. - Changes from 1.19.1 * Fix a linking issue with Samba. * Better support multiple pkinit_identities values by checking whether certificates can be loaded for each value. - Changes from 1.19 Administrator experience * When a client keytab is present, the GSSAPI krb5 mech will refresh credentials even if the current credentials were acquired manually. * It is now harder to accidentally delete the K/M entry from a KDB. Developer experience * gss_acquire_cred_from() now supports the "password" and "verify" options, allowing credentials to be acquired via password and verified using a keytab key. * When an application accepts a GSS security context, the new GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor both provided matching channel bindings. * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests to identify the desired client principal by certificate. * PKINIT certauth modules can now cause the hw-authent flag to be set in issued tickets. * The krb5_init_creds_step() API will now issue the same password expiration warnings as krb5_get_init_creds_password(). Protocol evolution * Added client and KDC support for Microsoft's Resource-Based Constrained Delegation, which allows cross-realm S4U2Proxy requests. A third-party database module is required for KDC support. * kadmin/admin is now the preferred server principal name for kadmin connections, and the host-based form is no longer created by default. The client will still try the host-based form as a fallback. * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT extension, which causes channel bindings to be required for the initiator if the acceptor provided them. The client will send this option if the client_aware_gss_bindings profile option is set. User experience * kinit will now issue a warning if the des3-cbc-sha1 encryption type is used in the reply. This encryption type will be deprecated and removed in future releases. * Added kvno flags --out-cache, --no-store, and --cached-only (inspired by Heimdal's kgetcred). - Changes from 1.18.3 * Fix a denial of service vulnerability when decoding Kerberos protocol messages; (CVE-2020-28196); (bsc#1178512); * Fix a locking issue with the LMDB KDB module which could cause KDC and kadmind processes to lose access to the database. * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded and unloaded while libkrb5support remains loaded. - Changes from 1.18.2 * Fix a SPNEGO regression where an acceptor using the default credential would improperly filter mechanisms, causing a negotiation failure. * Fix a bug where the KDC would fail to issue tickets if the local krbtgt principal's first key has a single-DES enctype. * Add stub functions to allow old versions of OpenSSL libcrypto to link against libkrb5. * Fix a NegoEx bug where the client name and delegated credential might not be reported. - Changes from 1.18.1 * Fix a crash when qualifying short hostnames when the system has no primary DNS domain. * Fix a regression when an application imports "service@" as a GSS host-based name for its acceptor credential handle. * Fix KDC enforcement of auth indicators when they are modified by the KDB module. * Fix removal of require_auth string attributes when the LDAP KDB module is used. * Fix a compile error when building with musl libc on Linux. * Fix a compile error when building with gcc 4.x. * Change the KDC constrained delegation precedence order for consistency with Windows KDCs. - Changes from 1.18 Administrator experience: * Remove support for single-DES encryption types. * Change the replay cache format to be more efficient and robust. Replay cache filenames using the new format end with ".rcache2" by default. * setuid programs will automatically ignore environment variables that normally affect krb5 API functions, even if the caller does not use krb5_init_secure_context(). * Add an "enforce_ok_as_delegate" krb5.conf relation to disable credential forwarding during GSSAPI authentication unless the KDC sets the ok-as-delegate bit in the service ticket. * Use the permitted_enctypes krb5.conf setting as the default value for default_tkt_enctypes and default_tgs_enctypes. Developer experience: * Implement krb5_cc_remove_cred() for all credential cache types. * Add the krb5_pac_get_client_info() API to get the client account name from a PAC. Protocol evolution: * Add KDC support for S4U2Self requests where the user is identified by X.509 certificate. (Requires support for certificate lookup from a third-party KDB module.) * Remove support for an old ("draft 9") variant of PKINIT. * Add support for Microsoft NegoEx. (Requires one or more third-party GSS modules implementing NegoEx mechanisms.) User experience: * Add support for "dns_canonicalize_hostname=fallback", causing host-based principal names to be tried first without DNS canonicalization, and again with DNS canonicalization if the un-canonicalized server is not found. * Expand single-component hostnames in host-based principal names when DNS canonicalization is not used, adding the system's first DNS search path as a suffix. Add a "qualify_shortname" krb5.conf relation to override this suffix or disable expansion. * Honor the transited-policy-checked ticket flag on application servers, eliminating the requirement to configure capaths on servers in some scenarios. Code quality: * The libkrb5 serialization code (used to export and import krb5 GSS security contexts) has been simplified and made type-safe. * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED messages has been revised to conform to current coding practices. * The test suite has been modified to work with macOS System Integrity Protection enabled. * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support can always be tested. - Changes from 1.17.1 * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin. * Fix a bug preventing time skew correction from working when a KCM credential cache is used. - Changes from 1.17: Administrator experience: * A new Kerberos database module using the Lightning Memory-Mapped Database library (LMDB) has been added. The LMDB KDB module should be more performant and more robust than the DB2 module, and may become the default module for new databases in a future release. * "kdb5_util dump" will no longer dump policy entries when specific principal names are requested. Developer experience: * The new krb5_get_etype_info() API can be used to retrieve enctype, salt, and string-to-key parameters from the KDC for a client principal. * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise principal names to be used with GSS-API functions. * KDC and kadmind modules which call com_err() will now write to the log file in a format more consistent with other log messages. * Programs which use large numbers of memory credential caches should perform better. Protocol evolution: * The SPAKE pre-authentication mechanism is now supported. This mechanism protects against password dictionary attacks without requiring any additional infrastructure such as certificates. SPAKE is enabled by default on clients, but must be manually enabled on the KDC for this release. * PKINIT freshness tokens are now supported. Freshness tokens can protect against scenarios where an attacker uses temporary access to a smart card to generate authentication requests for the future. * Password change operations now prefer TCP over UDP, to avoid spurious error messages about replays when a response packet is dropped. * The KDC now supports cross-realm S4U2Self requests when used with a third-party KDB module such as Samba's. The client code for cross-realm S4U2Self requests is also now more robust (CVE-2018-20217). User experience: * The new ktutil addent -f flag can be used to fetch salt information from the KDC for password-based keys. * The new kdestroy -p option can be used to destroy a credential cache within a collection by client principal name. * The Kerberos man page has been restored, and documents the environment variables that affect programs using the Kerberos library. Code quality: * Python test scripts now use Python 3. * Python test scripts now display markers in verbose output, making it easier to find where a failure occurred within the scripts. * The Windows build system has been simplified and updated to work with more recent versions of Visual Studio. A large volume of unused Windows-specific code has been removed. Visual Studio 2013 or later is now required. - Replace old $RPM_* shell vars - Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld - Remove cruft to support distributions older than SLE 12 - Use macros where applicable - Switch to pkgconfig style dependencies - Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d notation: libexecdir is likely changing away from /usr/lib to /usr/libexec - Build with full Cyrus SASL support. Negotiating SASL credentials with an EXTERNAL bind mechanism requires interaction. Kerberos provides its own interaction function that skips all interaction, thus preventing the mechanism from working. - Removed patches: * 0007-krb5-1.12-ksu-path.patch * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch - Renamed patches: * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch => 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch - Fix integer overflows in PAC parsing; (CVE-2022-42898); (bso#15203), (bsc#1205126). - Added patches: * 0010-Fix-integer-overflows-in-PAC-parsing.patch - Update to 1.20.1; (bsc#1205126); (CVE-2022-42898); * Fix integer overflows in PAC parsing [CVE-2022-42898]. * Fix null deref in KDC when decoding invalid NDR. * Fix memory leak in OTP kdcpreauth module. * Fix PKCS11 module path search. - update to 1.20.0: * Added a "disable_pac" realm relation to suppress adding PAC authdata to tickets, for realms which do not need to support S4U requests. * Most credential cache types will use atomic replacement when a cache is reinitialized using kinit or refreshed from the client keytab. * kprop can now propagate databases with a dump size larger than 4GB, if both the client and server are upgraded. * kprop can now work over NATs that change the destination IP address, if the client is upgraded. * Updated the KDB interface. The sign_authdata() method is replaced with the issue_pac() method, allowing KDB modules to add logon info and other buffers to the PAC issued by the KDC. * Host-based initiator names are better supported in the GSS krb5 mechanism. * Replaced AD-SIGNEDPATH authdata with minimal PACs. * To avoid spurious replay errors, password change requests will not be attempted over UDP until the attempt over TCP fails. * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1. * Updated all code using OpenSSL to be compatible with OpenSSL 3. * Reorganized the libk5crypto build system to allow the OpenSSL back-end to pull in material from the builtin back-end depending on the OpenSSL version. * Simplified the PRNG logic to always use the platform PRNG. * Converted the remaining Tcl tests to Python. - update to 1.19.3 (bsc#1189929, CVE-2021-37750): * Fix a denial of service attack against the KDC [CVE-2021-37750]. * Fix KDC null deref on TGS inner body null server * Fix conformance issue in GSSAPI tests - Resolve "Credential cache directory /run/user/0/krb5cc does not exist while opening default credentials cache" by using a kernel keyring instead of a dir cache; (bsc#1109830); - Added hardening to systemd services; (bsc#1181400); - Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch, fixed in release 1.20.0 - Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch, fixed in release 1.20.1 - Ensure array count consistency in kadm5 RPC; (bsc#1214054); (CVE-2023-36054); - Added patches: * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch - Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch * CVE-2024-26458, bsc#1220770 * CVE-2024-26461, bsc#1220771 * CVE-2024-26462, bsc#1220772 - Fix vulnerabilities in GSS message token handling, add patch 0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch * CVE-2024-37370, bsc#1227186 * CVE-2024-37371, bsc#1227187 - Allow to configure utility containers for update test 0001-improve-kubevirt-update-test.patch - Drop kubevirt-psp-caasp.yaml - Use semantic equality comparison 0002-use-semantic-equality-comparison.patch - Avoid to return nil failure message 0003-Avoid-to-return-nil-failure-message.patch - Increase storage requirements in _constraints - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) 0004-only-create-1MiB-aligned-disk-images.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Use semantic equality comparison 0002-use-semantic-equality-comparison.patch - Avoid to return nil failure message 0003-Avoid-to-return-nil-failure-message.patch - Increase storage requirements in _constraints - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) 0004-only-create-1MiB-aligned-disk-images.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Update to version 1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.0 - Drop patches 0001-tests-Adapt-VM-phase-expectation.patch 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Add patch 0001-Collect-component-Role-rules-under-operator-Role-ins.patch - Pack configuration files for libvirt - Allow to configure utility containers for update test 0001-improve-kubevirt-update-test.patch - Drop kubevirt-psp-caasp.yaml - Use semantic equality comparison 0002-use-semantic-equality-comparison.patch - Avoid to return nil failure message 0003-Avoid-to-return-nil-failure-message.patch - Increase storage requirements in _constraints - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) 0004-only-create-1MiB-aligned-disk-images.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Use semantic equality comparison 0002-use-semantic-equality-comparison.patch - Avoid to return nil failure message 0003-Avoid-to-return-nil-failure-message.patch - Increase storage requirements in _constraints - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) 0004-only-create-1MiB-aligned-disk-images.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Update to version 1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.0 - Drop patches 0001-tests-Adapt-VM-phase-expectation.patch 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Add patch 0001-Collect-component-Role-rules-under-operator-Role-ins.patch - Pack configuration files for libvirt - Allow to configure utility containers for update test 0001-improve-kubevirt-update-test.patch - Drop kubevirt-psp-caasp.yaml - Use semantic equality comparison 0002-use-semantic-equality-comparison.patch - Avoid to return nil failure message 0003-Avoid-to-return-nil-failure-message.patch - Increase storage requirements in _constraints - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) 0004-only-create-1MiB-aligned-disk-images.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Use semantic equality comparison 0002-use-semantic-equality-comparison.patch - Avoid to return nil failure message 0003-Avoid-to-return-nil-failure-message.patch - Increase storage requirements in _constraints - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) 0004-only-create-1MiB-aligned-disk-images.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Update to version 0.54.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0 - Drop upstreamed patches 0001-improve-kubevirt-update-test.patch 0002-use-semantic-equality-comparison.patch 0003-Avoid-to-return-nil-failure-message.patch 0004-only-create-1MiB-aligned-disk-images.patch - Add CVE fixes 0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528) 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460) 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch - Update libvirt-go to fix memory leak 0004-Update-libvirt-go-to-fix-memory-leak.patch - Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516) 0005-Improve-non-root-path-handling - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Support topology spread constraints 0006-topology-spread-constraints.patch - Fix containerdisk unmount logic 0007-Fix-containerdisk-unmount-logic.patch - Update to version 0.57.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0 - Drop upstreamed patches: 0001-Bump-the-version-of-go-restful-to-2.16.0.patch 0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch 0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch 0004-Update-libvirt-go-to-fix-memory-leak.patch 0005-Improve-non-root-path-handling 0006-topology-spread-constraints.patch 0007-Fix-containerdisk-unmount-logic.patch - Build new packages: virt-exportproxy and virt-exportserver - Update SP5 kubevirt registry path (bsc#1204140) - Update to version 0.58.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0 - Ensure RPMs and containers are built against the same distro - Be more strict when discovering the registry path: error out if the distro is unknown, instead of falling through to 'opensuse' by default - Fix libguestfs pod startup error 0001-guestfs-flag-to-set-uid-and-gid.patch - Use JSON syntax for slirp device 0002-network-Use-JSON-syntax-for-slirp-device.patch - Use recent golang compiler (bsc#1208916) - Limit operator secrets permission (CVE-2023-26484, bsc#1209359) 0003-Vulnerability-fix-limit-operator-secrets-permission.patch - TSC frequencies: add 250PPM tolerance (bsc#1210906) 0004-TSC-frequencies-add-250PPM-tolerance.patch - Update to version 1.0.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0 - Drop patches 0001-guestfs-flag-to-set-uid-and-gid.patch 0002-network-Use-JSON-syntax-for-slirp-device.patch 0003-Vulnerability-fix-limit-operator-secrets-permission.patch 0004-TSC-frequencies-add-250PPM-tolerance.patch - Add patches 0001-Fix-qemu-system-lookup.patch 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch - Add registry path for SLE15 SP6 - Use compat cmdline options for virtiofsd 0005-Use-compat-cmdline-options-for-virtiofsd.patch - Fix leaking file descriptor 0006-isolation-close-file-when-exits.patch - Fix volume detach on hotplug attachment pod delete 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch - Fix leaking tickers 0008-fix-ticker-leak.patch - Run helper pod as qemu user 0009-tests-Run-helper-pod-as-qemu-107-user.patch - SCSI reservation: fix leftover mount and resource permissions 0010-Fix-PR-leftover-mount-and-perms.patch - Bump client-go (fix possible panic in discovery) 0011-Fix-Aggregated-Discovery.patch - Wait for new hotplug attachment pod to be ready 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch - Adapt the storage tests to the new populators flow 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch - Create export VM datavolumes compatible with populators 0014-Export-create-populator-compatible-datavolumes-from-.patch - Delete VMI prior to NFS server pod in tests 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Update to version 1.0.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.1 - Drop patches: 0002-ksm-Access-sysfs-from-the-host-filesystem.patch 0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch 0006-isolation-close-file-when-exits.patch 0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch 0008-fix-ticker-leak.patch 0009-tests-Run-helper-pod-as-qemu-107-user.patch 0010-Fix-PR-leftover-mount-and-perms.patch 0011-Fix-Aggregated-Discovery.patch 0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch 0013-Adapt-e2e-tests-to-CDI-1.57.0.patch 0014-Export-create-populator-compatible-datavolumes-from-.patch 0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch - Add registry path for SLE15 SP6 - Update to version 1.1.0 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.0 - Drop upstreamed patches 0001-Fix-qemu-system-lookup.patch 0003-Virtiofs-Remove-duplicated-functional-tests.patch - Add patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch (CVE-2023-44487) 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch - Fix seccomp profile for post-copy migration 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Set ExclusiveArch conditionally depending on the distro - Remove SLE15 SP4 from the distro check (end of general support) - Update to version 1.1.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.1.1 - Drop upstreamed patches 0001-Update-google.golang.org-grpc-to-1.56.3.patch 0002-virt-launcher-fix-qemu-non-root-path.patch 0003-cgroupsv2-reconstruct-device-allowlist.patch 0004-seccomp-Use-Names-field-to-define-the-syscall.patch - Fix test with initially invalid DataVolume (bsc#1218174) 0001-tests-Adapt-VM-phase-expectation.patch - Improve the OrdinalPodInterfaceName mechanism (bsc#1222699) 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch - Collect component Role rules under operator Role instead of ClusterRole (bsc#1223965, CVE-2024-33394) 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Update to version 1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.1 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.0 - Drop patches 0001-tests-Adapt-VM-phase-expectation.patch 0002-Improve-the-handling-of-ordinal-pod-interface-name-for-upgrade.patch 0003-Collect-component-Role-rules-under-operator-Role-ins.patch - Add patch 0001-Collect-component-Role-rules-under-operator-Role-ins.patch - Pack configuration files for libvirt - less 481: * Don't overwrite history file; just append to it. This behaves better when multiple sessions are running less simultaneously and using the same history file. * New command ESC-G goes to end of currently buffered data in a pipe. * Disable history feature when compiled with LESSHISTFILE set to "-". * In more-compatible mode, make the -p option apply to every file opened, not just the first one. * In more-compatible mode, change the -e option to work like -E, not -EF. * Treat multiple CRs before LF are like one CR (all the CRs are hidden). * Allow "extra" string in lesskey file to append to a multi-char command (like a search pattern), without executing the command. * Ignore -u/-U setting while viewing help file, so that underline and bold chars are displayed correctly. * Improve detection of "binary" files in UTF-8 mode. * Fix bug with ++ commands. * Fix bug where prompt was sometimes not displayed with +G. * Fix possible memory corruption * Fix bugs and improve performance in ampersand filtering. * Allow %% escape sequence in LESSOPEN variable. * Automate construction of Unicode tables from Unicode database. - add keyring and verify source signature - drop upstream patches: * less-458-out_of_bounds_read.patch * less-fix_crash_in_hilite_line.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - less 481: * Don't overwrite history file; just append to it. This behaves better when multiple sessions are running less simultaneously and using the same history file. * New command ESC-G goes to end of currently buffered data in a pipe. * Disable history feature when compiled with LESSHISTFILE set to "-". * In more-compatible mode, make the -p option apply to every file opened, not just the first one. * In more-compatible mode, change the -e option to work like -E, not -EF. * Treat multiple CRs before LF are like one CR (all the CRs are hidden). * Allow "extra" string in lesskey file to append to a multi-char command (like a search pattern), without executing the command. * Ignore -u/-U setting while viewing help file, so that underline and bold chars are displayed correctly. * Improve detection of "binary" files in UTF-8 mode. * Fix bug with ++ commands. * Fix bug where prompt was sometimes not displayed with +G. * Fix possible memory corruption * Fix bugs and improve performance in ampersand filtering. * Allow %% escape sequence in LESSOPEN variable. * Automate construction of Unicode tables from Unicode database. - add keyring and verify source signature - drop upstream patches: * less-458-out_of_bounds_read.patch * less-fix_crash_in_hilite_line.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - less 481: * Don't overwrite history file; just append to it. This behaves better when multiple sessions are running less simultaneously and using the same history file. * New command ESC-G goes to end of currently buffered data in a pipe. * Disable history feature when compiled with LESSHISTFILE set to "-". * In more-compatible mode, make the -p option apply to every file opened, not just the first one. * In more-compatible mode, change the -e option to work like -E, not -EF. * Treat multiple CRs before LF are like one CR (all the CRs are hidden). * Allow "extra" string in lesskey file to append to a multi-char command (like a search pattern), without executing the command. * Ignore -u/-U setting while viewing help file, so that underline and bold chars are displayed correctly. * Improve detection of "binary" files in UTF-8 mode. * Fix bug with ++ commands. * Fix bug where prompt was sometimes not displayed with +G. * Fix possible memory corruption * Fix bugs and improve performance in ampersand filtering. * Allow %% escape sequence in LESSOPEN variable. * Automate construction of Unicode tables from Unicode database. - add keyring and verify source signature - drop upstream patches: * less-458-out_of_bounds_read.patch * less-fix_crash_in_hilite_line.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - less 481: * Don't overwrite history file; just append to it. This behaves better when multiple sessions are running less simultaneously and using the same history file. * New command ESC-G goes to end of currently buffered data in a pipe. * Disable history feature when compiled with LESSHISTFILE set to "-". * In more-compatible mode, make the -p option apply to every file opened, not just the first one. * In more-compatible mode, change the -e option to work like -E, not -EF. * Treat multiple CRs before LF are like one CR (all the CRs are hidden). * Allow "extra" string in lesskey file to append to a multi-char command (like a search pattern), without executing the command. * Ignore -u/-U setting while viewing help file, so that underline and bold chars are displayed correctly. * Improve detection of "binary" files in UTF-8 mode. * Fix bug with ++ commands. * Fix bug where prompt was sometimes not displayed with +G. * Fix possible memory corruption * Fix bugs and improve performance in ampersand filtering. * Allow %% escape sequence in LESSOPEN variable. * Automate construction of Unicode tables from Unicode database. - add keyring and verify source signature - drop upstream patches: * less-458-out_of_bounds_read.patch * less-fix_crash_in_hilite_line.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - Fix CVE-2024-32487, mishandling of \n character in paths when LESSOPEN is set leads to OS command execution (CVE-2024-32487, bsc#1222849) * CVE-2024-32487.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - Fix CVE-2024-32487, mishandling of \n character in paths when LESSOPEN is set leads to OS command execution (CVE-2024-32487, bsc#1222849) * CVE-2024-32487.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - Fix CVE-2024-32487, mishandling of \n character in paths when LESSOPEN is set leads to OS command execution (CVE-2024-32487, bsc#1222849) * CVE-2024-32487.patch - update to version 487 * New commands ESC-{ and ESC-} to shift to start/end of displayed lines. * Make search highlights work correctly when changing caselessness with -i. * New option -Da in Windows version to enable SGR mode. * Fix "nothing to search" error when top or bottom line on screen is empty. * Fix bug when terminal has no "cm" termcap entry. * Fix incorrect display when entering double-width chars in search string. * Fix bug in Unicode handling that missed some double width characters. * Update Unicode database to 9.0.0. - remove less-429-widechars.patch that is no longer needed (fixed upstream) - refresh less-429-shell.patch - get rid of %{name} macro from the patch names - Extend lesskey with mappings for 8-bit controls key escape sequences - Let lessopen.sh also handle UTF-8 for (g)roff input, only apparmor as breaker of /usr/bin/file re,mains as "file" is not allowed to read files within the tool lessopen.sh - Use %license instead of %doc [bsc#1082318] - update to version 530 [bsc#1091308] * Don't output terminal init sequence if using -F and file fits on one screen. * When using -S, mark truncated lines with a special character. The character can be changed or disabled via the new --rscroll option. * New command M marks the last line displayed on the screen. * New command ESC-m removes a line mark. * Status column (enabled via -J) now shows mark letters. * Status column shows search matches even if highlighting is disabled via -G. * A second ESC-u command will clear search match markers in the status column. * Do same ANSI escape code filtering for tag matching that we do for searching, to help when viewing syntax-highlighted code. * Catch SIGTERM and clean up before exiting. * Fix bug initializing default charset on Windows. * Handle keypad ENTER key correctly if it sends something other than newline. * Fix buffering bug when using stdin with a LESSOPEN pipe. * Update Unicode tables to 2017-03-08. * Pass-thru Unicode formating chars (Cf type) instead of treating them as binary chars. But treat them as binary if -U is set. * Fix erroneous binary file warning when UTF-8 file contains ANSI SGR sequences. * Fix bugs when using LESSOPEN and switching between stdin and other files. * Fix some bugs handling filenames containing shell metacharacters * Fix some memory leaks. * Allow some debugging environment variables to be set in lesskey file. * Code improvements: * Use ANSI prototypes in funcs.h declarations. * Fix some const mismatches. * Remove archaic "register" in variable declarations. - remove the following patches (applied upstream) * less-429-strict_aliasing.patch * less-429-terminate.patch - renumber patches - remove 'make mkhelp' from the specfile as mkhelp.pl is now distributed in the tarball - less 551: * Add --mouse option * Add --wheel-lines option * Add --no-histdups option * Add --save-marks option * Support PCRE2 regular expression library * Redraw screen on SIGWINCH even if screen size doesn't change * Shell-escape filenames in history so they can be used again * Ring bell if user enters invalid long option name * Use PCRE_UTF8 flag for pcre regular expressions when in UTF-8 mode * Don't count lines in initial screen if using -X with -F * Fix bug in v command on empty file * Fix bug in v command when filename contains shell metacharacters - refresh less-429-shell.patch - Move lesskey* from /etc to /usr/etc - less 557: * Update Unicode tables * Treat Hangul Jamo medial vowels and final consonants as zero width * Display error message immediately when -o is toggled and input is not a pipe * Fix memory corruption when built with libtermcap * Support libtinfow - less 562: * Update unicode tables * formatting changes in man pages - update to 563: * Update Unicode tables. * Treat Hangul Jamo medial vowels and final consonants as zero width. * Display error message immediately when -o is toggled and input is not a pipe. * Fix regression: make screen repaint when "squished" and a no-movement command is given. * Fix erroneous EOF calculation when F command is interrupted. * Make WIN32C version include this fix from 551: Don't count lines in initial screen if using -X with -F. * Fix display bug in WIN32C version. * Fix memory corruption when built with libtermcap. * Support libtinfow. - less 581: * Change ESC-u command to toggle, not disable, highlighting per man page * Add ESC-U command * Add ctrl-W search modifier for wrapping search * F command can be interrupted by ^X * Support OSC 8 hyperlinks when -R is in effect * g command with no number will ignore -j and put first line at top of screen * Multiple + or -p command line options are handled better * Add the --incsearch option * Add the --line-num-width option * Add the --status-col-width option * Add the --use-color and --color options * Display -w highlight even if highlighted line is empty * If search result is in a long line, scroll to ensure it is visible * Editing the same file under different names now creates only one entry in the file list. * Make visual bell more visible on some terminals * Ring end-of-file bell no more than once per second * Build can use either Python or Perl for Makefile.aut operations * Fix crash when using the @ search modifier. * Fix crash in the 's' command due to duplicate free - drop less-429-save_line_position.patch which was never accepted upstream due to solving one problem and creating others - update to 581.2: * This fixes a bug found in less-581 where the terminal was sometimes left in mouse-reporting mode after exiting less. - update to 586: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * Fix bug which could leave terminal in mouse-reporting mode after exiting less. * Fix bug which caused failure to respond to window resize. * Fix backslash bug searching in tag file. - Remove --with-pic (no static libs are ever produced). - update to 590: * Make less able to read lesskey source files (deprecating lesskey). * If XDG_CONFIG_HOME is set, find lesskey source file in $XDG_CONFIG_HOME/lesskey rather than $HOME/.lesskey. * If XDG_DATA_HOME is set, find and store history file in $XDG_DATA_HOME/lesshst rather than $HOME/.lesshst. * Add the --lesskey-src option. * Add the --file-size option. * With -F, if screen is resized to make file fit on one screen, don't exit. - Fix build on Leap: Account for distinction in confdir after UsrMerge. - Add missing runtime dependency on which, which it is used by lessopen.sh. Fix bsc#1190552. - Apply "cve-2022-46663.patch" to fix a vulnerability in less that could be exploited for denial-of-service attacks or even remote code execution by printing specially crafted escape sequences to the terminal. [CVE-2022-46663, bsc#1207815] - Fix CVE-2022-48624, LESSCLOSE handling in less does not quote shell metacharacters, bsc#1219901 * CVE-2022-48624.patch - Fix CVE-2024-32487, mishandling of \n character in paths when LESSOPEN is set leads to OS command execution (CVE-2024-32487, bsc#1222849) * CVE-2024-32487.patch - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 1.6.2: This release of libX11 includes a number of fixes to handle realloc() failure better, resolves a number of compiler & static analyzer warnings, fixes several bugs in the X Input Method framework, and cleans up the XKB code to be a little more maintainable. - Drop upstreamed patches: + Patch10: bug-239698_libx11.diff + Patch13: bug-221326-xim-sync.patch - U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch * fix typo in en_US Compose file (s/dead_actute/dead_acute/) (bnc#869333) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Update to version 1.6.3: This release of libX11 looks bigger than it is, due to a lot of spec/doc cleanup work that doesn't affect the code itself. There is still a good deal of bug fixes, code cleanup, locale improvements, and compose key table additions, including new UTF-8 compose sequences for: + <Multi_key> <R> <equal> : "<U+20B9>" U20b9 # INDIAN RUPEE SIGN + <Multi_key> <S> <semicolon> : "Ș" U0218 # LATIN CAPITAL LETTER S WITH COMMA BELOW + <Multi_key> <s> <semicolon> : "ș" U0219 # LATIN SMALL LETTER S WITH COMMA BELOW + <Multi_key> <T> <semicolon> : "Ț" U021A # LATIN CAPITAL LETTER T WITH COMMA BELOW + <Multi_key> <t> <semicolon> : "ț" U021B # LATIN SMALL LETTER T WITH COMMA BELOW + <Multi_key> <F> <U> : "<U+1F595>" U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED + <Multi_key> <L> <L> <A> <P> : "<U+1F596>" U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS - Changes to package: + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch - marked baselibs.conf as source file in specfile - U_fix_for_Xlib_32-bit_request_number_issues.patch * Fix for overflow of requet number on 32bit platforms. (bnc#845916) - Update to version 1.6.4: + Move Compose \ o / to be with other emoji compose sequences + Replace Xmalloc+memset pairs with Xcalloc calls + Remove unused definition of XCONN_CHECK_FREQ + Bug 93184: read_EncodingInfo invalid free + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification + XlcDL.c: replace strcpy+strcat sequences with snprintf + XlcDL.c: reduce code duplication + lcPubWrap: replace malloc(strlen) + strcpy with strdup + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them + Stop checking for preferred order of local transports + Don't need to link libX11-xcb against libX11 + xcms: use size_t for strlen/sizeof values instead of converting to int & back + xcms: use unsigned indexes when looping through unsigned values + xcms: use size_t for pointer offsets passed to strncmp + omGeneric.c: Correct the parameter usage of sizeof + fix for Xlib 32-bit request number issues + Add Compose sequence for U+1F4A9. + Xlib.h: Fix macros imitating C functions. + Add compose file for pt_PT similar to pt_BR + Mark _XNextRequest as hidden + New compose keys for local languages in Togo + Fixup param specification for XChangeProperty() - Package changes: + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch - Run fdupes over at least the manpages - u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219) - Update to version 1.6.5: + Revert "Compose sequences for rouble sign" + specs/libX11: More synopsis fixes + specs/libX11: Fix paramdef entries listing multiple parameters + specs/libX11: Make paramdef spacing more consistent + specs/libX11: Add missing parameter types for XGetWindowProperty() + specs/libX11: Fix broken synopsis for Data/Data16/Data32 + specs/libX11: Update Portability Considerations for the 21st century + autogen.sh: use quoted string variables + Plug a memory leak + Fix wrong Xfree in XListFonts failure path + Typos in "Xlib - C Language X Interface" document - Chapter 02 + autogen: add default patch prefix + Compose sequences for rouble sign + autogen.sh: use exec instead of waiting for configure to finish + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8 - supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch - u_off-by-one-write-in-XListExtensions.patch * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599) - u_out-of-boundary-write-in-XListExtensions.patch * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600) - u_crash-on-invalid-reply-in-XListExtensions.patch * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598) - U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch, U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch, U_003-FixMoreUncheckedLengths.patch, U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch, U_005-ZeroOutBuffersInFunctions.patch, * XIM client heap overflows (CVE-2020-14344, bsc#1174628) - U_006-Fix-size-calculation-in-_XimAttributeToValue.patch: * Regression fix in previous XIM client head overflow fixes (CVE-2020-14344, bsc#1174628) - U_0001-Fix-an-integer-overflow-in-init_om.patch * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239] - U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch U_0002-remove-empty-line.patch U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch U_0005-Prepare-for-_XIOError-possibly-returning.patch U_0006-Fix-poll_for_response-race-condition.patch * fixes a race condition in libX11 that causes various applications to crash randomly (boo#1181963) - refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch - U_CVE-2021-31535.patch * adds missing request length checks in libX11 (CVE-2021-31535, bsc#1182506) - redone U_CVE-2021-31535.patch due to regressions (boo#1186643) * fixes segfaults for xforms applications like fdesign - U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch * security update for CVE-2022-3554 (bsc#1204422) - U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch * security update for CVE-2022-3555 (bsc#1204425) - U_Don-t-try-to-destroy-NULL-condition-variables.patch * fixes regression introduced with security update for CVE-2022-3555 (bsc#1204425, bsc#1208881) - U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138) - U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch * CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms() (boo#1215683) * CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage() (boo#1215684) * CVE-2023-43787 libX11: integer overflow in XCreateImage() leading to a heap overflow (boo#1215685) - Drop source package, was only used by grpc which was switched over to use the shared library - Update to version 20200923.2 What's New: * absl::StatusOr<T> has been released. See our blog post for more information. * Abseil Flags reflection interfaces have been released. * Abseil Flags memory usage has been significantly optimized. * Abseil now supports a "hardened" build mode. This build mode enables runtime checks that guard against programming errors that may lead to security vulnerabilities. Notable Fixes: * Sanitizer dynamic annotations like AnnotateRWLockCreate that are also defined by the compiler sanitizer implementation are no longer also defined by Abseil. * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions. * Sanitizer usage is now automatically detected and no longer requires macros like ADDRESS_SANITIZER to be defined on the command line. Breaking Changes: * Abseil no longer contains a dynamic_annotations library. Users using a supported build system (Bazel or CMake) are unaffected by this, but users manually specifying link libraries may get an error about a missing linker input. - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - Drop source package, was only used by grpc which was switched over to use the shared library - Update to version 20200923.2 What's New: * absl::StatusOr<T> has been released. See our blog post for more information. * Abseil Flags reflection interfaces have been released. * Abseil Flags memory usage has been significantly optimized. * Abseil now supports a "hardened" build mode. This build mode enables runtime checks that guard against programming errors that may lead to security vulnerabilities. Notable Fixes: * Sanitizer dynamic annotations like AnnotateRWLockCreate that are also defined by the compiler sanitizer implementation are no longer also defined by Abseil. * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions. * Sanitizer usage is now automatically detected and no longer requires macros like ADDRESS_SANITIZER to be defined on the command line. Breaking Changes: * Abseil no longer contains a dynamic_annotations library. Users using a supported build system (Bazel or CMake) are unaffected by this, but users manually specifying link libraries may get an error about a missing linker input. - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - Drop source package, was only used by grpc which was switched over to use the shared library - Update to version 20200923.2 What's New: * absl::StatusOr<T> has been released. See our blog post for more information. * Abseil Flags reflection interfaces have been released. * Abseil Flags memory usage has been significantly optimized. * Abseil now supports a "hardened" build mode. This build mode enables runtime checks that guard against programming errors that may lead to security vulnerabilities. Notable Fixes: * Sanitizer dynamic annotations like AnnotateRWLockCreate that are also defined by the compiler sanitizer implementation are no longer also defined by Abseil. * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions. * Sanitizer usage is now automatically detected and no longer requires macros like ADDRESS_SANITIZER to be defined on the command line. Breaking Changes: * Abseil no longer contains a dynamic_annotations library. Users using a supported build system (Bazel or CMake) are unaffected by this, but users manually specifying link libraries may get an error about a missing linker input. - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - Drop source package, was only used by grpc which was switched over to use the shared library - Update to version 20200923.2 What's New: * absl::StatusOr<T> has been released. See our blog post for more information. * Abseil Flags reflection interfaces have been released. * Abseil Flags memory usage has been significantly optimized. * Abseil now supports a "hardened" build mode. This build mode enables runtime checks that guard against programming errors that may lead to security vulnerabilities. Notable Fixes: * Sanitizer dynamic annotations like AnnotateRWLockCreate that are also defined by the compiler sanitizer implementation are no longer also defined by Abseil. * Sanitizer macros are now prefixed with ABSL_ to avoid naming collisions. * Sanitizer usage is now automatically detected and no longer requires macros like ADDRESS_SANITIZER to be defined on the command line. Breaking Changes: * Abseil no longer contains a dynamic_annotations library. Users using a supported build system (Bazel or CMake) are unaffected by this, but users manually specifying link libraries may get an error about a missing linker input. - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - update to 20240116.1: * Add absl::NoDestructor<T> to simplify defining static types that do not need to be destructed upon program exit. * Add configurable verbose logging (also known as VLOG). * Added absl::Overload(), which returns a functor that provides overloads based on the functors passed to it. Note that this functionality requires C++17 or newer. * Breaking Change: AbslHashValue() no longer accepts C-style arrays as a parameter, caller need to wrap C-string literals in absl::string_view. * Breaking Change: absl::weak_equality and absl::strong_equality have been removed. The corresponding std types were removed before C++20 was finalized - SLE-only: import upstream patch to fix build with gcc7 in C++17 mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261) + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303 - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - update to 20240116.1: * Add absl::NoDestructor<T> to simplify defining static types that do not need to be destructed upon program exit. * Add configurable verbose logging (also known as VLOG). * Added absl::Overload(), which returns a functor that provides overloads based on the functors passed to it. Note that this functionality requires C++17 or newer. * Breaking Change: AbslHashValue() no longer accepts C-style arrays as a parameter, caller need to wrap C-string literals in absl::string_view. * Breaking Change: absl::weak_equality and absl::strong_equality have been removed. The corresponding std types were removed before C++20 was finalized - SLE-only: import upstream patch to fix build with gcc7 in C++17 mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261) + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303 - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - update to 20240116.1: * Add absl::NoDestructor<T> to simplify defining static types that do not need to be destructed upon program exit. * Add configurable verbose logging (also known as VLOG). * Added absl::Overload(), which returns a functor that provides overloads based on the functors passed to it. Note that this functionality requires C++17 or newer. * Breaking Change: AbslHashValue() no longer accepts C-style arrays as a parameter, caller need to wrap C-string literals in absl::string_view. * Breaking Change: absl::weak_equality and absl::strong_equality have been removed. The corresponding std types were removed before C++20 was finalized - SLE-only: import upstream patch to fix build with gcc7 in C++17 mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261) + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303 - Update to LTS version 20210324.0 * Breaking: The empty absl::container target has been removed from the CMake build. This target had no effect and references to this target in user code can safely be removed. * New: The cleanup library has been released. This library contains the control-flow-construct-like type absl::Cleanup which is used for executing a callback on scope exit. * New: The numeric library now includes bits.h, a polyfill header containing implementations of C++20's bitwise math functions. * New: Abseil now installs pkg-config files to make it easier to use Abseil with some other build systems. * New: Abseil now respects the default CMake installation paths. Standard CMake variables like CMAKE_INSTALL_PREFIX can be used to change the installation path. - Added Correctly-install-pkgconfig.patch from upstream to fix installation of pkgconfig files - Call ldconfig on post and postun - Update to LTS version 20210324.1 * Fixed missing absl::Cleanup * Fixed pkgconfig install path - Dropped upstream merged Correctly-install-pkgconfig.patch - Update to version 20210324.2 (LTS): * No user visible changes, only build system related - update to 20211102.0: * absl::Cord is now implemented as a b-tree. The new implementation offers improved performance in most workloads. * absl::SimpleHexAtoi() has been added to strings library for parsing hexadecimal strings - Fix build on SLE-12-SP5 - Implement shlib packaging policy - Add options-old.patch, options-cxx17.patch (boo#1203378) * Ensure ABI stability regardless of compiler settings per instruction in the header. - Remove obsolete 0%{suse_version} < 1500 conditions - Update to version 20220623.0 What's New: * Added absl::AnyInvocable, a move-only function type. * Added absl::CordBuffer, a type for buffering data for eventual inclusion an absl::Cord, which is useful for writing zero-copy code. * Added support for command-line flags of type absl::optional<T>. Breaking Changes: * CMake builds now use the flag ABSL_BUILD_TESTING (default: OFF) to control whether or not unit tests are built. * The ABSL_DEPRECATED macro now works with the GCC compiler. GCC users that are experiencing new warnings can use -Wno-deprecated-declatations silence the warnings or use -Wno-error=deprecated-declarations to see warnings but not fail the build. * ABSL_CONST_INIT uses the C++20 keyword constinit when available. Some compilers are more strict about where this keyword must appear compared to the pre-C++20 implementation. * Bazel builds now depend on the bazelbuild/bazel-skylib repository. See Abseil's WORKSPACE file for an example of how to add this dependency. Other: * This will be the last release to support C++11. Future releases will require at least C++14. - run spec-cleaner - Add Fix-maes-msse41-leaking-into-pkgconfig.patch * Do not make programs compiled with abseil require new-ish CPUs (boo#1203379) - update to 20220623.1: * minor warning fix - update to 20230125.2 What's New: The Abseil logging library has been released. This library provides facilities for writing short text messages about the status of a program to stderr, disk files, or other sinks (via an extension API). See the logging library documentation for more information. An extension point, AbslStringify(), allows user-defined types to seamlessly work with Abseil's string formatting functions like absl::StrCat() and absl::StrFormat(). A library for computing CRC32C checksums has been added. Floating-point parsing now uses the Eisel-Lemire algorithm, which provides a significant speed improvement. The flags library now provides suggestions for the closest flag(s) in the case of misspelled flags. Using CMake to install Abseil now makes the installed artifacts (in particular absl/base/options.h) reflect the compiled ABI. Breaking Changes: Abseil now requires at least C++14 and follows Google's Foundational C++ Support Policy. See this table for a list of currently supported versions compilers, platforms, and build tools. The legacy spellings of the thread annotation macros/functions (e.g. GUARDED_BY()) have been removed by default in favor of the ABSL_ prefixed versions (e.g. ABSL_GUARDED_BY()) due to clashes with other libraries. The compatibility macro ABSL_LEGACY_THREAD_ANNOTATIONS can be defined on the compile command-line to temporarily restore these spellings, but this compatibility macro will be removed in the future. Known Issues The Abseil logging library in this release is not a feature-complete replacement for glog yet. VLOG and DFATAL are examples of features that have not yet been released. - obsolete Fix-maes-msse41-leaking-into-pkgconfig.patch - update to 20230125.3 Details can be found on: https://github.com/abseil/abseil-cpp/releases/tag/20230125.3 - Add baselibs.conf to make protobuf happy. Hopefully temporary. - Fix build on older systems by requiring C++17 compliant compiler - Added patch: * cmake.patch + lower the cmake requirement to 3.5 in order to be able to build on SLE12SP5 - update to 20230802.0 What's New: * Added the nullability library for designating the expected nullability of pointers. Currently these serve as annotations only, but it is expected that compilers will one day be able to use these annotations for diagnostic purposes. * Added the prefetch library as a portable layer for moving data into caches before it is read. * Abseil's hash tables now detect many more programming errors in debug and sanitizer builds. * Abseil's synchronization objects now differentiate absolute waits (when passed an absl::Time) from relative waits (when passed an absl::Duration) when the underlying platform supports differentiating these cases. This only makes a difference when system clocks are adjusted. * Abseil's flag parsing library includes additional methods that make it easier to use when another library also expects to be able to parse flags. * absl::string_view is now available as a smaller target, @com_google_absl//absl/strings:string_view, so that users may use this library without depending on the much larger @com_google_absl//absl/strings target. - update to 20230802.1: * Add StdcppWaiter to the end of the list of waiter implementations - fix build for non-SUSE distributions - update to 20240116.1: * Add absl::NoDestructor<T> to simplify defining static types that do not need to be destructed upon program exit. * Add configurable verbose logging (also known as VLOG). * Added absl::Overload(), which returns a functor that provides overloads based on the functors passed to it. Note that this functionality requires C++17 or newer. * Breaking Change: AbslHashValue() no longer accepts C-style arrays as a parameter, caller need to wrap C-string literals in absl::string_view. * Breaking Change: absl::weak_equality and absl::strong_equality have been removed. The corresponding std types were removed before C++20 was finalized - SLE-only: import upstream patch to fix build with gcc7 in C++17 mode: hash-fix-gcc7-cpp17-build.patch (bsc#1222261) + Upstream commit bb83aceacb554e79e7cd2404856f0be30bd00303 - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - Added patches: * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR decoder (CVE-2018-1000877 bsc#1120653) * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR decoder (CVE-2018-1000878 bsc#1120654) * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656) * CVE-2018-1000880.patch, which fixes an improper input validation vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659) - Make use of %license macro - Applied spec-cleaner - Added patches: * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341) * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342) - Update to version 3.4.0 * Support for file and directory symlinks on Windows * Read support for RAR 5.0 archives * Read support for ZIPX archives with xz, lzma, ppmd8 and bzip2 compression * Support for non-recursive list and extract * New tar option: --exclude-vcs * Improved file attribute support on Linux and file flags support on FreeBSD * Fix reading Android APK archives (#1055 ) * Fix problems related to unreadable directories (#1167) * A two-digit number of OSS-Fuzz issues was resolved in this release including CVE-2019-18408 - Add libarchive.keyring and validate the tarball signature - Drop all security patches, fixed upstream: * CVE-2018-1000877.patch * CVE-2018-1000878.patch * CVE-2018-1000879.patch * CVE-2018-1000880.patch * CVE-2019-1000019.patch * CVE-2019-1000020.patch - Add lz4 and zstd support - Add BuildRequires on liblz4-devel and libzstd-devel - Switch to cmake build - Add lib-suffix.patch to honor LIB_SUFFIX - Add fix-zstd-test.patch to fix zstd test - Add fix-soversion.patch to fix the soversion to 13 as autotools - fix bsc#1157569 CVE-2019-19221.patch out-of-bounds read in libarchive - Update to version 3.4.1 New features: * Unicode filename support for reading lha/lzh archives * New pax write option "xattrhdr" Important bugfixes: * security fixes in wide string processing (#1276 #1298) * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221 * security fixes and optimizations to write filter logic (#351) * security fix related to use of readlink(2) (1dae5a5) * sparse file handling fixes (#1218 #1260) - Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream - Revert back to autoconf, cmake introduces a cycle. Leave cmake patches in since they are basically correct and might be useful in the future. - Update to version 3.4.2 New features: * support for atomic file extraction (bsdtar -x --safe-writes) (#1289) * support for mbed TLS (PolarSSL) (#1301) Important bugfixes: * security fixes in RAR5 reader (#1280 #1326) * compression buffer fix in XAR writer (#1317) * fix uname and gname longer than 32 characters in PAX writer (#1319) * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325) * fix support for extracting 7z archive entries with Delta filter (#987) - Switch back to cmake build now that cmake-mini exists, this will no longer create a build-cycle. - Update to version 3.4.3 * support for pzstd compressed files (#1357) * support for RHT.security.selinux tar extended attribute (#1348) * various zstd fixes and improvements (#1342 #1352 #1359) * child process handling fixes (#1372) - fix build with binutils submitted to Factory, adding upstream libarchive-3.4.3-fix_test_write_disk_secure.patch - Update to version 3.5.0 New features: * mtree digest reader support (#1347) * completed support for UTF-8 encoding conversion (#1389) * minor API enhancements (#1258, #1405) * support for system extended attributes (#1409) * support for decompression of symbolic links in zipx archives (#1435) Important bugfixes * fixed extraction of archives with hard links pointing to itself (#1381) * cpio fixes (#1387, #1388) * fixed uninitialized size in rar5_read_data (#1408) * fixed memory leaks in error case of archive_write_open() functions (#1456) - Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream. - update to 3.5.1: * various compilation fixes (#1461, #1462, #1463, #1464) * fixed undefined behavior in a function in warc reader (#1465) - Fix CVE-2021-36976 use-after-free in copy_string (CVE-2021-36976, bsc#1188572) * fix-CVE-2021-36976.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2017-5601, bsc#1022528, bsc#1189528 - Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280, bsc#1197634) * fix-CVE-2022-26280.patch - Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177, bsc#1192425) * CVE-2021-23177.patch - Fix CVE-2021-31566, modifies file flags of symlink target (CVE-2021-31566, bsc#1192426.patch) CVE-2021-31566.patch - Fix bsc#1192427, processing fixup entries may follow symbolic links bsc1192427.patch - Fix CVE-2022-36227, Handle a calloc returning NULL (CVE-2022-36227, bsc#1205629) * CVE-2022-36227.patch - Fix CVE-2024-20696, heap based out-of-bounds write (CVE-2024-20696, bsc#1225971) * CVE-2024-20696.patch - Added patches: * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR decoder (CVE-2018-1000877 bsc#1120653) * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR decoder (CVE-2018-1000878 bsc#1120654) * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656) * CVE-2018-1000880.patch, which fixes an improper input validation vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659) - Make use of %license macro - Applied spec-cleaner - Added patches: * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341) * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342) - Update to version 3.4.0 * Support for file and directory symlinks on Windows * Read support for RAR 5.0 archives * Read support for ZIPX archives with xz, lzma, ppmd8 and bzip2 compression * Support for non-recursive list and extract * New tar option: --exclude-vcs * Improved file attribute support on Linux and file flags support on FreeBSD * Fix reading Android APK archives (#1055 ) * Fix problems related to unreadable directories (#1167) * A two-digit number of OSS-Fuzz issues was resolved in this release including CVE-2019-18408 - Add libarchive.keyring and validate the tarball signature - Drop all security patches, fixed upstream: * CVE-2018-1000877.patch * CVE-2018-1000878.patch * CVE-2018-1000879.patch * CVE-2018-1000880.patch * CVE-2019-1000019.patch * CVE-2019-1000020.patch - Add lz4 and zstd support - Add BuildRequires on liblz4-devel and libzstd-devel - Switch to cmake build - Add lib-suffix.patch to honor LIB_SUFFIX - Add fix-zstd-test.patch to fix zstd test - Add fix-soversion.patch to fix the soversion to 13 as autotools - fix bsc#1157569 CVE-2019-19221.patch out-of-bounds read in libarchive - Update to version 3.4.1 New features: * Unicode filename support for reading lha/lzh archives * New pax write option "xattrhdr" Important bugfixes: * security fixes in wide string processing (#1276 #1298) * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221 * security fixes and optimizations to write filter logic (#351) * security fix related to use of readlink(2) (1dae5a5) * sparse file handling fixes (#1218 #1260) - Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream - Revert back to autoconf, cmake introduces a cycle. Leave cmake patches in since they are basically correct and might be useful in the future. - Update to version 3.4.2 New features: * support for atomic file extraction (bsdtar -x --safe-writes) (#1289) * support for mbed TLS (PolarSSL) (#1301) Important bugfixes: * security fixes in RAR5 reader (#1280 #1326) * compression buffer fix in XAR writer (#1317) * fix uname and gname longer than 32 characters in PAX writer (#1319) * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325) * fix support for extracting 7z archive entries with Delta filter (#987) - Switch back to cmake build now that cmake-mini exists, this will no longer create a build-cycle. - Update to version 3.4.3 * support for pzstd compressed files (#1357) * support for RHT.security.selinux tar extended attribute (#1348) * various zstd fixes and improvements (#1342 #1352 #1359) * child process handling fixes (#1372) - fix build with binutils submitted to Factory, adding upstream libarchive-3.4.3-fix_test_write_disk_secure.patch - Update to version 3.5.0 New features: * mtree digest reader support (#1347) * completed support for UTF-8 encoding conversion (#1389) * minor API enhancements (#1258, #1405) * support for system extended attributes (#1409) * support for decompression of symbolic links in zipx archives (#1435) Important bugfixes * fixed extraction of archives with hard links pointing to itself (#1381) * cpio fixes (#1387, #1388) * fixed uninitialized size in rar5_read_data (#1408) * fixed memory leaks in error case of archive_write_open() functions (#1456) - Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream. - update to 3.5.1: * various compilation fixes (#1461, #1462, #1463, #1464) * fixed undefined behavior in a function in warc reader (#1465) - Fix CVE-2021-36976 use-after-free in copy_string (CVE-2021-36976, bsc#1188572) * fix-CVE-2021-36976.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2017-5601, bsc#1022528, bsc#1189528 - Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280, bsc#1197634) * fix-CVE-2022-26280.patch - Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177, bsc#1192425) * CVE-2021-23177.patch - Fix CVE-2021-31566, modifies file flags of symlink target (CVE-2021-31566, bsc#1192426.patch) CVE-2021-31566.patch - Fix bsc#1192427, processing fixup entries may follow symbolic links bsc1192427.patch - Fix CVE-2022-36227, Handle a calloc returning NULL (CVE-2022-36227, bsc#1205629) * CVE-2022-36227.patch - Fix CVE-2024-20696, heap based out-of-bounds write (CVE-2024-20696, bsc#1225971) * CVE-2024-20696.patch - Added patches: * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR decoder (CVE-2018-1000877 bsc#1120653) * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR decoder (CVE-2018-1000878 bsc#1120654) * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656) * CVE-2018-1000880.patch, which fixes an improper input validation vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659) - Make use of %license macro - Applied spec-cleaner - Added patches: * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341) * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342) - Update to version 3.4.0 * Support for file and directory symlinks on Windows * Read support for RAR 5.0 archives * Read support for ZIPX archives with xz, lzma, ppmd8 and bzip2 compression * Support for non-recursive list and extract * New tar option: --exclude-vcs * Improved file attribute support on Linux and file flags support on FreeBSD * Fix reading Android APK archives (#1055 ) * Fix problems related to unreadable directories (#1167) * A two-digit number of OSS-Fuzz issues was resolved in this release including CVE-2019-18408 - Add libarchive.keyring and validate the tarball signature - Drop all security patches, fixed upstream: * CVE-2018-1000877.patch * CVE-2018-1000878.patch * CVE-2018-1000879.patch * CVE-2018-1000880.patch * CVE-2019-1000019.patch * CVE-2019-1000020.patch - Add lz4 and zstd support - Add BuildRequires on liblz4-devel and libzstd-devel - Switch to cmake build - Add lib-suffix.patch to honor LIB_SUFFIX - Add fix-zstd-test.patch to fix zstd test - Add fix-soversion.patch to fix the soversion to 13 as autotools - fix bsc#1157569 CVE-2019-19221.patch out-of-bounds read in libarchive - Update to version 3.4.1 New features: * Unicode filename support for reading lha/lzh archives * New pax write option "xattrhdr" Important bugfixes: * security fixes in wide string processing (#1276 #1298) * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221 * security fixes and optimizations to write filter logic (#351) * security fix related to use of readlink(2) (1dae5a5) * sparse file handling fixes (#1218 #1260) - Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream - Revert back to autoconf, cmake introduces a cycle. Leave cmake patches in since they are basically correct and might be useful in the future. - Update to version 3.4.2 New features: * support for atomic file extraction (bsdtar -x --safe-writes) (#1289) * support for mbed TLS (PolarSSL) (#1301) Important bugfixes: * security fixes in RAR5 reader (#1280 #1326) * compression buffer fix in XAR writer (#1317) * fix uname and gname longer than 32 characters in PAX writer (#1319) * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325) * fix support for extracting 7z archive entries with Delta filter (#987) - Switch back to cmake build now that cmake-mini exists, this will no longer create a build-cycle. - Update to version 3.4.3 * support for pzstd compressed files (#1357) * support for RHT.security.selinux tar extended attribute (#1348) * various zstd fixes and improvements (#1342 #1352 #1359) * child process handling fixes (#1372) - fix build with binutils submitted to Factory, adding upstream libarchive-3.4.3-fix_test_write_disk_secure.patch - Update to version 3.5.0 New features: * mtree digest reader support (#1347) * completed support for UTF-8 encoding conversion (#1389) * minor API enhancements (#1258, #1405) * support for system extended attributes (#1409) * support for decompression of symbolic links in zipx archives (#1435) Important bugfixes * fixed extraction of archives with hard links pointing to itself (#1381) * cpio fixes (#1387, #1388) * fixed uninitialized size in rar5_read_data (#1408) * fixed memory leaks in error case of archive_write_open() functions (#1456) - Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream. - update to 3.5.1: * various compilation fixes (#1461, #1462, #1463, #1464) * fixed undefined behavior in a function in warc reader (#1465) - Fix CVE-2021-36976 use-after-free in copy_string (CVE-2021-36976, bsc#1188572) * fix-CVE-2021-36976.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2017-5601, bsc#1022528, bsc#1189528 - Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280, bsc#1197634) * fix-CVE-2022-26280.patch - Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177, bsc#1192425) * CVE-2021-23177.patch - Fix CVE-2021-31566, modifies file flags of symlink target (CVE-2021-31566, bsc#1192426.patch) CVE-2021-31566.patch - Fix bsc#1192427, processing fixup entries may follow symbolic links bsc1192427.patch - Fix CVE-2022-36227, Handle a calloc returning NULL (CVE-2022-36227, bsc#1205629) * CVE-2022-36227.patch - Fix CVE-2024-20696, heap based out-of-bounds write (CVE-2024-20696, bsc#1225971) * CVE-2024-20696.patch - Added patches: * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR decoder (CVE-2018-1000877 bsc#1120653) * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR decoder (CVE-2018-1000878 bsc#1120654) * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656) * CVE-2018-1000880.patch, which fixes an improper input validation vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659) - Make use of %license macro - Applied spec-cleaner - Added patches: * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341) * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342) - Update to version 3.4.0 * Support for file and directory symlinks on Windows * Read support for RAR 5.0 archives * Read support for ZIPX archives with xz, lzma, ppmd8 and bzip2 compression * Support for non-recursive list and extract * New tar option: --exclude-vcs * Improved file attribute support on Linux and file flags support on FreeBSD * Fix reading Android APK archives (#1055 ) * Fix problems related to unreadable directories (#1167) * A two-digit number of OSS-Fuzz issues was resolved in this release including CVE-2019-18408 - Add libarchive.keyring and validate the tarball signature - Drop all security patches, fixed upstream: * CVE-2018-1000877.patch * CVE-2018-1000878.patch * CVE-2018-1000879.patch * CVE-2018-1000880.patch * CVE-2019-1000019.patch * CVE-2019-1000020.patch - Add lz4 and zstd support - Add BuildRequires on liblz4-devel and libzstd-devel - Switch to cmake build - Add lib-suffix.patch to honor LIB_SUFFIX - Add fix-zstd-test.patch to fix zstd test - Add fix-soversion.patch to fix the soversion to 13 as autotools - fix bsc#1157569 CVE-2019-19221.patch out-of-bounds read in libarchive - Update to version 3.4.1 New features: * Unicode filename support for reading lha/lzh archives * New pax write option "xattrhdr" Important bugfixes: * security fixes in wide string processing (#1276 #1298) * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221 * security fixes and optimizations to write filter logic (#351) * security fix related to use of readlink(2) (1dae5a5) * sparse file handling fixes (#1218 #1260) - Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream - Revert back to autoconf, cmake introduces a cycle. Leave cmake patches in since they are basically correct and might be useful in the future. - Update to version 3.4.2 New features: * support for atomic file extraction (bsdtar -x --safe-writes) (#1289) * support for mbed TLS (PolarSSL) (#1301) Important bugfixes: * security fixes in RAR5 reader (#1280 #1326) * compression buffer fix in XAR writer (#1317) * fix uname and gname longer than 32 characters in PAX writer (#1319) * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325) * fix support for extracting 7z archive entries with Delta filter (#987) - Switch back to cmake build now that cmake-mini exists, this will no longer create a build-cycle. - Update to version 3.4.3 * support for pzstd compressed files (#1357) * support for RHT.security.selinux tar extended attribute (#1348) * various zstd fixes and improvements (#1342 #1352 #1359) * child process handling fixes (#1372) - fix build with binutils submitted to Factory, adding upstream libarchive-3.4.3-fix_test_write_disk_secure.patch - Update to version 3.5.0 New features: * mtree digest reader support (#1347) * completed support for UTF-8 encoding conversion (#1389) * minor API enhancements (#1258, #1405) * support for system extended attributes (#1409) * support for decompression of symbolic links in zipx archives (#1435) Important bugfixes * fixed extraction of archives with hard links pointing to itself (#1381) * cpio fixes (#1387, #1388) * fixed uninitialized size in rar5_read_data (#1408) * fixed memory leaks in error case of archive_write_open() functions (#1456) - Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream. - update to 3.5.1: * various compilation fixes (#1461, #1462, #1463, #1464) * fixed undefined behavior in a function in warc reader (#1465) - Fix CVE-2021-36976 use-after-free in copy_string (CVE-2021-36976, bsc#1188572) * fix-CVE-2021-36976.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2017-5601, bsc#1022528, bsc#1189528 - Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280, bsc#1197634) * fix-CVE-2022-26280.patch - Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177, bsc#1192425) * CVE-2021-23177.patch - Fix CVE-2021-31566, modifies file flags of symlink target (CVE-2021-31566, bsc#1192426.patch) CVE-2021-31566.patch - Fix bsc#1192427, processing fixup entries may follow symbolic links bsc1192427.patch - Fix CVE-2022-36227, Handle a calloc returning NULL (CVE-2022-36227, bsc#1205629) * CVE-2022-36227.patch - Fix CVE-2024-20696, heap based out-of-bounds write (CVE-2024-20696, bsc#1225971) * CVE-2024-20696.patch - update to 2.1.1 * no changes on the GNU/Linux platform - includes changes from 2.1.0: * Support for the nPth library. * Add assuan_check_version and two version macros. * Interface changes relative to the 2.0.3 release: ASSUAN_SYSTEM_NPTH_IMPL NEW macro. ASSUAN_SYSTEM_NPTH NEW macro. __assuan_read NEW (private). __assuan_write NEW (private). __assuan_recvmsg NEW (private). __assuan_sendmsg NEW (private). __assuan_waitpid NEW (private). ASSUAN_VERSION NEW macro. ASSUAN_VERSION_NUMBER NEW macro. assuan_check_version NEW. - add tarball signature and keyring - run unit tests during build - libgpg-error requirement is >= 1.8 - update to 2.1.2: * Added support for ppc64le. - update to 2.1.3: + Performance fix for a platform other than GNU/Linux - libassuan 2.2.0: * Added support for socket redirection. * Interface changes relative to the 2.1.3 release: assuan_sock_set_sockaddr_un NEW. - fix SLE 11 SP2 build (make install) - libassuan 2.2.1: * Documentation updates. * Fixes for platforms other than GNU/Linux - libassuan 2.3.0: * Now wipes out the memory of the context structure before freeing. The context may have stored sensitive data in its line buffers. * Fixed a problem with the data length limit in assuan_inquire. * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a context. * Two new functions to tweak the behaviour of the socket wrappers. * By default build without a build timestamp. * Interface changes relative to the 2.2.1 release: assuan_sock_set_flag NEW. assuan_sock_get_flag NEW. - libassuan 2.4.0: * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag. * New function assuan_sock_connect_byname. * Require at least libgpg-error 1.17. * Interface changes relative to the 2.3.0 release: assuan_sock_connect_byname NEW. ASSUAN_SOCK_TOR NEW. ASSUAN_SOCK_SOCKS NEW. assuan_sock_set_flag EXTENDED. assuan_sock_get_flag EXTENDED. - libassuan 2.4.1: * In Tor mode fallback to port 9150 if 9050 is not listening. - libassuan 2.4.2: * The nPth version of the connect system hook does now wrap the call with npth_unprotec/npth_protect to avoid blocking during a connect. * Add feature to assuan_sock_connect_byname to test for SOCKS5 availability. - libassuan 2.4.3: * Allow socket redirection with assuan_socket_connect. * Speedup spawning programs on Linux * Fix minor memory leaks - qemu-disable-fdpassing-test.patch: disable fdpassing test when running under qemu-linux-user - libassuan 2.4.4: * New configure option --disable-doc * Fix the use of nanosleep * Portability fix for systems not defining INADDR_LOOPBACK - libassuan 2.4.5: * fixes for platforms other than GNU/Linux - libassuan 2.5.1: * New function to change the system hooks for the socket interface (assuan_sock_set_system_hooks) - Use %license (boo#1082318) -Update to 2.5.2: * configure.ac: Bump LT version to C8/A8/R2 * include libassuan.pc in the spec file - qemu-disable-fdpassing-test.patch: remove - Update to 2.5.3: * Add a timeout for writing to a SOCKS5 proxy. * Add workaround for a problem with LD_LIBRARY_PATH on newer systems. - update to 2.5.4: * Fix some minor build annoyances - update to 2.5.5: * Fix a crash in the logging code * Upgrade autoconf - update to 2.1.3: + Performance fix for a platform other than GNU/Linux - libassuan 2.2.0: * Added support for socket redirection. * Interface changes relative to the 2.1.3 release: assuan_sock_set_sockaddr_un NEW. - fix SLE 11 SP2 build (make install) - libassuan 2.2.1: * Documentation updates. * Fixes for platforms other than GNU/Linux - libassuan 2.3.0: * Now wipes out the memory of the context structure before freeing. The context may have stored sensitive data in its line buffers. * Fixed a problem with the data length limit in assuan_inquire. * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a context. * Two new functions to tweak the behaviour of the socket wrappers. * By default build without a build timestamp. * Interface changes relative to the 2.2.1 release: assuan_sock_set_flag NEW. assuan_sock_get_flag NEW. - libassuan 2.4.0: * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag. * New function assuan_sock_connect_byname. * Require at least libgpg-error 1.17. * Interface changes relative to the 2.3.0 release: assuan_sock_connect_byname NEW. ASSUAN_SOCK_TOR NEW. ASSUAN_SOCK_SOCKS NEW. assuan_sock_set_flag EXTENDED. assuan_sock_get_flag EXTENDED. - libassuan 2.4.1: * In Tor mode fallback to port 9150 if 9050 is not listening. - libassuan 2.4.2: * The nPth version of the connect system hook does now wrap the call with npth_unprotec/npth_protect to avoid blocking during a connect. * Add feature to assuan_sock_connect_byname to test for SOCKS5 availability. - libassuan 2.4.3: * Allow socket redirection with assuan_socket_connect. * Speedup spawning programs on Linux * Fix minor memory leaks - qemu-disable-fdpassing-test.patch: disable fdpassing test when running under qemu-linux-user - libassuan 2.4.4: * New configure option --disable-doc * Fix the use of nanosleep * Portability fix for systems not defining INADDR_LOOPBACK - libassuan 2.4.5: * fixes for platforms other than GNU/Linux - libassuan 2.5.1: * New function to change the system hooks for the socket interface (assuan_sock_set_system_hooks) - Use %license (boo#1082318) -Update to 2.5.2: * configure.ac: Bump LT version to C8/A8/R2 * include libassuan.pc in the spec file - qemu-disable-fdpassing-test.patch: remove - Update to 2.5.3: * Add a timeout for writing to a SOCKS5 proxy. * Add workaround for a problem with LD_LIBRARY_PATH on newer systems. - update to 2.5.4: * Fix some minor build annoyances - update to 2.5.5: * Fix a crash in the logging code * Upgrade autoconf - update to 2.1.3: + Performance fix for a platform other than GNU/Linux - libassuan 2.2.0: * Added support for socket redirection. * Interface changes relative to the 2.1.3 release: assuan_sock_set_sockaddr_un NEW. - fix SLE 11 SP2 build (make install) - libassuan 2.2.1: * Documentation updates. * Fixes for platforms other than GNU/Linux - libassuan 2.3.0: * Now wipes out the memory of the context structure before freeing. The context may have stored sensitive data in its line buffers. * Fixed a problem with the data length limit in assuan_inquire. * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a context. * Two new functions to tweak the behaviour of the socket wrappers. * By default build without a build timestamp. * Interface changes relative to the 2.2.1 release: assuan_sock_set_flag NEW. assuan_sock_get_flag NEW. - libassuan 2.4.0: * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag. * New function assuan_sock_connect_byname. * Require at least libgpg-error 1.17. * Interface changes relative to the 2.3.0 release: assuan_sock_connect_byname NEW. ASSUAN_SOCK_TOR NEW. ASSUAN_SOCK_SOCKS NEW. assuan_sock_set_flag EXTENDED. assuan_sock_get_flag EXTENDED. - libassuan 2.4.1: * In Tor mode fallback to port 9150 if 9050 is not listening. - libassuan 2.4.2: * The nPth version of the connect system hook does now wrap the call with npth_unprotec/npth_protect to avoid blocking during a connect. * Add feature to assuan_sock_connect_byname to test for SOCKS5 availability. - libassuan 2.4.3: * Allow socket redirection with assuan_socket_connect. * Speedup spawning programs on Linux * Fix minor memory leaks - qemu-disable-fdpassing-test.patch: disable fdpassing test when running under qemu-linux-user - libassuan 2.4.4: * New configure option --disable-doc * Fix the use of nanosleep * Portability fix for systems not defining INADDR_LOOPBACK - libassuan 2.4.5: * fixes for platforms other than GNU/Linux - libassuan 2.5.1: * New function to change the system hooks for the socket interface (assuan_sock_set_system_hooks) - Use %license (boo#1082318) -Update to 2.5.2: * configure.ac: Bump LT version to C8/A8/R2 * include libassuan.pc in the spec file - qemu-disable-fdpassing-test.patch: remove - Update to 2.5.3: * Add a timeout for writing to a SOCKS5 proxy. * Add workaround for a problem with LD_LIBRARY_PATH on newer systems. - update to 2.5.4: * Fix some minor build annoyances - update to 2.5.5: * Fix a crash in the logging code * Upgrade autoconf - update to 2.1.3: + Performance fix for a platform other than GNU/Linux - libassuan 2.2.0: * Added support for socket redirection. * Interface changes relative to the 2.1.3 release: assuan_sock_set_sockaddr_un NEW. - fix SLE 11 SP2 build (make install) - libassuan 2.2.1: * Documentation updates. * Fixes for platforms other than GNU/Linux - libassuan 2.3.0: * Now wipes out the memory of the context structure before freeing. The context may have stored sensitive data in its line buffers. * Fixed a problem with the data length limit in assuan_inquire. * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a context. * Two new functions to tweak the behaviour of the socket wrappers. * By default build without a build timestamp. * Interface changes relative to the 2.2.1 release: assuan_sock_set_flag NEW. assuan_sock_get_flag NEW. - libassuan 2.4.0: * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag. * New function assuan_sock_connect_byname. * Require at least libgpg-error 1.17. * Interface changes relative to the 2.3.0 release: assuan_sock_connect_byname NEW. ASSUAN_SOCK_TOR NEW. ASSUAN_SOCK_SOCKS NEW. assuan_sock_set_flag EXTENDED. assuan_sock_get_flag EXTENDED. - libassuan 2.4.1: * In Tor mode fallback to port 9150 if 9050 is not listening. - libassuan 2.4.2: * The nPth version of the connect system hook does now wrap the call with npth_unprotec/npth_protect to avoid blocking during a connect. * Add feature to assuan_sock_connect_byname to test for SOCKS5 availability. - libassuan 2.4.3: * Allow socket redirection with assuan_socket_connect. * Speedup spawning programs on Linux * Fix minor memory leaks - qemu-disable-fdpassing-test.patch: disable fdpassing test when running under qemu-linux-user - libassuan 2.4.4: * New configure option --disable-doc * Fix the use of nanosleep * Portability fix for systems not defining INADDR_LOOPBACK - libassuan 2.4.5: * fixes for platforms other than GNU/Linux - libassuan 2.5.1: * New function to change the system hooks for the socket interface (assuan_sock_set_system_hooks) - Use %license (boo#1082318) -Update to 2.5.2: * configure.ac: Bump LT version to C8/A8/R2 * include libassuan.pc in the spec file - qemu-disable-fdpassing-test.patch: remove - Update to 2.5.3: * Add a timeout for writing to a SOCKS5 proxy. * Add workaround for a problem with LD_LIBRARY_PATH on newer systems. - update to 2.5.4: * Fix some minor build annoyances - update to 2.5.5: * Fix a crash in the logging code * Upgrade autoconf - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Do not depend on insserv nor fillup; the package provides neither sysconfig nor sysvinit files - Version update to 2.5 release - Refresh two patches and README to contain SUSE and not SuSE * audit-allow-manual-stop.patch * audit-plugins-path.patch - Cleanup with spec-cleaner and do not use subshells but rather use - C parameter of make - Install m4 file to the devel package - Create folder for the m4 file from previous commit to avoid install failure - Update to version 2.7.7 release Changelog: https://people.redhat.com/sgrubb/audit/ChangeLog - Rectify RPM groups, diversify descriptions. - Remove mentions of static libraries because they are not built. - Update to version 2.8.1 release (includes 2.8 and 2.7.8 changes) * many features added to auparse_normalize * cli option added to auditd and audispd for setting config dir * in auditd, restore the umask after creating a log file * option added to auditd for skipping email verification - Full changelog: http://people.redhat.com/sgrubb/audit/ChangeLog - Add patch to fix test run without python2 interpreter: * audit-python3.patch - Update to 2.8.2 release: * Update tables for 4.14 kernel * Fixup ipv6 server side binding * AVC report from aureport was missing result column header (#1511606) * Add SOFTWARE_UPDATE event * In ausearch/report pickup any path and new-disk fields as a file * Fix value returned by auditctl --reset-lost (Richard Guy Briggs) * In auparse, fix expr_create_timestamp_comparison_ex to be numeric field * Fix building on old systems without linux/fanotify.h * Fix shell portability issues reported by shellcheck * Auditd validate_email should not use gethostbyname - Update header in audit-python3.patch - Update patch guidelines in README-BEFORE-ADDING-PATCHES - Update to version 2.8.3: * Correct msg function name in lru debug code. * Fix a segfault in auditd when dns resolution isn't available. * Make a reload legacy service for auditd. * In auparse python bindings, expose some new types that were missing. * In normalizer, pickup subject kind for user_login events. * Fix interpretation of unknown ioctcmds (rh#1540507). * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, & RESP_ORIGIN_BLOCK_TIMED events. * In auparse_normalize for USER_LOGIN events, map acct for subj_kind. * Fix logging of IPv6 addresses in DAEMON_ACCEPT events (rh#1534748). * Do not rotate auditd logs when num_logs < 2 (brozs). - Update to version 2.8.4: * Generate checkpoint file even when not results are returned (Burn Alting). * Fix log file creation when file logging is disabled entirely (Vlad Glagolev). * Use SIGCONT to dump auditd internal state (rh#1504251). * Fix parsing of virtual timestamp fields in ausearch_expression (rh#1515903). * Fix parsing of uid & success for ausearch. * Hide lru symbols in auparse. * Fix aureport summary time range reporting. * Allow unlimited retries on startup for remote logging. * Add queue_depth to remote logging stats and increase default queue_depth size. - Make use of some %make_install. - Update to version 2.8.5: * Fix segfault on shutdown * Fix hang on startup (#1587995) * Add sleep to script to dump state so file is ready when needed * Add auparse_normalizer support for SOFTWARE_UPDATE event * Mark netlabel events as simple events so that get processed quicker * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) * Add 30-ospp-v42.rules to meet new Common Criteria requirements * Update lookup tables for the 4.18 kernel * In aureport, fix segfault in file report * Add auparse_normalizer support for labeled networking events * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) * Event aging is off by a second * In ausearch/auparse, correct event ordering to process oldest first * auparse_reset was not clearing everything it should * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events * In ausearch/report, lightly parse selinux portion of USER_AVC events * In ausearch/report, limit record size when malformed * In auditd, fix extract_type function for network originating events * In auditd, calculate right size and location for network originating events * Treat all network originating events as VER2 so dispatcher doesn't format it * In audisp-remote do an initial connection attempt (#1625156) * In auditd, allow expression of space left as a percentage (#1650670) * On PPC64LE systems, only allow 64 bit rules (#1462178) * Make some parts of auditd state report optional based on config * Fix ausearch when checkpointing a single file (Burn Alting) * Fix scripting in 31-privileged.rules wrt filecap (#1662516) * In ausearch, do not checkpt if stdin is input source * In libev, remove __cold__ attribute for functions to allow proper hardening * Add tests to configure.ac for openldap support * Make systemd support files use /run rather than /var/run (Christian Hesse) * Fix minor memory leak in auditd kerberos credentials code * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test * In ausearch/report fix --end to use midnight time instead of now (#1671338) - Remote zos building is now a configurable option. It should be disabled in audit (and left enabled in audit-secondary). - Fix specfile to require libauparse0 and libaudit1 after splitting audit-libs (bsc#1172295) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Remove audit-fno-common.patch: fixed in upstream - Remove audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Modernize specfile constructs. - Enable livepatching on main library on x86_64. - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Use sover variables all over the spec file - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Build python bindings subpackages for all flavors * use the python-rpm-macros singlespec system: The macro %python_subpackages together with %python_subpackage_only creates the pythonXY-avahi bindings package for all python flavors on Tumbleweed (currently python36, python38) * Put the avahi-bookmarks command under updates-alternatives control to avoid package conflicts between flavors * outside of build_core, the build continues to use but not install everything in the primary python3 flavor. * For distros without multiple python3 flavors and/or older python-rpm-macros, the status quo is unchanged. - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Drop configure --libexecdir variable as it does not appear to be used by the source archive. - Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. - Rebase avahi-daemon-check-dns-suse.patch, and drop privileges when invoking avahi-daemon-check-dns.sh (boo#1180827 CVE-2021-26720). - Add sudo to requires: used to drop privileges. - Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling HUP event in client_work (boo#1184521 CVE-2021-3468). https://github.com/lathiat/avahi/pull/330 - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Fix libavahi-devel requirements. The devel package installs libavahi-libevent.so but didn't require the library it's pointing to. - Add avahi-CVE-2021-3502.patch: fix NULL pointer crashes (boo#1184846 CVE-2021-3502). - Obsolete the same version of mDNSResponder-lib and mDNSResponder in baselib.conf and spec. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Add rpmlintrc: Filter shlib-policy-name-error for libdns_sd (boo#1191750). - Change %python38_version_nodots to %suse_version which is compatible with Leap and SLE. See also: https://github.com/openSUSE/python-rpm-macros/issues/107 - Move sftp-ssh and ssh services to the doc directory. They allow a host's up/down status to be easily discovered and should not be enabled by default (boo#1179060). - Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561). This can probably go away if/when gh#lathiat/avahi#118 is fixed. - Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should no longer need this given the above patch. - Add several patches from git: 0001-man-fix-reference-to-avahi-autoipd.action-8-in-avahi.patch 0005-avahi-dnsconfd.service-Drop-Also-avahi-daemon.socket.patch 0006-man-add-missing-bshell.1-symlink.patch 0007-Ship-avahi-discover-1-bssh-1-and-bvnc-1-also-for-GTK.patch 0009-fix-bytestring-decoding-for-proper-display.patch 0010-avahi_dns_packet_consume_uint32-fix-potential-undefi.patch - Build manpages with xmltoman. Currently needed for bssh. - Minor spec file clean-up. - Require python-rpm-macros for all builds (boo#1194744 boo#1194745). - Change to systemd-sysusers - Replace avahi-0.6.31-systemd-order.patch with avahi-add-resolv-conf-to-inotify.patch: re-read configuration when resolv.conf changes, per discussion on the bug (boo#1194561). - remove avahi-mono* subspecfiles, they are no longer required by anything. this makes the spec file slightly more readable. - switch to use _multibuild - delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete - use https urls - Add avahi-CVE-2023-1981.patch: emit error if requested service is not found (boo#1210328 CVE-2023-1981). - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). - Add avahi-CVE-2023-38470.patch: Ensure each label is at least one byte long (bsc#1215947, CVE-2023-38470). - Add avahi-CVE-2023-38472.patch: Fix reachable assertion in avahi_rdata_parse (bsc#1216853, CVE-2023-38472). - Add avahi-CVE-2023-38471.patch: Extract host name using avahi_unescape_label (bsc#1216594, CVE-2023-38471). - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource records (bsc#1216598, CVE-2023-38469). - Add avahi-filter-bogus-services.patch: no longer supply bogus services to callbacks (bsc#1226586). - Add avahi-CVE-2024-52616.patch: Backporting 1dade81c from upstream: Properly randomize query id of DNS packets. (CVE-2024-52616, bsc#1233420) - prerequire avahi in avahi-autipd as we user "user avahi" - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - Initial package, version 2.14: * Features: - Added function to get DM device subsystem. - Support for the NTFS file system. - pkg-config definitions improvements. * Fixes: - Fix BSSize memory leaks. - Fixes for issues discovered by coverity. - Support for the 'Legacy boot' GPT flag. - Remove excess Provides, BuildRequires and %ifs. - Fix %description line mismatch for s390x parts. - Update to version 2.16: * Features: - LUKS 2 support for luks_open/close and luks_add/remove/change_key. - Progress report support for ext filesystem checks. - Changes from version 2.15: * Features: - The file system plugin is now split into multiple source files making it easier to add support for more file systems and technologies. * Fixes: - How GPT patition flags are set; - Check the btrfs module availability as part of checking the btrfs plugin's dependencies; - Memory leaks in bd_fs_vfat_get_info(); - The file system plugin's dependency checking mechanisms. - Add libblockdev-fix-libkmod-include.patch as openSUSE doesn't use /usr/include/ but /usr/include/kmod to place libkmod.h. - Conditionalize the use of Python 2's bindings and turn it off defaulting Python 3. - Drop s390's plugin due to the lack of a file still not present in s390-tools package. - Drop BuildRoot tag since RPM already handles this itself. - Move all plugins into the shared library subpackage and their respective development files into the devel one. - Add '-only' to LGPL License tag to comply with SPDX 3.0. - Resplit plugins to avoid pulling clusterlvm support by default into the dependency chain (bsc#1086447). - Update to version 2.17: + New plugin: nvdimm, support for NVDIMM namespaces management; + LUKS2 support for creating LUKS2 format including authenticated disk encryption. Multiple new functions for working with LUKS devices (suspend/resume, header backup, metadata size...); + Extended support for opening TrueCrypt/VeraCrypt volumes. - Drop pkgconfig(nss) and libvolume_key-devel BuildRequires now that they are optional and pass without-escrow to configure: libvolume_key's code is ancient and nearly dead upstream. - Update to version 2.18: + New plugin: vdo, support for creating and managing VDO volumes. - Update to version 2.20: + Fixes: - Fix parsing extra arguments for LVM methods calls in the LVM DBus plugin; - Multiple fixes for running tests on Debian testing. + Development: Vagrantfile template was added for easy development machine setup. - Changes from version 2.19: + Features: - vdo: new functions to get statistical data for existing VDO volumes (bd_vdo_get_stats); - crypto: support for passing extra arguments for key derivation function when creating LUKS2 format. - Add pkgconfig(dbus-1) BuildRequires: Add missing BuildRequires, libblockdev needs dbus headerfiles during build, but configure does not check for it. - Add pkgconfig(yaml-0.1) BuildRequires and pass with-vdo instead of without-vdo to configure, build vdo support. - Following the above, add new sub-packages libbd_vdo2 and libbd_vdo-devel, aswell as handle the new library in post(un). - Explain VDO. Fix grammar mishaps. - Update to version 2.22: + New minor release of the libblockdev library with multiple fixes. + nvdimm: New function for getting list of supported sector sizes for namespaces fixes. + Multiple memory leaks fixed. - Changes from version 2.21: + crypto: Default key size for LUKS was changed to 512bit. + tools: - New simple cli tools that use libblockdev. - First tool is lvm-cache-stats for displaying stats for LVM cache devices. - Use configure option --without-tools to disable building these. - Package new cli tool in main package, should possibly be moved into own sub-package in the future. - lvm2-clvm doesn't exist in lvm2-2.03, so change SPEC file libbd_lvm-dbus requires from lvm2-clvm to lvm2 - fix files directive for s390 in specfile - udpate to 2.24: * VDO plugin has been deprecated in this release (functionality replaced by LVM VDO) * support for creating and managing LVM VDO volumes added * support for unlocking of BitLocker-compatible format BITLK added * new functions for (un)freezing filesystems added * test suite can now be run against installed version of libblockdev - update to 2.25: * exec: Fix polling for stdout and stderr * exec: Use non-blocking read and process the buffer manually * exec: Clarify the BDUtilsProgExtract callback documentation * tests: Add bufferbloat exec tests * tests: Add null-byte exec tests * lvm: Fix bd_lvm_vdopooldata_* symbols * exec: Fix setting locale for util calls * fs: Do not report error when errors were fixed by e2fsck * README: Use CI status image for 2.x-branch on 2.x * fs: Fix compile error in ext_repair caused by cherry pick from master * Mark all GIR file constants as guint64 * lvm: Set thin metadata limits to match limits LVM uses in lvcreate * lvm: Do not use thin_metadata_size to recommend thin metadata size * lvm: Use the UNUSED macro instead of __attribute__((unused)) * Fix max size limit for LVM thinpool metadata * loop: Retry LOOP_SET_STATUS64 on EAGAIN - Add -Wno-deprecated-declarations to cflags: dealing with deprecations is upstreams business and should not hinder downstream packages from building. - Update to version 2.26: + Fixes: - Deprecated glib function call; - Build with LLVM/clang; - Many memory leaks; - Many tests. - Fix dbus.h being wrongly packaged in libbd_lvm-dbus-devl instead of libbd_utils-devel (boo#1189787). - Fix lack of dependency on libblockdev-lvm needed by libblockdev package. The lvm-cache-stats binary needs the logical volume plugin to work (boo#1183948). - Remove unnecessary dependency of libbd_part2 on multipath-tools (bsc#1194771) - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - Porting Yifan Jiang <yfjiang@suse.com>'s solution of bsc#1220329 to SLE15-SP5 (bsc#1209153) - Add necessary Supplements (gnome-bluetooth, blueman, bluedevil5) to bluez-obexd, so that file transfer features of the applications can be used by default (bsc#1209153, bsc#1220329). - Update the description of bluez-obexd. - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - Porting Yifan Jiang <yfjiang@suse.com>'s solution of bsc#1220329 to SLE15-SP5 (bsc#1209153) - Add necessary Supplements (gnome-bluetooth, blueman, bluedevil5) to bluez-obexd, so that file transfer features of the applications can be used by default (bsc#1209153, bsc#1220329). - Update the description of bluez-obexd. - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - Porting Yifan Jiang <yfjiang@suse.com>'s solution of bsc#1220329 to SLE15-SP5 (bsc#1209153) - Add necessary Supplements (gnome-bluetooth, blueman, bluedevil5) to bluez-obexd, so that file transfer features of the applications can be used by default (bsc#1209153, bsc#1220329). - Update the description of bluez-obexd. - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - remove notification message from bluez-deprecated package. I'm not going to remove it, and another maintainer can still restart the removal process :-) also boo#1188660 - fix bluez-auto-enable-devices subpackage (boo#1177845) - add fedora's patches 0002-Use-g_memdup2-everywhere.patch and 0005-media-rename-local-function-conflicting-with-pause-2.patch to fix compatibility problems with newer glib and glibc - update to version 5.61 (JIRA-SLE-18497): * Fix issue with A2DP while waiting for command response. * Fix issue with A2DP when SetConfiguration fails. * Fix issue with device removal handling. * Fix issue with storing discoverable setting. * Add support for Central Address Resolution characteristic. * Add support for admin policy plugin. - update to version 5.62 (JIRA-SLE-18497): * Fix issue with handling truncation when loading LTKs. * Fix issue with accepting Exchange MTU on EATT bearer. * Fix issue with clearing DeviceLost timers on power down. * Fix issue with AVCTP browsing channel and missing ERTM. * Fix issue with AVDTP and local SEID pool for each adapter. * Add support for BR/EDR and LE connection failure reasons. - drop obsoleted patch 0005-media-rename-local-function-conflicting-with-pause-2.patch - Stop nuking the obex service, we support user systemd services just fine now. Following this, no longer hack the dbus service, leave it as a systemd service as upstream intended. - Split out obex in own package with it's needed enabledment as a systemd user service. - Add 0001-obex-Use-GLib-helper-function-to-manipulate-paths.patch: obex: Use GLib helper function to manipulate paths. Instead of trying to do it by hand. This also makes sure that relative paths aren't used by the agent. Patch from fedora. - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to version 5.63: * Fix issue with storing IRK causing invalid read access. * Fix issue with disconnecting due to GattCharacteristic1.MTU. * Add support for Device{Found,Lost} of advertising monitoring. - Add code to restore user modifications for modprobe.d %config files after moving the files to %_modprobedir - Use %_modprobedir (jsc#SLE-20639) - update to version 5.64: This is another release mostly with bug fixes on HOG, GATT, A2DP, Media, AVDTP, AVRCP, and scanning failure. This release includes a fix for building with old glibc (< 2.25) and other minor issues found with the static code analyzing tool. ISO packet support is added to the emulator as a part of LE Audio development. - removed obsoleted 0002-Use-g_memdup2-everywhere.patch - add Requires(post): systemd for bluez-auto-enable-devices * fixes boo#1198906 - Move the dbus-1 system.d file to /usr (bsc#1199207) - Fix self-obsoletion issues - Add supplements to cups subpackage - Split zsh completion into subpackage - Don't tell the user to write to /usr (in README-mesh.SUSE) - Upgrade bluez-test requirement of PyGObject from ancient version 2 to current version. (bluez/test is at least able to use it since 2014) - update to 5.65: * Fix issue with A2DP cache invalidation handling. * Fix issue with A2DP and not initialized SEP codec. * Fix issue with A2DP and multiple SetConfiguration to same SEP * Fix issue with AVRCP and not properly initialized volume. * Fix issue with SDP records when operating in LE only mode. * Fix issue with HoG and not reading report map of instances. * Fix issue with GATT server crashing while disconnecting. * Fix issue with not removing connected devices. * Fix issue with enabling wake support without RPA Resolution. * Fix issue with pairing failed due to the error of Already Paired. * Add support for CONFIGURATION_DIRECTORY environment variable. * Add support for STATE_DIRECTORY environment variable. * Add support for "Bonded" property with Device API. * Add experimental support for ISO socket. - drop bluez-test-2to3.diff (obsolete/upstream) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the patches and log: (jsc#PED-1407) - hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch patch be merged to 5.51 mainline. So 5.65 bluez already includes it. (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800) - Add the following patches from the bluez-5.62 of 15-SP5: - disable_some_obex_tests.patch - disable tests for bypass boo#1078285 - hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch - bsc#1013708 CVE-2016-9797 - Al Cho has sent it to upstream but it not be merged: https://lore.kernel.org/all/20181031081508.25927-1-acho@suse.com/T/ - hcidump-Fix-memory-leak-with-malformed-packet.patch - bsc#1015171 CVE-2016-9917 - Al Cho has sent it to upstream but it not be merged: https://www.spinics.net/lists/linux-bluetooth/msg79852.html - hcidump-Fixed-malformed-segment-frame-length.patch - bsc#1013712 CVE-2016-9798 - Did not send to upstream. - 0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch - Move 43xx firmware path for RPi3 bluetooth support bsc#1140688 bsc#995059 bsc#1094902 - From https://www.yoctoproject.org/pipermail/yocto/2016-April/029424.html - Respin the following patches - bluez-test-2to3.diff - Removed some parts of patch because those codes be included in a1939bd51e0faba9a8550eea2590d99cb63a33c1 since 5.65. - The following patches are the same between SLE15-SP5 with openSUSE TW: - bluez-5.45-disable-broken-tests.diff in 15-SP5 matchs with bluez-disable-broken-tests.diff in openSUSE TW. - 0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch in 15-SP5 matchs with RPi-Move-the-43xx-firmware-into-lib-firmware.patch in openSUSE TW. (bsc#995059)(bsc#1094902) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will use the bluez.spec from openSUSE TW. The following are changes in bluez.spec of SLE15-SP5: - Obsoletes: bluez-utils <= 3.36 to Obsoletes: bluez-utils < 3.36 - Obsoletes: bluez-audio <= 3.36 to Obsoletes: bluez-audio < 3.36 - In %package -n libbluetooth3: Obsoletes: bluez-libs <= 3.36 to Obsoletes: bluez-libs < 3.36 - In %package cups, add the following statements Requires: %{name} Requires: cups Supplements: (%{name} and cups) - In %package test Requires: python3-gobject2 to Requires: python3-gobject - In %package auto-enable-devices package, add Requires(post): systemd - Add %package obexd and %package zsh-completion and their %description - In %prep - Removed %setup -q - Removed [#] FIXME: Change the dbus service to be a real service, not systemd launched sed -i "s:Exec=/bin/false:Exec=%{_libexecdir}/bluetooth/obexd:g" obexd/src/org.bluez.obex.service sed -i "/SystemdService=.*/d" obexd/src/org.bluez.obex.service [#] END FIXME - In %build, add - -with-dbusconfdir=%{_datadir} \ - In %install - Removed [#] FIXME: Do not delete the systemd service once we support systemd user/session services rm %{buildroot}%{_userunitdir}/obex.service [#] end FIXME - org.bluez.mesh.service to %{_sysconfdir}/dbus-1/system-services/, to org.bluez.mesh.service to %{_datadir}/dbus-1/system-services/, - In %files - Add %{_bindir}/isotest %{_libexecdir}/bluetooth/obexd %{_mandir}/man1/isotest.1%{?ext_man} - %config %{_sysconfdir}/dbus-1/system.d/bluetooth.conf to %{_datadir}/dbus-1/system.d/bluetooth.conf - Removed %{_datadir}/dbus-1/services/org.bluez.obex.service - Removed %{_datadir}/zsh/site-functions/_bluetoothctl - Add %files zsh-completion - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Removed shared-gatt-server-Fix-heap-overflow-when-appending-.patch in SLE15-SP5 bluez because 5.65 bluez already includes it. - The code shall check if the prepare writes would append more the allowed maximum attribute length. (bsc#1194704 CVE-2022-0204) - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync the spec file and log: (jsc#PED-1407) - SLE15-SP5 will direct use bluez.changes for openSUSE TW. So keep the contents of SLE bluez.changes to bluez.changes.sle file. - Put to /usr/share/doc/packages/bluez/bluez.changes.sle in package. - For pushing bluez 5.65 to 15-SP5 (bluez-5.62), sync more change log: (jsc#PED-1407) - The hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch be merged to bluez-5.51 in 2018. (bsc#1013732)(CVE-2016-9801) - The following btmon patches are merged to bluez-5.51 and later: 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch 0004-btmon-Fix-crash-caused-by-integer-underflow.patch 0005-btmon-fix-stack-buffer-overflow.patch 0006-btmon-fix-multiple-segfaults.patch 0007-btmon-fix-segfault-caused-by-integer-underflow.patch 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch 0011-btmon-fix-segfault-caused-by-integer-underflow.patch 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch (bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802) - The shared-gatt-server-Fix-not-properly-checking-for-sec.patch be merged to bluez-5.57 in 2021. (bsc#1186463 CVE-2021-0129 CVE-2020-26558) - The gatt-Fix-potential-buffer-out-of-bound.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - The gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch be merged to bluez-5.56 in 2021. (bsc#1187165 CVE-2021-3588) - Add JIRA-SLE-18497 number to 5.60, 5.61 and 5.62 update log to sync with bluez.changes in SLE15-SP5. - Install modprobe.conf files to %_modprobedir This change already in bluez.sepc in openSUSE:Factory/bluez. Sync the change log here. (bsc#1196275, jsc#SLE-20639) - Add avrcp-Fix-crash-while-handling-unsupported-events.patch avrcp: Fix crash while handling unsupported events (bsc#1210398)(CVE-2023-27349) - Add pbap-Fix-not-checking-Primary-Secundary-Counter-leng.patch pbap: Fix not checking Primary/Secundary Counter length (bsc#1218301)(CVE-2023-50230)(bsc#1218300)(CVE-2023-50229) - Initial release - Reflect SUSE CFLAGS - Do not bother with obscpio if we are fetching direct releases - Remove patch 0001-makefile-Fix-install-target.patch seems to build/install without it just fine - Update to 0.0.6: + New features - new extensible bpf_object__open_{file,mem} APIs and DECLARE_LIBBPF_OPTS() macro to go with them - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now distributed with libbpf - BPF CO-RE: added field size, field existence, and bitfield relocation support - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(), bpf_core_field_size() and other BPF CO-RE related helpers available through bpf_core_read.h header - bpf_object__open() API now auto-detects program type from its section name - BPF_PROG_TRACING programs support (incuding BTF-typed raw tracepoints, fentry/fexit programs) - mmap() support for BPF global variables - declarative map pinning support added - probe_read_{user,kernel}[_str]() BPF helpers added - bpf_get_link_xdp_info() function to get more XDP information added - a bunch of other AF_XDP changes + Usability improvements - no need for int version SEC('version') = 1; anymore - raw_tp/tp and uprobe/uretprobe section prefixes added - new bpf_program__get_{type,expected_attach_type} getters - preserve error code on program load failure + Fixes - btf_dump padding handling - bpf_object__name() returning name, not path - ELF section handling off-by-one bug fix - mem leak/double free fix in BPF program relocation code - Build libbpf from kernel sources, not from github sources, for consistency with bpftool package. - Add python3 as a build dependency. - libbpf is now a separate project, stop building from the kernel (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805). - Fix LIBSUBDIR + libdir.patch - Create libbpf0-32bit needed by libdwarves1-32bit - Depend on new enough Linux headers. - Fix LTO build (bsc#1188749). + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to 0.5.0: + New features and user-space APIs: - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details. - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in); - "Light" BPF skeleton support; - BPF_PROG_TYPE_SYSCALL support; - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs; - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs; - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API; - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations; - sk_reuseport/migrate program type support; - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description; - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them; - btf__load_vmlinux_btf() and btf__load_module_btf() APIs; - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps; - bpf_map_lookup_and_delete_elem_flags() API. + BPF-side APIs and features: - support for weak typed __ksym externs; - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel(); - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side; - bpf_get_func_ip() helper; - bpf_sys_bpf() helper; - bpf_task_pt_regs() helper; - bpf_btf_find_by_name_kind() helper; - usability improvements for bpf_tracing.h when target architecture is missing. + Bug fixes and compatibility improvements: - improve BPF support detection on old Red Hat kernels with backported BPF patches; - improvements for LTO builds with GCC 10+; - pass NLM_F_EXCL when creating TC qdisc; - better support of BPF map reuse on old kernels; - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself. - Remove patches merged upstream + libdir.patch + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to release 0.6.1 * Introduce legacy kprobe events support * Add legacy uprobe attaching support * Support uniform BTF-defined key/value specification across all BPF maps * Support kernel module function calls * Support detecting and attaching of writable tracepoint program * Add bloom filter map implementation * Add typeless and weak ksym support to gen_loader * Add RISC-V (RV64) support to bpf_tracing.h * Deprecate AF_XDP support * Support BTF_KIND_TYPE_TAG - Update to release 0.7.0 * legacy BPF map definitions (using struct bpf_map_def) are deprecated when LIBBPF_STRICT_MAP_DEFINITIONS is passed to libbpf_set_strict_mode(). Please use BTF-defined map definitions. * ability to control and capture BPF verifier log output on per-object and per-program level * CO-RE support and other improvements for "light skeleton" * improved compilation when system BTF UAPI headers are outdated - Python is not used during build; remove it and help break a cycle. - Enable building and packaging of static library. Explicitly enable fat LTO objects. - Update to release 0.8.0 * New features and APIs: - support auto-resolution of binaries and shared libraries from PATH, if necessary; - support attaching by function names (only by IP was supported before); - support attaching to USDTs (SEC("usdt/...") and bpf_program__attach_usdt()) with initially supported architectures: x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv); - improved BPF verifier log reporting for CO-RE relocation failures (no more obscure "invalid func unknown#195896080" errors); - auto-adjust BPF ringbuf size according to host kernel's page size requirements; - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(), etc that validate key/value buffer sizes; - bpf_link_create() can create all bpf_link-based (including raw_tp, fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old kernels transparently; - support opting out from auto-loading BPF programs declaratively with SEC("?..."); - support opting out from auto-creation of declarative BPF maps with bpf_map__set_autocreate(); - support multi-kprobes (SEC("kprobe.multi/...") and bpf_program__attach_kprobe_multi_opts()); - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc); - support BPF sub-skeletons for "incomplete" BPF object files (requires matching bpftool to generate .subskel.h); - BPF cookie support for fentry/fexit/fmod_ret BPF programs (bpf_program__attach_trace_opts()); - support for custom SEC() handlers (libbpf_register_prog_handler()). * BPF-side API - BPF-side USDT APIs. See new usdt.bpf.h header: * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(), * bpf_usdt_cookie() helpers; - new bpf_core_field_offset() CO-RE helper and support bpf_core_field_size(type, field) forms; - barrier() and barrier_var() macros for improving BPF code generation; - __kptr and __kptr_ref tags added; - ARC architecture support in bpf_tracing.h header; - new BPF helpers: * bpf_skb_set_tstamp(); * bpf_ima_file_hash(); * bpf_kptr_xchg(); * bpf_map_lookup_percpu_elem(). * Bug fixes - netlink bug fixes; - libbpf.pc fixes to support patch releases properly; - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix; - minor CO-RE fixes and improvements for some corner cases; - various other small fixes and improvements. - Update to release 0.8.1: * make shared xsk creation network namespace aware - update to 1.0.1: * fix inadvertently changed struct bpf_object_open_opts memory layout; * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers; * fix NULL pointer exception in API btf_dump__dump_type_data; * remove struct btf_map_def accidentally left in bpf_helpers.h header. * All deprecated APIs and features removed! * support for syscall-specific kprobe/kretprobe (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>")); * support for sleepable uprobe BPF programs (SEC("uprobe.s")); * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup")); * support for new BPF CO-RE relocation TYPE_MATCHES; * bpf_prog_load() and bpf_map_create() are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names); * BTF_KIND_ENUM64 support; * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted; * new APIs for converting BPF enums to their string representation: * libbpf_bpf_prog_type_str(); * libbpf_bpf_map_type_str(); * libbpf_bpf_link_type_str(); * libbpf_bpf_attach_type_str(); * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting out from auto-attaching of BPF program by BPF skeleton; * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf; * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information. - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941) + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534) + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533) + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606) + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch - update to v1.1.0: User space-side features and APIs: * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support; * new documentation page listing all recognized SEC() definitions; * BTF dedup improvements: * unambiguous fwd declaration resolution for structs and unions; * better handling of some corner cases with identical structs and arrays; * mixed enum and enum64 forward declaration resolution logic; * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts() APIs; * libbpf supports loading raw BTF for BPF CO-RE from known search paths; * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE); * libbpf will only add BPF_F_MMAPABLE flag for data maps with global (i.e., non-static) vars; * latest Linux UAPI headers with lots of changes synced into include/uapi/linux. BPF-side features and APIs; * BPF_PROG2() macro added that supports struct-by-value arguments; * new BPF helpers: * bpf_user_ringbuf_drain(); * cgrp_storage_get() and cgrp_storage_delete(). Bug fixes * better handling of padding corner cases; * btf__align_of() determines packed structs better now; * improved handling of enums of non-standard sizes; * USDT spec parsing improvements; * overflow handling fixes for ringbufs; * Makefile fixes to support cross-compilation for 32-bit targets; * fix crash if SEC("freplace") programs don't have attach_prog_fd set; * better handling of file existence checks when running as non-root with enhanced capabilities; * a bunch of small fixes: * ELF handling improvements; * fix memory leak in USDT argument parsing logic; * fix NULL dereferences in few corner cases; * improved netlink attribute iteration handling. - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch, libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch, libbpf-Fix-memory-leak-in-parse_usdt_arg.patch libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream) - Remove requirement of linux-glibc-devel >= 5.16 for devel package - Fix null pointer dereference in bpf_object__collect_prog_relos() (bsc#1221101) * Add libbpf-Fix-NULL-pointer-dereference-in-bpf_object__c.patch - Initial release - Reflect SUSE CFLAGS - Do not bother with obscpio if we are fetching direct releases - Remove patch 0001-makefile-Fix-install-target.patch seems to build/install without it just fine - Update to 0.0.6: + New features - new extensible bpf_object__open_{file,mem} APIs and DECLARE_LIBBPF_OPTS() macro to go with them - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now distributed with libbpf - BPF CO-RE: added field size, field existence, and bitfield relocation support - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(), bpf_core_field_size() and other BPF CO-RE related helpers available through bpf_core_read.h header - bpf_object__open() API now auto-detects program type from its section name - BPF_PROG_TRACING programs support (incuding BTF-typed raw tracepoints, fentry/fexit programs) - mmap() support for BPF global variables - declarative map pinning support added - probe_read_{user,kernel}[_str]() BPF helpers added - bpf_get_link_xdp_info() function to get more XDP information added - a bunch of other AF_XDP changes + Usability improvements - no need for int version SEC('version') = 1; anymore - raw_tp/tp and uprobe/uretprobe section prefixes added - new bpf_program__get_{type,expected_attach_type} getters - preserve error code on program load failure + Fixes - btf_dump padding handling - bpf_object__name() returning name, not path - ELF section handling off-by-one bug fix - mem leak/double free fix in BPF program relocation code - Build libbpf from kernel sources, not from github sources, for consistency with bpftool package. - Add python3 as a build dependency. - libbpf is now a separate project, stop building from the kernel (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805). - Fix LIBSUBDIR + libdir.patch - Create libbpf0-32bit needed by libdwarves1-32bit - Depend on new enough Linux headers. - Fix LTO build (bsc#1188749). + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to 0.5.0: + New features and user-space APIs: - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details. - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in); - "Light" BPF skeleton support; - BPF_PROG_TYPE_SYSCALL support; - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs; - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs; - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API; - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations; - sk_reuseport/migrate program type support; - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description; - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them; - btf__load_vmlinux_btf() and btf__load_module_btf() APIs; - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps; - bpf_map_lookup_and_delete_elem_flags() API. + BPF-side APIs and features: - support for weak typed __ksym externs; - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel(); - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side; - bpf_get_func_ip() helper; - bpf_sys_bpf() helper; - bpf_task_pt_regs() helper; - bpf_btf_find_by_name_kind() helper; - usability improvements for bpf_tracing.h when target architecture is missing. + Bug fixes and compatibility improvements: - improve BPF support detection on old Red Hat kernels with backported BPF patches; - improvements for LTO builds with GCC 10+; - pass NLM_F_EXCL when creating TC qdisc; - better support of BPF map reuse on old kernels; - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself. - Remove patches merged upstream + libdir.patch + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to release 0.6.1 * Introduce legacy kprobe events support * Add legacy uprobe attaching support * Support uniform BTF-defined key/value specification across all BPF maps * Support kernel module function calls * Support detecting and attaching of writable tracepoint program * Add bloom filter map implementation * Add typeless and weak ksym support to gen_loader * Add RISC-V (RV64) support to bpf_tracing.h * Deprecate AF_XDP support * Support BTF_KIND_TYPE_TAG - Update to release 0.7.0 * legacy BPF map definitions (using struct bpf_map_def) are deprecated when LIBBPF_STRICT_MAP_DEFINITIONS is passed to libbpf_set_strict_mode(). Please use BTF-defined map definitions. * ability to control and capture BPF verifier log output on per-object and per-program level * CO-RE support and other improvements for "light skeleton" * improved compilation when system BTF UAPI headers are outdated - Python is not used during build; remove it and help break a cycle. - Enable building and packaging of static library. Explicitly enable fat LTO objects. - Update to release 0.8.0 * New features and APIs: - support auto-resolution of binaries and shared libraries from PATH, if necessary; - support attaching by function names (only by IP was supported before); - support attaching to USDTs (SEC("usdt/...") and bpf_program__attach_usdt()) with initially supported architectures: x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv); - improved BPF verifier log reporting for CO-RE relocation failures (no more obscure "invalid func unknown#195896080" errors); - auto-adjust BPF ringbuf size according to host kernel's page size requirements; - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(), etc that validate key/value buffer sizes; - bpf_link_create() can create all bpf_link-based (including raw_tp, fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old kernels transparently; - support opting out from auto-loading BPF programs declaratively with SEC("?..."); - support opting out from auto-creation of declarative BPF maps with bpf_map__set_autocreate(); - support multi-kprobes (SEC("kprobe.multi/...") and bpf_program__attach_kprobe_multi_opts()); - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc); - support BPF sub-skeletons for "incomplete" BPF object files (requires matching bpftool to generate .subskel.h); - BPF cookie support for fentry/fexit/fmod_ret BPF programs (bpf_program__attach_trace_opts()); - support for custom SEC() handlers (libbpf_register_prog_handler()). * BPF-side API - BPF-side USDT APIs. See new usdt.bpf.h header: * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(), * bpf_usdt_cookie() helpers; - new bpf_core_field_offset() CO-RE helper and support bpf_core_field_size(type, field) forms; - barrier() and barrier_var() macros for improving BPF code generation; - __kptr and __kptr_ref tags added; - ARC architecture support in bpf_tracing.h header; - new BPF helpers: * bpf_skb_set_tstamp(); * bpf_ima_file_hash(); * bpf_kptr_xchg(); * bpf_map_lookup_percpu_elem(). * Bug fixes - netlink bug fixes; - libbpf.pc fixes to support patch releases properly; - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix; - minor CO-RE fixes and improvements for some corner cases; - various other small fixes and improvements. - Update to release 0.8.1: * make shared xsk creation network namespace aware - update to 1.0.1: * fix inadvertently changed struct bpf_object_open_opts memory layout; * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers; * fix NULL pointer exception in API btf_dump__dump_type_data; * remove struct btf_map_def accidentally left in bpf_helpers.h header. * All deprecated APIs and features removed! * support for syscall-specific kprobe/kretprobe (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>")); * support for sleepable uprobe BPF programs (SEC("uprobe.s")); * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup")); * support for new BPF CO-RE relocation TYPE_MATCHES; * bpf_prog_load() and bpf_map_create() are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names); * BTF_KIND_ENUM64 support; * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted; * new APIs for converting BPF enums to their string representation: * libbpf_bpf_prog_type_str(); * libbpf_bpf_map_type_str(); * libbpf_bpf_link_type_str(); * libbpf_bpf_attach_type_str(); * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting out from auto-attaching of BPF program by BPF skeleton; * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf; * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information. - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941) + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534) + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533) + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606) + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch - update to v1.1.0: User space-side features and APIs: * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support; * new documentation page listing all recognized SEC() definitions; * BTF dedup improvements: * unambiguous fwd declaration resolution for structs and unions; * better handling of some corner cases with identical structs and arrays; * mixed enum and enum64 forward declaration resolution logic; * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts() APIs; * libbpf supports loading raw BTF for BPF CO-RE from known search paths; * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE); * libbpf will only add BPF_F_MMAPABLE flag for data maps with global (i.e., non-static) vars; * latest Linux UAPI headers with lots of changes synced into include/uapi/linux. BPF-side features and APIs; * BPF_PROG2() macro added that supports struct-by-value arguments; * new BPF helpers: * bpf_user_ringbuf_drain(); * cgrp_storage_get() and cgrp_storage_delete(). Bug fixes * better handling of padding corner cases; * btf__align_of() determines packed structs better now; * improved handling of enums of non-standard sizes; * USDT spec parsing improvements; * overflow handling fixes for ringbufs; * Makefile fixes to support cross-compilation for 32-bit targets; * fix crash if SEC("freplace") programs don't have attach_prog_fd set; * better handling of file existence checks when running as non-root with enhanced capabilities; * a bunch of small fixes: * ELF handling improvements; * fix memory leak in USDT argument parsing logic; * fix NULL dereferences in few corner cases; * improved netlink attribute iteration handling. - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch, libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch, libbpf-Fix-memory-leak-in-parse_usdt_arg.patch libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream) - Remove requirement of linux-glibc-devel >= 5.16 for devel package - Fix null pointer dereference in bpf_object__collect_prog_relos() (bsc#1221101) * Add libbpf-Fix-NULL-pointer-dereference-in-bpf_object__c.patch - Initial release - Reflect SUSE CFLAGS - Do not bother with obscpio if we are fetching direct releases - Remove patch 0001-makefile-Fix-install-target.patch seems to build/install without it just fine - Update to 0.0.6: + New features - new extensible bpf_object__open_{file,mem} APIs and DECLARE_LIBBPF_OPTS() macro to go with them - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now distributed with libbpf - BPF CO-RE: added field size, field existence, and bitfield relocation support - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(), bpf_core_field_size() and other BPF CO-RE related helpers available through bpf_core_read.h header - bpf_object__open() API now auto-detects program type from its section name - BPF_PROG_TRACING programs support (incuding BTF-typed raw tracepoints, fentry/fexit programs) - mmap() support for BPF global variables - declarative map pinning support added - probe_read_{user,kernel}[_str]() BPF helpers added - bpf_get_link_xdp_info() function to get more XDP information added - a bunch of other AF_XDP changes + Usability improvements - no need for int version SEC('version') = 1; anymore - raw_tp/tp and uprobe/uretprobe section prefixes added - new bpf_program__get_{type,expected_attach_type} getters - preserve error code on program load failure + Fixes - btf_dump padding handling - bpf_object__name() returning name, not path - ELF section handling off-by-one bug fix - mem leak/double free fix in BPF program relocation code - Build libbpf from kernel sources, not from github sources, for consistency with bpftool package. - Add python3 as a build dependency. - libbpf is now a separate project, stop building from the kernel (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805). - Fix LIBSUBDIR + libdir.patch - Create libbpf0-32bit needed by libdwarves1-32bit - Depend on new enough Linux headers. - Fix LTO build (bsc#1188749). + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to 0.5.0: + New features and user-space APIs: - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details. - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in); - "Light" BPF skeleton support; - BPF_PROG_TYPE_SYSCALL support; - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs; - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs; - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API; - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations; - sk_reuseport/migrate program type support; - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description; - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them; - btf__load_vmlinux_btf() and btf__load_module_btf() APIs; - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps; - bpf_map_lookup_and_delete_elem_flags() API. + BPF-side APIs and features: - support for weak typed __ksym externs; - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel(); - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side; - bpf_get_func_ip() helper; - bpf_sys_bpf() helper; - bpf_task_pt_regs() helper; - bpf_btf_find_by_name_kind() helper; - usability improvements for bpf_tracing.h when target architecture is missing. + Bug fixes and compatibility improvements: - improve BPF support detection on old Red Hat kernels with backported BPF patches; - improvements for LTO builds with GCC 10+; - pass NLM_F_EXCL when creating TC qdisc; - better support of BPF map reuse on old kernels; - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself. - Remove patches merged upstream + libdir.patch + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to release 0.6.1 * Introduce legacy kprobe events support * Add legacy uprobe attaching support * Support uniform BTF-defined key/value specification across all BPF maps * Support kernel module function calls * Support detecting and attaching of writable tracepoint program * Add bloom filter map implementation * Add typeless and weak ksym support to gen_loader * Add RISC-V (RV64) support to bpf_tracing.h * Deprecate AF_XDP support * Support BTF_KIND_TYPE_TAG - Update to release 0.7.0 * legacy BPF map definitions (using struct bpf_map_def) are deprecated when LIBBPF_STRICT_MAP_DEFINITIONS is passed to libbpf_set_strict_mode(). Please use BTF-defined map definitions. * ability to control and capture BPF verifier log output on per-object and per-program level * CO-RE support and other improvements for "light skeleton" * improved compilation when system BTF UAPI headers are outdated - Python is not used during build; remove it and help break a cycle. - Enable building and packaging of static library. Explicitly enable fat LTO objects. - Update to release 0.8.0 * New features and APIs: - support auto-resolution of binaries and shared libraries from PATH, if necessary; - support attaching by function names (only by IP was supported before); - support attaching to USDTs (SEC("usdt/...") and bpf_program__attach_usdt()) with initially supported architectures: x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv); - improved BPF verifier log reporting for CO-RE relocation failures (no more obscure "invalid func unknown#195896080" errors); - auto-adjust BPF ringbuf size according to host kernel's page size requirements; - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(), etc that validate key/value buffer sizes; - bpf_link_create() can create all bpf_link-based (including raw_tp, fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old kernels transparently; - support opting out from auto-loading BPF programs declaratively with SEC("?..."); - support opting out from auto-creation of declarative BPF maps with bpf_map__set_autocreate(); - support multi-kprobes (SEC("kprobe.multi/...") and bpf_program__attach_kprobe_multi_opts()); - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc); - support BPF sub-skeletons for "incomplete" BPF object files (requires matching bpftool to generate .subskel.h); - BPF cookie support for fentry/fexit/fmod_ret BPF programs (bpf_program__attach_trace_opts()); - support for custom SEC() handlers (libbpf_register_prog_handler()). * BPF-side API - BPF-side USDT APIs. See new usdt.bpf.h header: * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(), * bpf_usdt_cookie() helpers; - new bpf_core_field_offset() CO-RE helper and support bpf_core_field_size(type, field) forms; - barrier() and barrier_var() macros for improving BPF code generation; - __kptr and __kptr_ref tags added; - ARC architecture support in bpf_tracing.h header; - new BPF helpers: * bpf_skb_set_tstamp(); * bpf_ima_file_hash(); * bpf_kptr_xchg(); * bpf_map_lookup_percpu_elem(). * Bug fixes - netlink bug fixes; - libbpf.pc fixes to support patch releases properly; - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix; - minor CO-RE fixes and improvements for some corner cases; - various other small fixes and improvements. - Update to release 0.8.1: * make shared xsk creation network namespace aware - update to 1.0.1: * fix inadvertently changed struct bpf_object_open_opts memory layout; * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers; * fix NULL pointer exception in API btf_dump__dump_type_data; * remove struct btf_map_def accidentally left in bpf_helpers.h header. * All deprecated APIs and features removed! * support for syscall-specific kprobe/kretprobe (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>")); * support for sleepable uprobe BPF programs (SEC("uprobe.s")); * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup")); * support for new BPF CO-RE relocation TYPE_MATCHES; * bpf_prog_load() and bpf_map_create() are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names); * BTF_KIND_ENUM64 support; * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted; * new APIs for converting BPF enums to their string representation: * libbpf_bpf_prog_type_str(); * libbpf_bpf_map_type_str(); * libbpf_bpf_link_type_str(); * libbpf_bpf_attach_type_str(); * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting out from auto-attaching of BPF program by BPF skeleton; * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf; * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information. - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941) + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534) + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533) + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606) + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch - update to v1.1.0: User space-side features and APIs: * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support; * new documentation page listing all recognized SEC() definitions; * BTF dedup improvements: * unambiguous fwd declaration resolution for structs and unions; * better handling of some corner cases with identical structs and arrays; * mixed enum and enum64 forward declaration resolution logic; * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts() APIs; * libbpf supports loading raw BTF for BPF CO-RE from known search paths; * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE); * libbpf will only add BPF_F_MMAPABLE flag for data maps with global (i.e., non-static) vars; * latest Linux UAPI headers with lots of changes synced into include/uapi/linux. BPF-side features and APIs; * BPF_PROG2() macro added that supports struct-by-value arguments; * new BPF helpers: * bpf_user_ringbuf_drain(); * cgrp_storage_get() and cgrp_storage_delete(). Bug fixes * better handling of padding corner cases; * btf__align_of() determines packed structs better now; * improved handling of enums of non-standard sizes; * USDT spec parsing improvements; * overflow handling fixes for ringbufs; * Makefile fixes to support cross-compilation for 32-bit targets; * fix crash if SEC("freplace") programs don't have attach_prog_fd set; * better handling of file existence checks when running as non-root with enhanced capabilities; * a bunch of small fixes: * ELF handling improvements; * fix memory leak in USDT argument parsing logic; * fix NULL dereferences in few corner cases; * improved netlink attribute iteration handling. - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch, libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch, libbpf-Fix-memory-leak-in-parse_usdt_arg.patch libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream) - Remove requirement of linux-glibc-devel >= 5.16 for devel package - Fix null pointer dereference in bpf_object__collect_prog_relos() (bsc#1221101) * Add libbpf-Fix-NULL-pointer-dereference-in-bpf_object__c.patch - Initial release - Reflect SUSE CFLAGS - Do not bother with obscpio if we are fetching direct releases - Remove patch 0001-makefile-Fix-install-target.patch seems to build/install without it just fine - Update to 0.0.6: + New features - new extensible bpf_object__open_{file,mem} APIs and DECLARE_LIBBPF_OPTS() macro to go with them - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now distributed with libbpf - BPF CO-RE: added field size, field existence, and bitfield relocation support - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(), bpf_core_field_size() and other BPF CO-RE related helpers available through bpf_core_read.h header - bpf_object__open() API now auto-detects program type from its section name - BPF_PROG_TRACING programs support (incuding BTF-typed raw tracepoints, fentry/fexit programs) - mmap() support for BPF global variables - declarative map pinning support added - probe_read_{user,kernel}[_str]() BPF helpers added - bpf_get_link_xdp_info() function to get more XDP information added - a bunch of other AF_XDP changes + Usability improvements - no need for int version SEC('version') = 1; anymore - raw_tp/tp and uprobe/uretprobe section prefixes added - new bpf_program__get_{type,expected_attach_type} getters - preserve error code on program load failure + Fixes - btf_dump padding handling - bpf_object__name() returning name, not path - ELF section handling off-by-one bug fix - mem leak/double free fix in BPF program relocation code - Build libbpf from kernel sources, not from github sources, for consistency with bpftool package. - Add python3 as a build dependency. - libbpf is now a separate project, stop building from the kernel (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805). - Fix LIBSUBDIR + libdir.patch - Create libbpf0-32bit needed by libdwarves1-32bit - Depend on new enough Linux headers. - Fix LTO build (bsc#1188749). + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to 0.5.0: + New features and user-space APIs: - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details. - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in); - "Light" BPF skeleton support; - BPF_PROG_TYPE_SYSCALL support; - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs; - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs; - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API; - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations; - sk_reuseport/migrate program type support; - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description; - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them; - btf__load_vmlinux_btf() and btf__load_module_btf() APIs; - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps; - bpf_map_lookup_and_delete_elem_flags() API. + BPF-side APIs and features: - support for weak typed __ksym externs; - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel(); - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side; - bpf_get_func_ip() helper; - bpf_sys_bpf() helper; - bpf_task_pt_regs() helper; - bpf_btf_find_by_name_kind() helper; - usability improvements for bpf_tracing.h when target architecture is missing. + Bug fixes and compatibility improvements: - improve BPF support detection on old Red Hat kernels with backported BPF patches; - improvements for LTO builds with GCC 10+; - pass NLM_F_EXCL when creating TC qdisc; - better support of BPF map reuse on old kernels; - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself. - Remove patches merged upstream + libdir.patch + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch - Update to release 0.6.1 * Introduce legacy kprobe events support * Add legacy uprobe attaching support * Support uniform BTF-defined key/value specification across all BPF maps * Support kernel module function calls * Support detecting and attaching of writable tracepoint program * Add bloom filter map implementation * Add typeless and weak ksym support to gen_loader * Add RISC-V (RV64) support to bpf_tracing.h * Deprecate AF_XDP support * Support BTF_KIND_TYPE_TAG - Update to release 0.7.0 * legacy BPF map definitions (using struct bpf_map_def) are deprecated when LIBBPF_STRICT_MAP_DEFINITIONS is passed to libbpf_set_strict_mode(). Please use BTF-defined map definitions. * ability to control and capture BPF verifier log output on per-object and per-program level * CO-RE support and other improvements for "light skeleton" * improved compilation when system BTF UAPI headers are outdated - Python is not used during build; remove it and help break a cycle. - Enable building and packaging of static library. Explicitly enable fat LTO objects. - Update to release 0.8.0 * New features and APIs: - support auto-resolution of binaries and shared libraries from PATH, if necessary; - support attaching by function names (only by IP was supported before); - support attaching to USDTs (SEC("usdt/...") and bpf_program__attach_usdt()) with initially supported architectures: x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv); - improved BPF verifier log reporting for CO-RE relocation failures (no more obscure "invalid func unknown#195896080" errors); - auto-adjust BPF ringbuf size according to host kernel's page size requirements; - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(), etc that validate key/value buffer sizes; - bpf_link_create() can create all bpf_link-based (including raw_tp, fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old kernels transparently; - support opting out from auto-loading BPF programs declaratively with SEC("?..."); - support opting out from auto-creation of declarative BPF maps with bpf_map__set_autocreate(); - support multi-kprobes (SEC("kprobe.multi/...") and bpf_program__attach_kprobe_multi_opts()); - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc); - support BPF sub-skeletons for "incomplete" BPF object files (requires matching bpftool to generate .subskel.h); - BPF cookie support for fentry/fexit/fmod_ret BPF programs (bpf_program__attach_trace_opts()); - support for custom SEC() handlers (libbpf_register_prog_handler()). * BPF-side API - BPF-side USDT APIs. See new usdt.bpf.h header: * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(), * bpf_usdt_cookie() helpers; - new bpf_core_field_offset() CO-RE helper and support bpf_core_field_size(type, field) forms; - barrier() and barrier_var() macros for improving BPF code generation; - __kptr and __kptr_ref tags added; - ARC architecture support in bpf_tracing.h header; - new BPF helpers: * bpf_skb_set_tstamp(); * bpf_ima_file_hash(); * bpf_kptr_xchg(); * bpf_map_lookup_percpu_elem(). * Bug fixes - netlink bug fixes; - libbpf.pc fixes to support patch releases properly; - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix; - minor CO-RE fixes and improvements for some corner cases; - various other small fixes and improvements. - Update to release 0.8.1: * make shared xsk creation network namespace aware - update to 1.0.1: * fix inadvertently changed struct bpf_object_open_opts memory layout; * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers; * fix NULL pointer exception in API btf_dump__dump_type_data; * remove struct btf_map_def accidentally left in bpf_helpers.h header. * All deprecated APIs and features removed! * support for syscall-specific kprobe/kretprobe (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>")); * support for sleepable uprobe BPF programs (SEC("uprobe.s")); * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup")); * support for new BPF CO-RE relocation TYPE_MATCHES; * bpf_prog_load() and bpf_map_create() are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names); * BTF_KIND_ENUM64 support; * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted; * new APIs for converting BPF enums to their string representation: * libbpf_bpf_prog_type_str(); * libbpf_bpf_map_type_str(); * libbpf_bpf_link_type_str(); * libbpf_bpf_attach_type_str(); * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting out from auto-attaching of BPF program by BPF skeleton; * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf; * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information. - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941) + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534) + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533) + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606) + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch - update to v1.1.0: User space-side features and APIs: * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support; * new documentation page listing all recognized SEC() definitions; * BTF dedup improvements: * unambiguous fwd declaration resolution for structs and unions; * better handling of some corner cases with identical structs and arrays; * mixed enum and enum64 forward declaration resolution logic; * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts() APIs; * libbpf supports loading raw BTF for BPF CO-RE from known search paths; * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE); * libbpf will only add BPF_F_MMAPABLE flag for data maps with global (i.e., non-static) vars; * latest Linux UAPI headers with lots of changes synced into include/uapi/linux. BPF-side features and APIs; * BPF_PROG2() macro added that supports struct-by-value arguments; * new BPF helpers: * bpf_user_ringbuf_drain(); * cgrp_storage_get() and cgrp_storage_delete(). Bug fixes * better handling of padding corner cases; * btf__align_of() determines packed structs better now; * improved handling of enums of non-standard sizes; * USDT spec parsing improvements; * overflow handling fixes for ringbufs; * Makefile fixes to support cross-compilation for 32-bit targets; * fix crash if SEC("freplace") programs don't have attach_prog_fd set; * better handling of file existence checks when running as non-root with enhanced capabilities; * a bunch of small fixes: * ELF handling improvements; * fix memory leak in USDT argument parsing logic; * fix NULL dereferences in few corner cases; * improved netlink attribute iteration handling. - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch, libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch, libbpf-Fix-memory-leak-in-parse_usdt_arg.patch libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream) - Remove requirement of linux-glibc-devel >= 5.16 for devel package - Fix null pointer dereference in bpf_object__collect_prog_relos() (bsc#1221101) * Add libbpf-Fix-NULL-pointer-dereference-in-bpf_object__c.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Update to 5.6: * inspect logical-resolve: support LOGICAL_INO_V2 as new option '-o', helps advanced dedupe tools * inspect: user larger buffer (64K) for results * subvol delete: support deletion by id (requires kernel 5.7+) * dump-tree: new option --hide-names, replace any names (file, directory, subvolume, xattr) in the output with stubs * various fixes - Fix content of _dracutmodulesdir variable: this definitively does not belong to libexecdir. - Update to 5.6.1: * print warning when multiple block group profiles exist, update 'fi usage' summary, add docs to maual page explaining the situation * build: optional support for libgcrypt or libsodium, providing hash implementations * updated docs - Update to 5.7: * mkfs: * new option to enable features otherwise enabled at runtime, now implemented for quotas, 'mkfs.btrfs -R quota' * fix space accounting for small image, DUP and --rootdir * option -A removed * check: detect ranges with overlapping csum items * fi usage: report correct numbers when plain RAID56 profiles are used * convert: ensure the data chunks size never exceed device size * libbtrfsutil: update documentation regarding subvolume deletion * build: support libkcapi as implementation backend for cryptographic primitives * core: global options for verbosity (-v, -q), subcommands -v or -q are aliases and will continue to work but are considered deprecated, current command output is preserved to keep scripts working * other: * build warning fixes * btrfs-debugfs ported to python 3 - Update to 5.9: * mkfs: * switch default to single profile for multi-device filesystem, up to now it was raid0 that may not be simple to convert to some other profile as raid0 needs a workspace on all device for that * new option -R for run-time options (eg. mount time enabled), now understands free-space-tree * subvolume delete: * refuse to delete the default subvolume (kernel will not allow that but the error reason is not obvious) * warn on EPERM, eg. if send is on progress on the subvolume * convert: * fix 32bit overflows on large filesystems * improved error handling and error messages * check free space taking fragmentation into account * check: * detect and repair wrong inode generation * minor improvement in error reporting on roots * libbtrfsutils: follow main package versioning (5.9) * add pkg-config file definitions * python-btrfsutil: follow main package versioning (5.9) * inspect tree-stats: print node counts for each level, fanout * other: * docs: * remove obsolete mount options (alloc_start, subvolrootid) * deleting default subvolume is not permitted * updated or fixed tests * .editorconfig updates * move files to kernel-shared/ * CI: * updated to use zstd 1.4.5 * fix reiserfs build * more builds with asan, ubsan * sb-mod updates * build: * print .so versions of libraries in configure summary - prepare usrmerge (boo#1029961) - Update to 5.11 * fix device path canonicalization for device mapper devices * receive: remove workaround for setting capabilities, all stable kernels have been patched * receive: fix duplicate mount path detection * rescue: new subcommand create-control-device * device stats: minor fix for plain text format output * build: detect if e2fsprogs support 64bit timestamps * build: drop libmount, required functionality has been reimplemented * mkfs: warn when raid56 is used * balance convert: warn when raid56 is used * other * new and updated tests * documentation updates * seeding device * raid56 status * CI updates * docker images for various distros - Update to 5.10.1 * static build works again * other: * add a way to test static binaries with the testsuite * clarify scrub docs * update dependencies, minimum version for libmount is 2.24, this may change in the future - Update to 5.10 * scrub status: * print percentage of progress * add size unit options * fi usage: also print free space from statfs * convert: copy full 64 bit timestamp from ext4 if availalble * check: * add ability to repair extent item generation * new option to remove leftovers from inode number cache (-o inode_cache) * check for already running exclusive operation (balance, device add/...) when starting one * preliminary json output support for 'device stats' * fixes: * subvolume set-default: id 0 correctly falls back to toplevel * receive: align internal buffer to allow fast CRC calculation * logical-resolve: distinguish -o subvol and bind mounts * build: new dependency libmount * other * doc fixes and updates * new tests * ci on gitlab temporarily disabled * debugging output enhancements - Update to 5.12 * libbtrfsutil: relicensed to LGPL v2.1+ * mkfs: zoned mode support (kernel 5.12+) * fi df: show zone_unusable per profile type in zoned mode * fi usage: show total amount of zone_unusable * fi resize: fix message for exact size * image: fix warning and enlarge output file if necessary * core * refactor chunk allocator for more modes * implement zoned mode support: allocation and writes, sb log * crypto/hash refactoring and cleanups * refactoring and cleanups * other * test updates * CI updates * travis-ci integration disabled * docker images updated, more coverage * incomplete build support for Android removed * doc updates * chattr mode m for 'NOCOMPRESS" * swapfile used from fstab * how to add a new export to libbtrfsutil * update status of mount options since 5.9 - Update to 5.11.1 * properly format checksums when a mismatch is reported * check: fix false alert on tree block crossing 64K page boundary * convert: * refuse to convert filesystem with 'needs_recovery' * update documentation to require fsck before conversion * balance convert: fix raid56 warning when converting other profiles * fi resize: improved summary * other * build: fix checks and autoconf defines * fix symlink paths for CI support scripts * updated tests - Update to 5.12.1 * build: fix missing symbols in libbtrfs * mkfs: check for minimal number of zones * check: fix warning about cache generation when free space tree is enabled * fix superblock write in zoned mode on 16K pages - Fix build for leap * --disable-zstd if leap < 42.3 * --disable-zoned for leap - revert previous change, unintentionally disables zstd on tumbleweed - Add --disable-zoned for leap - Update to 5.13 * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print stripe count for striped profiles * print zoned information: size, total unusable * mkfs: print note about sha256 accelerated module loading issue * check: ability to reset dev_item::bytes_used * fixes * detect zoned kernel support at run time too * exclusive op running check return value * fi resize: support cancel (kernel 5.14) * device remove: support cancel (kernel 5.14) * documentation about general topics * compression * zoned mode * storage model * hardware considerations * other * libbtrfsutil API overview * help text fixes and updates * hash speedtest measure time, cycles using perf and print throughput - Update to 5.13.1 * build: fix build on musl libc due to missing definition of NAME_MAX * check: * batch more work into one transaction when clearing v1 free space inodes * detect directoris with wrong number of links * libbtrfsutil: fix race between subvolume iterator and deletion * mkfs: be more specific about supported profiles for zoned device * other: * documentation updates - Update to 5.14 * convert: * new option --uuid to copy, generate or set a given uuid * improve output * mkfs: * allow to create degenerate raid0 (on 1 device) and raid10 (on 2 devices) * image: * improved error messages * fix some alignment of restored image * subvol delete: allow to delete by id when path is not resolvable * check: * require alignment of nodesize for 64k page systems * detect and fix invalid block groups * libbtrfs (deprecated): * remove most exported symbols, leave only a few that are used by snapper * no version change (still 0.1) * remove btrfs-list.h, btrfsck.h * fixes: * reset generation of space v1 if v2 is used * fi us: don't wrongly report missing device size when partition is not readable * other: * build: experimental features * build: better detection of 64bit timestamp support for ext4 * corrupt-block: block group items * new and updated tests * refactoring * experimental features: * new image dump format, with data - Deleted upstreamed patches for upgrade: - fate#325871 * 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch * 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch * 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch * 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch * 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch - btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny metadata (bsc#1131334). * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch - btrfs-progs: check: fix segfault with -Q (bsc#1158560) * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch - Enqueue feature to wait for exclusive operation to finish (JSC#SLE-15234) * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch - Correct check_running_fs_exclop() return value (bsc#1184481) * btrfs-progs-Correct-check_running_fs_exclop-return-v.patch - Ignore multipath devices when probing devices for a btrfs filesystem (bsc#1192983) * 0001-btrfs-progs-Add-optional-dependency-on-libudev.patch * 0002-btrfs-progs-Ignore-devices-representing-paths-in-mul.patch * 0003-btrfs-progs-Add-fallback-code-for-path-device-ignore.patch - add python-rpm-macros (bsc#1194748) - Upstream behavior of btrfs compression=none (JSC#PED-1711) * btrfs-progs_props_dont_translate_value_of_compression_none.patch - btrfs-progs: fix defrag -c option parsing (bsc#1218029) * btrfs-progs-fix-defrag-c-option-parsing.patch - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Fix RPM groups; update summaries. Remove useless --with-pic which is only for static libs. - Add cairo-pdf-fixes.patch: Three minor pdf fixes from upstream git (fdo#99630). - Rebase cairo-pdf-fixes.patch: Add commit to fix fdo#100029. - Add cairo-get_bitmap_surface-bsc1036789-CVE-2017-7475.diff to fix a segfault in get_bitmap_surface due to malformed font (bsc#1036789, fdo#100763, CVE-2017-7475). - Update to version 1.15.6: + Detect if variable fonts have synthesized bold/italic or non-default variants, and use a fallback font where needed. + Restore MacOSX 10.4 support. Cairo had dropped 10.4 support when moving to the CoreText API. Now we automatically detect which API to use via dynamic linking, so can resume supporting this older version of MacOSX. + Fix error reporting in the xcb backend if fallback fails. Instead of returning NULL when the X11 server can't do some operation, return a surface in an error state. + Call XSync in the xlib backend before setting the error handler to ignore errors for certain requests, to make sure all pending errors are handled first. + Fix text-glyph-range for quartz-font. Use 0xFFFF instead of 0 for invalid index tracking. + Fix handling of Supplementary Multilingual Plane (SMP) Unicode characters in quartz-font. + Fix various issues in the drm backend including updating API usage and general code cleanup. + Clarify documentation regarding device scale inheritance and the units used in cairo_surface_create_similar_image (fdo#99094). - Drop cairo-pdf-fixes.patch: Fixed upstream. - Add cairo-fix-off-by-one-check.patch: Fix off by one check in cairo-image-info.c (fdo#101427). - Add 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to fix a segfault when using >4GB images since int values were used for pointer operations (bsc#1007255, fdo#98165, CVE-2016-9082). - Update to version 1.15.8: + This small snapshot provides new colored emoji glyph support, and a handful of minor fixes. For a complete log of changes, please see http://cairographics.org/releases/ChangeLog.1.15.8 + Features and Enhancements: Support colored emoji glyphs, stored as PNG images in OpenType fonts. + Bug Fixes: - pdf: . Fix internal links pointing to other pages, by pre-calculating page heights so that link positions can be calculated more accurately. . Don't emit /PageLabel dict when no labels defined. - image: Fix crash on negative lengths. - win32: Fix initialization of mutexes for static builds. - font: . Fix color font loading on big-endian systems. . Fix color font support infinite-loop with empty glyphs. - Fix off by one check in cairo-image-info.c. - Drop cairo-fix-off-by-one-check.patch: Fixed upstream. - Run spec-cleaner, modernize spec. - Rename 0001-image-prevent-invalid-ptr-access-for-4GB-images.patch to cairo-image-prevent-invalid-ptr-access.patch. - Pass enable-gtk-doc instead of disable-gtk-doc to configure, we already have the gtk-doc BuildRequires in place so I can only assume that this was an honest error. - Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel. * The pkgconfig(gl) and pkgconfig(egl) are what cairo really needs. Mesa-devel is too general and is a bottleneck in distribution build. (bnc#1071297) - Update to version 1.15.10: + Features and Enhancements: - Add support for OpenGL ES 3.0 to the gl backend. - Use Reusable streams for forms in Level 3 Postscript. - Add CAIRO_MIME_TYPE_EPS mime type for embedding EPS files. - Add CCITT_FAX mime type for PDF and PS surfaces. - svg: add a new function to specify the SVG document unit (fdo#90166). - Use UTF-8 filenames on Windows. + API Changes: cairo_svg_surface_set_document_unit() and cairo_svg_surface_get_document_unit(). + Bugs fixed: - Fix regression in gles version detection. - Fix undefined-behavior with integer math. - Handle SOURCE and CLEAR operators when painting color glyphs (fdo#102661). - Convert images to rgba or a8 formats when uploading with GLESv2. - Use _WIN32 instead of windows.h to check for windows build. - Fix sigabrt printing documents with fonts lacking the mandatory .nodef glyph (fdo#102922). - Prevent curved strokes in small ctms from being culled from vector surfaces (fdo#103071). - Fix painting an unbounded recording surface with the SVG backend. - Fix falling back to system font with PDFs using certain embedded fonts, due to truncated font names (fdo#103249). - Fix handling of truetype fonts with excessively long font names (fdo#103249). - Fix race conditions with cairo_mask_compositor_t (fdo#103037). - Fix build error with util/font-view. - Fix assertion hit with PDFs using Type 4 fonts rendered with user fonts, due to error when destroying glyph page (fdo#103335). - Set default creation date for PDFs. - Prevent invalid ptr access for > 4GB images (fdo#98165). - Prevent self-copy infinite loop in Postscript surface. - Fix padded image crash in Postscript surface. - Fix annotation bugs in PDFs and related memory leaks. - Fix test failures and other assorted issues in ps and pdf code. - Fix code generation when using GCC legacy atomic operations (fdo#103559). - Fix various compilation warnings and errors. - Fix various distcheck errors with private symbols, doxygen formatting etc. - Drop cairo-image-prevent-invalid-ptr-access.patch - Add explicit pkgconfig(zlib) and (conditionalized on build_xcb_backend) pkgconfig(xcb-render) BuildRequires: closer alignment with what configure checks for. - Modernize spec-file by calling spec-cleaner - Update to version 1.15.12: + The main focus for this release is the addition of Variable Font support. Variable fonts are single font files with various typography characteristics, such as weight or slant, that users of the font can adjust between two points. Effectively this enables a single font to behave as multiple fonts. + The Skia backend is disabled in this release, due to severe bitrot, and will be removed in future releases. Contact the cairo team if you have a need of this backend. + Features and Enhancements: - Variable font support. - Skia backend is disabled. + API Changes: cairo_font_options_get_variations() and cairo_font_options_set_variations() are added. + Bugs fixed: - Fix errors in csi-trace --help and --version options. - Fix a 'memory leak' in the image compositor, with pixman_glyph_cache_t. - Fix access of uninitialized memory found by valgrind (fdo#91271). - Fix improper initialization of memory in _cairo_ft_font_face_create_for_pattern() (fdo#105084). - Fix multi-monitor virtual desktop with negative coords on Win32 (fdo#100793). - Fix issues occuring with older FreeType versions. - Add cairo-fix-assertion-failure-in-freetype-backend.patch: Fix assertion failure in the freetype backend (fdo#105746). - Add cairo-CVE-2017-9814.patch: Replace malloc with _cairo_malloc and check cmap size before allocating (boo#1049092, CVE-2017-9814, fdo#101547). - Update to version 1.15.14: + Features and Enhancements: - Add more FreeeType font color conversions to support COLR/CPAL. - Update test reference images against current pixman. + Bugs fixed: - Fix crash when rendering Microsoft's Segoe UI Emoji Regular font. - Fix build breakage with glesv3 enabled due to non-existant glesv3.pc. - Fix memory leaks found by Coverity. - Fix incorrect null ptr handling found by Coverity. - Fix test compilation when font-config is disabled. - Use _cairo_malloc instead of malloc (fdo#101547, CVE-2017-9814). - Fix assertion failure in the freetype backend (fdo#105746). - Drop upstream fixed patches: + cairo-fix-assertion-failure-in-freetype-backend.patch. + cairo-CVE-2017-9814.patch. - Update to version 1.16.0: + test: Free resources in pdf2png. + Drop skia backend. + Revert "Correctly decode Adobe CMYK JPEGs in PDF export". - Add 2 upstream bug fix patches: + cairo-Use-FT_Done_MM_Var-instead-of-free-when-available.patch: ft: Use FT_Done_MM_Var instead of free when available in cairo_ft_apply_variations. Fixes a crash when using freetype >= 2.9 + cairo-composite_color_glyphs.patch: Fix a thinko in composite_color_glyphs. We can't just move around the contents of the passed-in string, we need to make a copy. This was showing up as memory corruption in pango. - Add an upstream bug fix + cairo-pdf-add-missing-flush.patch: Fixes PDF generation see https://gitlab.freedesktop.org/cairo/cairo/issues/342 - Add upstream patch + cairo-do-not-override-explicitly-requested-grayscale-aa.patch Do not replace explicitly set applications settings by user settings for font antialiasing. See: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 - Add cairo-fix-infinite-loop-bsc1122321-CVE-2019-6462.patch: This fixes a potentially infinite loop (bsc#1122321, CVE-2019-6462, glfo#cairo/cairo#155). - Add upstream patches with the ares_getaddrinfo function: * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch * 0007-getaddrinfo-enhancements-257.patch * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch - Add a patch which disables test failing on OBS (but passing in local environment): * 0010-Disable-failing-test.patch - Update to upstream snapshot 20191108 * getaddrinfo - avoid infinite loop in case of NXDOMAIN * ares_getenv - return NULL in all cases * implement ares_getaddrinfo - onion-crash.patch: removed, upstreamed. - removed upstream patches that are part of the snapshot: 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch 0007-getaddrinfo-enhancements-257.patch 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch 0010-Disable-failing-test.patch - disable-live-tests.patch - updated - Fix version number of the snapshot to not be downgrade: bsc#1156601 - Switch to cmake-based build. Some packages need the cmake build files. - Add netcfg as the build requirement and runtime requirement. ares_getaddrinfo function uses the getservbyport_r function which requires the /etc/services file to function properly. That config file is provided by the netcfg package. Unit tests rely on it too, hence it has to be a build dependency as well. - Upgrade to latest snapshot from 2020-01-17 - disable-live-tests.patch: refreshed - regression.patch: fix a regression in DNS results that contain both A and AAAA answers. - Version update to 1.16.1 Security: * Prevent possible use-after-free and double-free in ares_getaddrinfo() if ares_destroy() is called prior to ares_getaddrinfo() completing. Reported by Jann Horn at Google Project Zero. Changes: * Allow TXT records on CHAOS qclass. Used for retriving things like version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3] Bug fixes: * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1] * Silence false cast-align compiler warnings due to valid casts of struct sockaddr to struct sockaddr_in and struct sockaddr_in6. * MacOS should use libresolv for retrieving DNS servers, like iOS * CMake build system should populate the INCLUDE_DIRECTORIES property of installed targets [2] * Correct macros in use for the ares_getaddrinfo.3 man page - Changes in version 1.16.0 Changes: * Introduction of ares_getaddrinfo() API which provides similar output (including proper sorting as per RFC 6724) to the system native API, but utilizes different data structures in order to provide additional information such as TTLs and all aliases. Please reference the respective man pages for usage details. * Parse SOA records from ns_t_any response * CMake: Provide c-ares version in package export file * CMake: Add CPACK functionality for DEB and RPM * CMake: Generate PDB files during build * CMake: Support manpage installation Bug fixes: * Fix bad expectation in IPv6 localhost test. * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to prevent complaints about CPPFLAGS in CFLAGS. * Fix .onion handling * Command line usage was out of date for adig and ahost. * Typos in manpages * If ares_getenv is defined, it must return a value on all platforms * If /etc/resolv.conf has invalid lookup values, use the defaults. * Tests: Separate live tests from SetServers* tests as only live tests should require internet access. * ares_gethostbyname() should return ENODATA if no valid A or AAAA record is found, but a CNAME was found. * CMake: Rework library function checking to prevent unintended linking with system libraries that aren't needed. * Due to use of inet_addr() it was not possible to return 255.255.255.255 from ares_gethostbyname(). * CMake: Fix building of tests on Windows - Drop regression.patch which have been fixed upstream - Refresh disable-live-tests.patch - Remove static lib since its required when doing tests and we dont want it included in package - Run spec-cleaner - Implement multibuild specfile to split out tests into its own flavor; this way we can build and run tests, which require static lib, as well as avoid packaging the latter without issues with the installed cmake file.. - simplify conditions bit to make it tad more readable - Version update to 1.17.0 Security: * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing * Avoid theoretical buffer overflow in RC4 loop comparison * Empty hquery->name could lead to invalid memory access * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in (bsc#1178882, CVE-2020-8277) Changes: * Update help information for adig, acountry, and ahost * Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers * Detect remote DNS server does not support EDNS using rules from RFC 6891 * Source tree has been reorganized to use a more modern layout * Allow parsing of CAA Resource Record Bug fixes: * readaddrinfo bad sizeof() * Test cases should honor HAVE_WRITEV flag, not depend on WIN32 * FQDN with trailing period should be queried first * ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints. * ares_gethostbyname() with AF_UNSPEC and an ip address would fail * Properly document ares_set_local_ip4() uses host byte order For details, see https://c-ares.haxx.se/changelog.html - add missing upstream sources, to be removed for next release - remove unnecessary BuildRequires - fix building on SLE12 systems - ares_dns.h, missing_header.patch: re-add missing header in last release - add BR for pkg-config to get the provides in the devel package - update to 1.17.1: Travis: add iOS target built with CMake (#378) Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake. - fix build External projects were using non-public header ares_dns.h, make public again (#376) It appears some outside projects were relying on macros in ares_dns.h, even though it doesn't appear that header was ever meant to be public. That said, we don't want to break external integrators so we should distribute this header again. - note that so versioning has moved to configure.ac - note about 1.17.1 - fix sed gone wrong autotools cleanup (#372) * buildconf: remove custom logic with autoreconf - remove missing_header.patch (upstream) - update to 1.17.2: Security: * When building c-ares with CMake, the RANDOM_FILE would not be set and therefore downgrade to the less secure random number generator * If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause a crash * Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response * Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing follow-up (bsc#1188881, CVE-2021-3672) * Perform validation on hostnames to prevent possible XSS due to applications not performing valiation themselves Changes: * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases Bug fixes: * Building tests should not force building of static libraries except on Windows * Relative headers must use double quotes to prevent pulling in a system library for details see, https://c-ares.haxx.se/changelog.html#1_17_2 - 5c995d5.patch: augment input validation on hostnames to allow _ as part of DNS response (bsc#1190225) - new upstream website - drop multibuild - tests do not require static library anymore - spec file cleanup - drop sources that were re-added to upstream distibution (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake) - update to 1.18.1. Changes since 1.17.2: * Allow '/' as a valid character for a returned name for CNAME in-addr.arpa delegation * no longer forwards requests for localhost resolution per RFC6761 * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the search process will continue to the next domain in the search. * Provide ares_nameser.h as a public interface as needed by NodeJS * Add support for URI(Uniform Resource Identifier) records via ares_parse_uri_reply() - disable unit tests for SLE12 since GCC compiler too old to build unit tests - 5c995d5.patch: upstreamed - disable-live-tests.patch: refreshed - Update to version 1.19.0 Security: * Low. Stack overflow in ares_set_sortlist() which is used during c-ares initialization and typically provided by an administrator and not an end user. (bsc#1208067, CVE-2022-4904) Changes: * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for specifying a custom hosts file location. Bug fixes: * Fix memory leak in reading /etc/hosts when using localhost fallback. * Fix chain building c-ares when libresolv is already included by another project. * File lookup should not immediately abort as there may be other tries due to search criteria. * Asterisks should be allowed in host validation as CNAMEs may reference wildcard domains. * AutoTools build system referenced bad STDC_HEADERS macro. * Even if one address class returns a failure for ares_getaddrinfo() we should still return the results we have. * Fix ares_getaddrinfo() numerical address resolution with AF_UNSPEC * Fix tools and help information. * Various documentation fixes and cleanups. * Add include guards to ares_data.h * c-ares could try to exceed maximum number of iovec entries supported by system. * The RFC6761 6.3 states localhost subdomains must be offline too - Update to version 1.19.1 Security: * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service (bsc#1211604) * CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS query IDs (bsc#1211605) * CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() (bsc#1211606) * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation (bsc#1211607) Bug fixes: * Fix uninitialized memory warning in test * ares_getaddrinfo() should allow a port of 0 * Fix memory leak in ares_send() on error * Fix comment style in ares_data.h * Fix typo in ares_init_options.3 * Sync ax_pthread.m4 with upstream * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support - CVE-2024-25629.patch: fix out of bounds read in ares__read_line() (bsc#1220279, CVE-2024-25629) - Add upstream patches with the ares_getaddrinfo function: * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch * 0007-getaddrinfo-enhancements-257.patch * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch - Add a patch which disables test failing on OBS (but passing in local environment): * 0010-Disable-failing-test.patch - Update to upstream snapshot 20191108 * getaddrinfo - avoid infinite loop in case of NXDOMAIN * ares_getenv - return NULL in all cases * implement ares_getaddrinfo - onion-crash.patch: removed, upstreamed. - removed upstream patches that are part of the snapshot: 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch 0007-getaddrinfo-enhancements-257.patch 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch 0010-Disable-failing-test.patch - disable-live-tests.patch - updated - Fix version number of the snapshot to not be downgrade: bsc#1156601 - Switch to cmake-based build. Some packages need the cmake build files. - Add netcfg as the build requirement and runtime requirement. ares_getaddrinfo function uses the getservbyport_r function which requires the /etc/services file to function properly. That config file is provided by the netcfg package. Unit tests rely on it too, hence it has to be a build dependency as well. - Upgrade to latest snapshot from 2020-01-17 - disable-live-tests.patch: refreshed - regression.patch: fix a regression in DNS results that contain both A and AAAA answers. - Version update to 1.16.1 Security: * Prevent possible use-after-free and double-free in ares_getaddrinfo() if ares_destroy() is called prior to ares_getaddrinfo() completing. Reported by Jann Horn at Google Project Zero. Changes: * Allow TXT records on CHAOS qclass. Used for retriving things like version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3] Bug fixes: * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1] * Silence false cast-align compiler warnings due to valid casts of struct sockaddr to struct sockaddr_in and struct sockaddr_in6. * MacOS should use libresolv for retrieving DNS servers, like iOS * CMake build system should populate the INCLUDE_DIRECTORIES property of installed targets [2] * Correct macros in use for the ares_getaddrinfo.3 man page - Changes in version 1.16.0 Changes: * Introduction of ares_getaddrinfo() API which provides similar output (including proper sorting as per RFC 6724) to the system native API, but utilizes different data structures in order to provide additional information such as TTLs and all aliases. Please reference the respective man pages for usage details. * Parse SOA records from ns_t_any response * CMake: Provide c-ares version in package export file * CMake: Add CPACK functionality for DEB and RPM * CMake: Generate PDB files during build * CMake: Support manpage installation Bug fixes: * Fix bad expectation in IPv6 localhost test. * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to prevent complaints about CPPFLAGS in CFLAGS. * Fix .onion handling * Command line usage was out of date for adig and ahost. * Typos in manpages * If ares_getenv is defined, it must return a value on all platforms * If /etc/resolv.conf has invalid lookup values, use the defaults. * Tests: Separate live tests from SetServers* tests as only live tests should require internet access. * ares_gethostbyname() should return ENODATA if no valid A or AAAA record is found, but a CNAME was found. * CMake: Rework library function checking to prevent unintended linking with system libraries that aren't needed. * Due to use of inet_addr() it was not possible to return 255.255.255.255 from ares_gethostbyname(). * CMake: Fix building of tests on Windows - Drop regression.patch which have been fixed upstream - Refresh disable-live-tests.patch - Remove static lib since its required when doing tests and we dont want it included in package - Run spec-cleaner - Implement multibuild specfile to split out tests into its own flavor; this way we can build and run tests, which require static lib, as well as avoid packaging the latter without issues with the installed cmake file.. - simplify conditions bit to make it tad more readable - Version update to 1.17.0 Security: * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing * Avoid theoretical buffer overflow in RC4 loop comparison * Empty hquery->name could lead to invalid memory access * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in (bsc#1178882, CVE-2020-8277) Changes: * Update help information for adig, acountry, and ahost * Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers * Detect remote DNS server does not support EDNS using rules from RFC 6891 * Source tree has been reorganized to use a more modern layout * Allow parsing of CAA Resource Record Bug fixes: * readaddrinfo bad sizeof() * Test cases should honor HAVE_WRITEV flag, not depend on WIN32 * FQDN with trailing period should be queried first * ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints. * ares_gethostbyname() with AF_UNSPEC and an ip address would fail * Properly document ares_set_local_ip4() uses host byte order For details, see https://c-ares.haxx.se/changelog.html - add missing upstream sources, to be removed for next release - remove unnecessary BuildRequires - fix building on SLE12 systems - ares_dns.h, missing_header.patch: re-add missing header in last release - add BR for pkg-config to get the provides in the devel package - update to 1.17.1: Travis: add iOS target built with CMake (#378) Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake. - fix build External projects were using non-public header ares_dns.h, make public again (#376) It appears some outside projects were relying on macros in ares_dns.h, even though it doesn't appear that header was ever meant to be public. That said, we don't want to break external integrators so we should distribute this header again. - note that so versioning has moved to configure.ac - note about 1.17.1 - fix sed gone wrong autotools cleanup (#372) * buildconf: remove custom logic with autoreconf - remove missing_header.patch (upstream) - update to 1.17.2: Security: * When building c-ares with CMake, the RANDOM_FILE would not be set and therefore downgrade to the less secure random number generator * If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause a crash * Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response * Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing follow-up (bsc#1188881, CVE-2021-3672) * Perform validation on hostnames to prevent possible XSS due to applications not performing valiation themselves Changes: * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases Bug fixes: * Building tests should not force building of static libraries except on Windows * Relative headers must use double quotes to prevent pulling in a system library for details see, https://c-ares.haxx.se/changelog.html#1_17_2 - 5c995d5.patch: augment input validation on hostnames to allow _ as part of DNS response (bsc#1190225) - new upstream website - drop multibuild - tests do not require static library anymore - spec file cleanup - drop sources that were re-added to upstream distibution (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake) - update to 1.18.1. Changes since 1.17.2: * Allow '/' as a valid character for a returned name for CNAME in-addr.arpa delegation * no longer forwards requests for localhost resolution per RFC6761 * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the search process will continue to the next domain in the search. * Provide ares_nameser.h as a public interface as needed by NodeJS * Add support for URI(Uniform Resource Identifier) records via ares_parse_uri_reply() - disable unit tests for SLE12 since GCC compiler too old to build unit tests - 5c995d5.patch: upstreamed - disable-live-tests.patch: refreshed - Update to version 1.19.0 Security: * Low. Stack overflow in ares_set_sortlist() which is used during c-ares initialization and typically provided by an administrator and not an end user. (bsc#1208067, CVE-2022-4904) Changes: * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for specifying a custom hosts file location. Bug fixes: * Fix memory leak in reading /etc/hosts when using localhost fallback. * Fix chain building c-ares when libresolv is already included by another project. * File lookup should not immediately abort as there may be other tries due to search criteria. * Asterisks should be allowed in host validation as CNAMEs may reference wildcard domains. * AutoTools build system referenced bad STDC_HEADERS macro. * Even if one address class returns a failure for ares_getaddrinfo() we should still return the results we have. * Fix ares_getaddrinfo() numerical address resolution with AF_UNSPEC * Fix tools and help information. * Various documentation fixes and cleanups. * Add include guards to ares_data.h * c-ares could try to exceed maximum number of iovec entries supported by system. * The RFC6761 6.3 states localhost subdomains must be offline too - Update to version 1.19.1 Security: * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service (bsc#1211604) * CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS query IDs (bsc#1211605) * CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() (bsc#1211606) * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation (bsc#1211607) Bug fixes: * Fix uninitialized memory warning in test * ares_getaddrinfo() should allow a port of 0 * Fix memory leak in ares_send() on error * Fix comment style in ares_data.h * Fix typo in ares_init_options.3 * Sync ax_pthread.m4 with upstream * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support - CVE-2024-25629.patch: fix out of bounds read in ares__read_line() (bsc#1220279, CVE-2024-25629) - Add upstream patches with the ares_getaddrinfo function: * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch * 0007-getaddrinfo-enhancements-257.patch * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch - Add a patch which disables test failing on OBS (but passing in local environment): * 0010-Disable-failing-test.patch - Update to upstream snapshot 20191108 * getaddrinfo - avoid infinite loop in case of NXDOMAIN * ares_getenv - return NULL in all cases * implement ares_getaddrinfo - onion-crash.patch: removed, upstreamed. - removed upstream patches that are part of the snapshot: 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch 0007-getaddrinfo-enhancements-257.patch 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch 0010-Disable-failing-test.patch - disable-live-tests.patch - updated - Fix version number of the snapshot to not be downgrade: bsc#1156601 - Switch to cmake-based build. Some packages need the cmake build files. - Add netcfg as the build requirement and runtime requirement. ares_getaddrinfo function uses the getservbyport_r function which requires the /etc/services file to function properly. That config file is provided by the netcfg package. Unit tests rely on it too, hence it has to be a build dependency as well. - Upgrade to latest snapshot from 2020-01-17 - disable-live-tests.patch: refreshed - regression.patch: fix a regression in DNS results that contain both A and AAAA answers. - Version update to 1.16.1 Security: * Prevent possible use-after-free and double-free in ares_getaddrinfo() if ares_destroy() is called prior to ares_getaddrinfo() completing. Reported by Jann Horn at Google Project Zero. Changes: * Allow TXT records on CHAOS qclass. Used for retriving things like version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3] Bug fixes: * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1] * Silence false cast-align compiler warnings due to valid casts of struct sockaddr to struct sockaddr_in and struct sockaddr_in6. * MacOS should use libresolv for retrieving DNS servers, like iOS * CMake build system should populate the INCLUDE_DIRECTORIES property of installed targets [2] * Correct macros in use for the ares_getaddrinfo.3 man page - Changes in version 1.16.0 Changes: * Introduction of ares_getaddrinfo() API which provides similar output (including proper sorting as per RFC 6724) to the system native API, but utilizes different data structures in order to provide additional information such as TTLs and all aliases. Please reference the respective man pages for usage details. * Parse SOA records from ns_t_any response * CMake: Provide c-ares version in package export file * CMake: Add CPACK functionality for DEB and RPM * CMake: Generate PDB files during build * CMake: Support manpage installation Bug fixes: * Fix bad expectation in IPv6 localhost test. * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to prevent complaints about CPPFLAGS in CFLAGS. * Fix .onion handling * Command line usage was out of date for adig and ahost. * Typos in manpages * If ares_getenv is defined, it must return a value on all platforms * If /etc/resolv.conf has invalid lookup values, use the defaults. * Tests: Separate live tests from SetServers* tests as only live tests should require internet access. * ares_gethostbyname() should return ENODATA if no valid A or AAAA record is found, but a CNAME was found. * CMake: Rework library function checking to prevent unintended linking with system libraries that aren't needed. * Due to use of inet_addr() it was not possible to return 255.255.255.255 from ares_gethostbyname(). * CMake: Fix building of tests on Windows - Drop regression.patch which have been fixed upstream - Refresh disable-live-tests.patch - Remove static lib since its required when doing tests and we dont want it included in package - Run spec-cleaner - Implement multibuild specfile to split out tests into its own flavor; this way we can build and run tests, which require static lib, as well as avoid packaging the latter without issues with the installed cmake file.. - simplify conditions bit to make it tad more readable - Version update to 1.17.0 Security: * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing * Avoid theoretical buffer overflow in RC4 loop comparison * Empty hquery->name could lead to invalid memory access * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in (bsc#1178882, CVE-2020-8277) Changes: * Update help information for adig, acountry, and ahost * Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers * Detect remote DNS server does not support EDNS using rules from RFC 6891 * Source tree has been reorganized to use a more modern layout * Allow parsing of CAA Resource Record Bug fixes: * readaddrinfo bad sizeof() * Test cases should honor HAVE_WRITEV flag, not depend on WIN32 * FQDN with trailing period should be queried first * ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints. * ares_gethostbyname() with AF_UNSPEC and an ip address would fail * Properly document ares_set_local_ip4() uses host byte order For details, see https://c-ares.haxx.se/changelog.html - add missing upstream sources, to be removed for next release - remove unnecessary BuildRequires - fix building on SLE12 systems - ares_dns.h, missing_header.patch: re-add missing header in last release - add BR for pkg-config to get the provides in the devel package - update to 1.17.1: Travis: add iOS target built with CMake (#378) Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake. - fix build External projects were using non-public header ares_dns.h, make public again (#376) It appears some outside projects were relying on macros in ares_dns.h, even though it doesn't appear that header was ever meant to be public. That said, we don't want to break external integrators so we should distribute this header again. - note that so versioning has moved to configure.ac - note about 1.17.1 - fix sed gone wrong autotools cleanup (#372) * buildconf: remove custom logic with autoreconf - remove missing_header.patch (upstream) - update to 1.17.2: Security: * When building c-ares with CMake, the RANDOM_FILE would not be set and therefore downgrade to the less secure random number generator * If ares_getaddrinfo() was terminated by an ares_destroy(), it would cause a crash * Crash in sortaddrinfo() if the list size equals 0 due to an unexpected DNS response * Expand number of escaped characters in DNS replies as per RFC1035 5.1 to prevent spoofing follow-up (bsc#1188881, CVE-2021-3672) * Perform validation on hostnames to prevent possible XSS due to applications not performing valiation themselves Changes: * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases Bug fixes: * Building tests should not force building of static libraries except on Windows * Relative headers must use double quotes to prevent pulling in a system library for details see, https://c-ares.haxx.se/changelog.html#1_17_2 - 5c995d5.patch: augment input validation on hostnames to allow _ as part of DNS response (bsc#1190225) - new upstream website - drop multibuild - tests do not require static library anymore - spec file cleanup - drop sources that were re-added to upstream distibution (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake) - update to 1.18.1. Changes since 1.17.2: * Allow '/' as a valid character for a returned name for CNAME in-addr.arpa delegation * no longer forwards requests for localhost resolution per RFC6761 * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so that the search process will continue to the next domain in the search. * Provide ares_nameser.h as a public interface as needed by NodeJS * Add support for URI(Uniform Resource Identifier) records via ares_parse_uri_reply() - disable unit tests for SLE12 since GCC compiler too old to build unit tests - 5c995d5.patch: upstreamed - disable-live-tests.patch: refreshed - Update to version 1.19.0 Security: * Low. Stack overflow in ares_set_sortlist() which is used during c-ares initialization and typically provided by an administrator and not an end user. (bsc#1208067, CVE-2022-4904) Changes: * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for specifying a custom hosts file location. Bug fixes: * Fix memory leak in reading /etc/hosts when using localhost fallback. * Fix chain building c-ares when libresolv is already included by another project. * File lookup should not immediately abort as there may be other tries due to search criteria. * Asterisks should be allowed in host validation as CNAMEs may reference wildcard domains. * AutoTools build system referenced bad STDC_HEADERS macro. * Even if one address class returns a failure for ares_getaddrinfo() we should still return the results we have. * Fix ares_getaddrinfo() numerical address resolution with AF_UNSPEC * Fix tools and help information. * Various documentation fixes and cleanups. * Add include guards to ares_data.h * c-ares could try to exceed maximum number of iovec entries supported by system. * The RFC6761 6.3 states localhost subdomains must be offline too - Update to version 1.19.1 Security: * CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service (bsc#1211604) * CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS query IDs (bsc#1211605) * CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton() (bsc#1211606) * CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during cross compilation (bsc#1211607) Bug fixes: * Fix uninitialized memory warning in test * ares_getaddrinfo() should allow a port of 0 * Fix memory leak in ares_send() on error * Fix comment style in ares_data.h * Fix typo in ares_init_options.3 * Sync ax_pthread.m4 with upstream * Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support - CVE-2024-25629.patch: fix out of bounds read in ares__read_line() (bsc#1220279, CVE-2024-25629) - Update to version 1.4.1: + Bugfixes: - Add back the meson -Denable-systemd=false configure argument. - Add the fallback rules for older PolicyKit versions. - Define PATH_MAX if not available. - Enable C99 support in meson.build. - Include all the files in the GIR target. - Include the correct file when using Colord-1.0.gir. - Use appropriate feature macro for realpath(). - Use gio-2.0 when generating the VAPI. - Changes from version 1.4.0: + New Features: - Port to the Meson build system. - Enable Travis CI for Fedora 25 and Debian Stretch. - Make PolicyKit, gusb and udev a hard requirement. + Bugfixes: - Add some experimental tools for the HueyCOLOR sensor as found in the P70. - Conditionally build documentation and man pages. - Correctly build the ICC transfer curve for Rec709. - Do not build the examples as part of the regular build. - Do not spin the Huey LEDs when the sensor is embedded. - Do not use /tmp to create profiles. - Fix the version numbers in cd-version.h to reflect reality. - Get the Huey status before trying to unlock. - Use a different Huey unlock code on the W700 laptop. - Add meson BuildRequires, and switch autotools macros configure, make and makeinstall to meson, meson_build and meson_install following upstream switch to Meson Build System. - Add gtk-doc and docbook-utils BuildRequires: new dependencies. - Drop %glib2_gsettings_schema_* post/postun macros: the functionality is now covered by file triggers. - Drop intltool and vala BuildRequires: no longer needed. - Upstream rename of ColorHug-1.0.typelib file to Colorhug-1.0.typelib, thus its package has been renamed as well. - Add pkgconfig(vapigen) BuildRequires and pass enable-session-example=false, enable-bash-completion=true, enable-systemd=true, enable-libcolordcompat=true, enable-argyllcms-sensor=true, enable-reverse=false, enable-sane=false, enable-vala=true, enable-print-profiles=true, enable-tests=false, enable-installed-tests=false, with-daemon-user=colord, enable-man=true and enable-docs=true to meson, ensure we build the feature we want. - Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so that colprof is forced to work in chunks when generating the print profile rather than trying to allocate a 3.1 GiB chunk of RAM to put the entire B-to-A tables in. - Update package summaries. Replace old RPM shell variables. - Collapse files section for gtk-doc. - Modernize spec-file by calling spec-cleaner - Update to version 1.4.2: + New Features: - Add cd_icc_set_created. - Add --enable-timestamps option for CREATED header. + Bugfixes: - Avoid buffer overflow when reading profile_id. - Fix the detection of duplicate EDIDs. - Make udev hwdb optional by using pnp.ids as fallback. - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD. - Refactor build directory selection. - Set cd-create-profile date to SOURCE_DATE_EPOCH. - Pass new option enable-udev-rules=true to meson. - Update to version 1.4.3: + Bugfixes: - Make cd_color_get_blackbody_rgb_full safer. - Update style of Meson build options. - Update warning about running daemon as root. - Update options passed to meson following upstream changes. - Fix meson parameters: -Dargyllcms-sensor=true must be - Dargyllcms_sensor=true (boo#1124388). - Change BuildRequires to docbook-utils-minimal, otherwise the build pulls in half of texlive and all its dependencies. Only man pages and HTML API docs are generated, no need for PS/PDF generation. - Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230) - Update to version 1.4.4: + New Features: - Actually install the installed tests. - Allow building without the daemon. + Bugfixes: - Consistently search for spotread in $PATH. - Don't hard-require spotread to build argyll sensor. - Fix linker argument checks. - Include C header in Colorhug-1.0.gir. - Pass -DCD_COMPILATION to gir compiler. - Port manpages to xsltproc and DocBook 5. - Replace docbook-utils-minimal with docbook5-xsl-stylesheets BuildRequires following upstreams port. - Add _constraints file, avoid random buildfails for i586 and other arches. - Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5). - Move colord-session.service and tmpfiles config from libcolord-devel to colord package. - No longer recommend -lang: supplements are in use - Update to version 1.4.5: + New Features: - Add cd_icc_create_default_full - Add cd_icc_utils_get_adaptation_matrix - Add cd_mat33_is_finite - Add support for datacolor SpyderX + Bugfixes: - Check for errors from more sqlite calls - Fix cd_icc_load_data() annotation for the data array - Fix cd-sensor-dummy - Fix more annotation for data arrays - Fix owner and permissions on existing state files - Fix segfault due to dereferencing NULL pointer - Make the build reproductible - Refactor opening of mapping database and try again if fails - Drop add-spyderx.patch: Included upstream in new release. - allow access to /usr/local/share/color in AppArmor profile (boo#1180898) - Change to systemd-sysusers - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_colord.service.patch - Add colord-CVE-2021-42523.patch: fix a small memory leak in sqlite3_exec (boo#1202802 CVE-2021-42523). - Remove script in %pre to change ownership of /var/lib/colord (bsc#1208056). - Update to version 1.4.1: + Bugfixes: - Add back the meson -Denable-systemd=false configure argument. - Add the fallback rules for older PolicyKit versions. - Define PATH_MAX if not available. - Enable C99 support in meson.build. - Include all the files in the GIR target. - Include the correct file when using Colord-1.0.gir. - Use appropriate feature macro for realpath(). - Use gio-2.0 when generating the VAPI. - Changes from version 1.4.0: + New Features: - Port to the Meson build system. - Enable Travis CI for Fedora 25 and Debian Stretch. - Make PolicyKit, gusb and udev a hard requirement. + Bugfixes: - Add some experimental tools for the HueyCOLOR sensor as found in the P70. - Conditionally build documentation and man pages. - Correctly build the ICC transfer curve for Rec709. - Do not build the examples as part of the regular build. - Do not spin the Huey LEDs when the sensor is embedded. - Do not use /tmp to create profiles. - Fix the version numbers in cd-version.h to reflect reality. - Get the Huey status before trying to unlock. - Use a different Huey unlock code on the W700 laptop. - Add meson BuildRequires, and switch autotools macros configure, make and makeinstall to meson, meson_build and meson_install following upstream switch to Meson Build System. - Add gtk-doc and docbook-utils BuildRequires: new dependencies. - Drop %glib2_gsettings_schema_* post/postun macros: the functionality is now covered by file triggers. - Drop intltool and vala BuildRequires: no longer needed. - Upstream rename of ColorHug-1.0.typelib file to Colorhug-1.0.typelib, thus its package has been renamed as well. - Add pkgconfig(vapigen) BuildRequires and pass enable-session-example=false, enable-bash-completion=true, enable-systemd=true, enable-libcolordcompat=true, enable-argyllcms-sensor=true, enable-reverse=false, enable-sane=false, enable-vala=true, enable-print-profiles=true, enable-tests=false, enable-installed-tests=false, with-daemon-user=colord, enable-man=true and enable-docs=true to meson, ensure we build the feature we want. - Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so that colprof is forced to work in chunks when generating the print profile rather than trying to allocate a 3.1 GiB chunk of RAM to put the entire B-to-A tables in. - Update package summaries. Replace old RPM shell variables. - Collapse files section for gtk-doc. - Modernize spec-file by calling spec-cleaner - Update to version 1.4.2: + New Features: - Add cd_icc_set_created. - Add --enable-timestamps option for CREATED header. + Bugfixes: - Avoid buffer overflow when reading profile_id. - Fix the detection of duplicate EDIDs. - Make udev hwdb optional by using pnp.ids as fallback. - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD. - Refactor build directory selection. - Set cd-create-profile date to SOURCE_DATE_EPOCH. - Pass new option enable-udev-rules=true to meson. - Update to version 1.4.3: + Bugfixes: - Make cd_color_get_blackbody_rgb_full safer. - Update style of Meson build options. - Update warning about running daemon as root. - Update options passed to meson following upstream changes. - Fix meson parameters: -Dargyllcms-sensor=true must be - Dargyllcms_sensor=true (boo#1124388). - Change BuildRequires to docbook-utils-minimal, otherwise the build pulls in half of texlive and all its dependencies. Only man pages and HTML API docs are generated, no need for PS/PDF generation. - Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230) - Update to version 1.4.4: + New Features: - Actually install the installed tests. - Allow building without the daemon. + Bugfixes: - Consistently search for spotread in $PATH. - Don't hard-require spotread to build argyll sensor. - Fix linker argument checks. - Include C header in Colorhug-1.0.gir. - Pass -DCD_COMPILATION to gir compiler. - Port manpages to xsltproc and DocBook 5. - Replace docbook-utils-minimal with docbook5-xsl-stylesheets BuildRequires following upstreams port. - Add _constraints file, avoid random buildfails for i586 and other arches. - Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5). - Move colord-session.service and tmpfiles config from libcolord-devel to colord package. - No longer recommend -lang: supplements are in use - Update to version 1.4.5: + New Features: - Add cd_icc_create_default_full - Add cd_icc_utils_get_adaptation_matrix - Add cd_mat33_is_finite - Add support for datacolor SpyderX + Bugfixes: - Check for errors from more sqlite calls - Fix cd_icc_load_data() annotation for the data array - Fix cd-sensor-dummy - Fix more annotation for data arrays - Fix owner and permissions on existing state files - Fix segfault due to dereferencing NULL pointer - Make the build reproductible - Refactor opening of mapping database and try again if fails - Drop add-spyderx.patch: Included upstream in new release. - allow access to /usr/local/share/color in AppArmor profile (boo#1180898) - Change to systemd-sysusers - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_colord.service.patch - Add colord-CVE-2021-42523.patch: fix a small memory leak in sqlite3_exec (boo#1202802 CVE-2021-42523). - Remove script in %pre to change ownership of /var/lib/colord (bsc#1208056). - Update to version 1.4.1: + Bugfixes: - Add back the meson -Denable-systemd=false configure argument. - Add the fallback rules for older PolicyKit versions. - Define PATH_MAX if not available. - Enable C99 support in meson.build. - Include all the files in the GIR target. - Include the correct file when using Colord-1.0.gir. - Use appropriate feature macro for realpath(). - Use gio-2.0 when generating the VAPI. - Changes from version 1.4.0: + New Features: - Port to the Meson build system. - Enable Travis CI for Fedora 25 and Debian Stretch. - Make PolicyKit, gusb and udev a hard requirement. + Bugfixes: - Add some experimental tools for the HueyCOLOR sensor as found in the P70. - Conditionally build documentation and man pages. - Correctly build the ICC transfer curve for Rec709. - Do not build the examples as part of the regular build. - Do not spin the Huey LEDs when the sensor is embedded. - Do not use /tmp to create profiles. - Fix the version numbers in cd-version.h to reflect reality. - Get the Huey status before trying to unlock. - Use a different Huey unlock code on the W700 laptop. - Add meson BuildRequires, and switch autotools macros configure, make and makeinstall to meson, meson_build and meson_install following upstream switch to Meson Build System. - Add gtk-doc and docbook-utils BuildRequires: new dependencies. - Drop %glib2_gsettings_schema_* post/postun macros: the functionality is now covered by file triggers. - Drop intltool and vala BuildRequires: no longer needed. - Upstream rename of ColorHug-1.0.typelib file to Colorhug-1.0.typelib, thus its package has been renamed as well. - Add pkgconfig(vapigen) BuildRequires and pass enable-session-example=false, enable-bash-completion=true, enable-systemd=true, enable-libcolordcompat=true, enable-argyllcms-sensor=true, enable-reverse=false, enable-sane=false, enable-vala=true, enable-print-profiles=true, enable-tests=false, enable-installed-tests=false, with-daemon-user=colord, enable-man=true and enable-docs=true to meson, ensure we build the feature we want. - Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so that colprof is forced to work in chunks when generating the print profile rather than trying to allocate a 3.1 GiB chunk of RAM to put the entire B-to-A tables in. - Update package summaries. Replace old RPM shell variables. - Collapse files section for gtk-doc. - Modernize spec-file by calling spec-cleaner - Update to version 1.4.2: + New Features: - Add cd_icc_set_created. - Add --enable-timestamps option for CREATED header. + Bugfixes: - Avoid buffer overflow when reading profile_id. - Fix the detection of duplicate EDIDs. - Make udev hwdb optional by using pnp.ids as fallback. - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD. - Refactor build directory selection. - Set cd-create-profile date to SOURCE_DATE_EPOCH. - Pass new option enable-udev-rules=true to meson. - Update to version 1.4.3: + Bugfixes: - Make cd_color_get_blackbody_rgb_full safer. - Update style of Meson build options. - Update warning about running daemon as root. - Update options passed to meson following upstream changes. - Fix meson parameters: -Dargyllcms-sensor=true must be - Dargyllcms_sensor=true (boo#1124388). - Change BuildRequires to docbook-utils-minimal, otherwise the build pulls in half of texlive and all its dependencies. Only man pages and HTML API docs are generated, no need for PS/PDF generation. - Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230) - Update to version 1.4.4: + New Features: - Actually install the installed tests. - Allow building without the daemon. + Bugfixes: - Consistently search for spotread in $PATH. - Don't hard-require spotread to build argyll sensor. - Fix linker argument checks. - Include C header in Colorhug-1.0.gir. - Pass -DCD_COMPILATION to gir compiler. - Port manpages to xsltproc and DocBook 5. - Replace docbook-utils-minimal with docbook5-xsl-stylesheets BuildRequires following upstreams port. - Add _constraints file, avoid random buildfails for i586 and other arches. - Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5). - Move colord-session.service and tmpfiles config from libcolord-devel to colord package. - No longer recommend -lang: supplements are in use - Update to version 1.4.5: + New Features: - Add cd_icc_create_default_full - Add cd_icc_utils_get_adaptation_matrix - Add cd_mat33_is_finite - Add support for datacolor SpyderX + Bugfixes: - Check for errors from more sqlite calls - Fix cd_icc_load_data() annotation for the data array - Fix cd-sensor-dummy - Fix more annotation for data arrays - Fix owner and permissions on existing state files - Fix segfault due to dereferencing NULL pointer - Make the build reproductible - Refactor opening of mapping database and try again if fails - Drop add-spyderx.patch: Included upstream in new release. - allow access to /usr/local/share/color in AppArmor profile (boo#1180898) - Change to systemd-sysusers - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_colord.service.patch - Add colord-CVE-2021-42523.patch: fix a small memory leak in sqlite3_exec (boo#1202802 CVE-2021-42523). - Remove script in %pre to change ownership of /var/lib/colord (bsc#1208056). - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Add missing comma to previous change - Add missing Requires(post): sed, fixes boo#1200524 - Make %post compatible with dash - Use $() again in %post, but with a space for POSIX compliance - Resync containers.conf / storage.conf with Fedora - Create /etc/containers/registries.conf.d and add 000-shortnames.conf to it. - Fix obvious typo in containers.conf - set detached sigstore attachments for the SUSE controlled registries - postinstall script: slight cleanup, no functional change - add container-storage-driver.sh (bsc#1197093) - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - Add missing comma to previous change - Add missing Requires(post): sed, fixes boo#1200524 - Make %post compatible with dash - Use $() again in %post, but with a space for POSIX compliance - Resync containers.conf / storage.conf with Fedora - Create /etc/containers/registries.conf.d and add 000-shortnames.conf to it. - Fix obvious typo in containers.conf - set detached sigstore attachments for the SUSE controlled registries - postinstall script: slight cleanup, no functional change - add container-storage-driver.sh (bsc#1197093) - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Enforce BCI verification via Podman on openSUSE distributions using the already shipped container signing keys. (bsc#1197030) - Resolve choice on openSUSE distributions for libcontainer-policy by suggesting the libcontainers-openSUSE-policy explicitly. - Remove unused grep requirement - Disable CNI related configs on ALP (bsc#1213556) (https://github.com/containers/podman/issues/19327) - New release 20230814 - bump c/storage to 1.48.0 * Bump to v1.47.0 * Fix error if continueWrite/continueRead pipe open fails * pkg/regexp: make sure that &Regexp implements the interfaces * Remove use of fillGo18FileTypeBits - bump c/image to 5.27.0 * fix(deps): update module github.com/docker/docker to v23.0.3+incompatible * fix(deps): update module golang.org/x/term to v0.7.0 * fix(deps): update module github.com/klauspost/compress to v1.16.4 * fix(deps): update module github.com/sigstore/sigstore to v1.6.1 * chore(deps): update dependency containers/automation_images to v20230405 * fix(deps): update module golang.org/x/crypto to v0.8.0 * fix(deps): update module golang.org/x/oauth2 to v0.7.0 * fix(deps): update module github.com/containers/storage to v1.46.1 * fix(deps): update module github.com/sigstore/sigstore to v1.6.2 * Don't completely silently ignore non-OCI manifests in OCI layouts * fix(deps): update module github.com/klauspost/compress to v1.16.5 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * fix(deps): update module github.com/docker/docker to v23.0.4+incompatible - bump c/common to 0.55.3 * Change default image volume mode to "nullfs" on FreeBSD * [v0.55][CI-DOCS] remove zstd:chunked from docs * libimage: harden lookup by digest * libimage: HasDifferentDigest: add InsecureSkipTLSVerify option - New release 20230913 - bump c/image to 5.28.0 * Bump to v5.26.0 * fix(deps): update module github.com/sigstore/rekor to v1.2.2 * fix(deps): update module github.com/sigstore/fulcio to v1.3.2 * Adding IO decorator to copy progress bar * Ensure we close HTTP connections on all paths * fix(deps): update module github.com/containers/storage to v1.48.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * fix(deps): update github.com/cyberphone/json-canonicalization digest to 91eb5f1 * fix(deps): update golang.org/x/exp digest to 97b1e66 * fix(deps): update module github.com/klauspost/compress to v1.16.7 * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * fix(deps): update module golang.org/x/oauth2 to v0.10.0 * manifest: ListUpdate add imgspecv1.Platform field * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * pkg/docker: use the same default auth path as macOS on FreeBSD * fix(deps): update module github.com/sigstore/fulcio to v1.3.4 * blob: TryReusingBlobWithOptions consider RequiredCompression if set * Fix tests of the ostree transport * helpers_test,cleanup: correct argument order * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Make temporary names container/image specific * listupdate,oci: instance show read-only annotations and CompressionAlgorithmNames * fix(deps): update module github.com/docker/docker-credential-helpers to v0.8.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Fix TestOCI1IndexChooseInstanc * Refactor data passing in c/image/copy * Update module github.com/sigstore/fulcio to v1.4.0 * copy/multiple: instanceCopyCopy honor UpdateCompressionAlgorithms * Update vendor of containers/storage * copy/single: accept custom *Options and wrap arguments in copySingleImageOptions * Improve transport documentation * fix(deps): update module github.com/vbatts/tar-split to v0.11.5 * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * copy: implement instanceCopyClone for zstd compression * copy/multiple: priority of instanceCopyCopy must be higher than instanceCopyClone * Clarify where mirrors are used * fix(deps): update github.com/cyberphone/json-canonicalization digest to aa7fe85 * fix(deps): update github.com/containers/storage digest to c3da76f * Update x/exp/slices, and some small slice-related cleanups * Use consistent example domains in #2069 * copy: add support for ForceCompressionFormat * fix(deps): update module golang.org/x/term to v0.11.0 * fix(deps): update module golang.org/x/crypto to v0.12.0 * fix(deps): update module golang.org/x/oauth2 to v0.11.0 * [release-5.27] Preparing 5.27 backport * Update to Go 1.19 * storage.storageImageDestination.Commit(): leverage image options * Rename SKOPEO_CI_TAG to SKOPEO_CI_BRANCH * [CI:DOCS] Add cirrus-cron retry/monitor jobs * chore(deps): update dependency containers/automation_images to v20230807 * [release-5.27] Fix the branch we use for determining a git-validation starting point * fix(deps): update golang.org/x/exp digest to 352e893 * fix(deps): update module github.com/sigstore/sigstore to v1.7.2 * OCI image-spec / distribution-spec v1.1 updates, first round * fix(deps): update module github.com/sylabs/sif/v2 to v2.12.0 * chore(deps): update dependency containers/automation_images to v20230809 * Merge release branch into main * BREAKING: Update for move of github.com/theupdateframework/go-tuf/encrypted * Update module github.com/containers/ocicrypt to v1.1.8 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/containers/storage to v1.49.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.13.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.1 * fix(deps): update golang.org/x/exp digest to d852ddb * fix(deps): update module golang.org/x/term to v0.12.0 * fix(deps): update module github.com/sigstore/sigstore to v1.7.3 * fix removal of temp file in GetBlob on Windows * fix(deps): update module golang.org/x/crypto to v0.13.0 * Fix build with golangci-lint 1.54.2 * fix(deps): update module golang.org/x/oauth2 to v0.12.0 * Implement, and default to, a SQLite BlobInfoCache instead of BoltDB * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * Update dependencies of docker/docker * Correctly handle encryption/decryption changes in non-OCI formats * chore(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 [security] * fix(deps): update module github.com/containers/storage to v1.50.1 - bump c/storage to 1.50.2 * Bump to v1.50.1 * Add an OWNERS file for the merge bot to refer to - bump c/common to 0.55.4 * Bump c/image to v0.55.3 - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - New release 20231204 - bump c/common to 0.57.0 * Bump to v0.56.0 by * Fix typo in comment * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Fix specification of unix:///run * libimage/layer_tree: if parent is empty and a manifest list then ignore check. * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Split up util package into pkg/password, pkg/copy, pkg/version * Remove ActiveDestination method to move into podman * Default machine CPUs to Cores/2 * pkg/config: do NOT set StaticDir and VolumeDir * Implement negated label match function * chore: import packages only once * CoC: fix email link - bump c/storage to 1.51.0 * Bump to v1.50.2 * overlay, composefs: mount loop device RO * Run codespell on code * fix(deps): update module github.com/klauspost/compress to v1.17.0 * store: serialize container deletion * pkg/system: reduce retry timeout for EnsureRemoveAll * overlay, composefs: use data-only lower layers * store: call RecordWrite() before graphDriver Cleanup() * fix(deps): update module golang.org/x/sys to v0.13.0 - bump c/image to 5.29.0 * Bump to v5.28.0 * fix(deps): update module github.com/containers/storage to v1.50.2 * Run codespell on code * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Use constants and types from opencontainers/image-spec/specs-go/v1 * progress: set Current before Refill * copy: fix nil pointer dereference when checking compression algorithm * fix(deps): update module github.com/klauspost/compress to v1.17.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.14.0 * ociarchive: Add new ArchiveFileNotFoundError - New release 20240206 - bump bundled c/common to 0.57.4 - bump bundled c/image to 0.29.2 - conditionally require libcontainers-sles-mounds for product(SLE-Micro) as well (SLE Micro 6.0 now no longer provides product(SUSE_SLE) and instead only provides product(SLE-Micro)), fixes bsc#1216443 - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Enforce BCI verification via Podman on openSUSE distributions using the already shipped container signing keys. (bsc#1197030) - Resolve choice on openSUSE distributions for libcontainer-policy by suggesting the libcontainers-openSUSE-policy explicitly. - Remove unused grep requirement - Disable CNI related configs on ALP (bsc#1213556) (https://github.com/containers/podman/issues/19327) - New release 20230814 - bump c/storage to 1.48.0 * Bump to v1.47.0 * Fix error if continueWrite/continueRead pipe open fails * pkg/regexp: make sure that &Regexp implements the interfaces * Remove use of fillGo18FileTypeBits - bump c/image to 5.27.0 * fix(deps): update module github.com/docker/docker to v23.0.3+incompatible * fix(deps): update module golang.org/x/term to v0.7.0 * fix(deps): update module github.com/klauspost/compress to v1.16.4 * fix(deps): update module github.com/sigstore/sigstore to v1.6.1 * chore(deps): update dependency containers/automation_images to v20230405 * fix(deps): update module golang.org/x/crypto to v0.8.0 * fix(deps): update module golang.org/x/oauth2 to v0.7.0 * fix(deps): update module github.com/containers/storage to v1.46.1 * fix(deps): update module github.com/sigstore/sigstore to v1.6.2 * Don't completely silently ignore non-OCI manifests in OCI layouts * fix(deps): update module github.com/klauspost/compress to v1.16.5 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * fix(deps): update module github.com/docker/docker to v23.0.4+incompatible - bump c/common to 0.55.3 * Change default image volume mode to "nullfs" on FreeBSD * [v0.55][CI-DOCS] remove zstd:chunked from docs * libimage: harden lookup by digest * libimage: HasDifferentDigest: add InsecureSkipTLSVerify option - New release 20230913 - bump c/image to 5.28.0 * Bump to v5.26.0 * fix(deps): update module github.com/sigstore/rekor to v1.2.2 * fix(deps): update module github.com/sigstore/fulcio to v1.3.2 * Adding IO decorator to copy progress bar * Ensure we close HTTP connections on all paths * fix(deps): update module github.com/containers/storage to v1.48.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * fix(deps): update github.com/cyberphone/json-canonicalization digest to 91eb5f1 * fix(deps): update golang.org/x/exp digest to 97b1e66 * fix(deps): update module github.com/klauspost/compress to v1.16.7 * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * fix(deps): update module golang.org/x/oauth2 to v0.10.0 * manifest: ListUpdate add imgspecv1.Platform field * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * pkg/docker: use the same default auth path as macOS on FreeBSD * fix(deps): update module github.com/sigstore/fulcio to v1.3.4 * blob: TryReusingBlobWithOptions consider RequiredCompression if set * Fix tests of the ostree transport * helpers_test,cleanup: correct argument order * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Make temporary names container/image specific * listupdate,oci: instance show read-only annotations and CompressionAlgorithmNames * fix(deps): update module github.com/docker/docker-credential-helpers to v0.8.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Fix TestOCI1IndexChooseInstanc * Refactor data passing in c/image/copy * Update module github.com/sigstore/fulcio to v1.4.0 * copy/multiple: instanceCopyCopy honor UpdateCompressionAlgorithms * Update vendor of containers/storage * copy/single: accept custom *Options and wrap arguments in copySingleImageOptions * Improve transport documentation * fix(deps): update module github.com/vbatts/tar-split to v0.11.5 * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * copy: implement instanceCopyClone for zstd compression * copy/multiple: priority of instanceCopyCopy must be higher than instanceCopyClone * Clarify where mirrors are used * fix(deps): update github.com/cyberphone/json-canonicalization digest to aa7fe85 * fix(deps): update github.com/containers/storage digest to c3da76f * Update x/exp/slices, and some small slice-related cleanups * Use consistent example domains in #2069 * copy: add support for ForceCompressionFormat * fix(deps): update module golang.org/x/term to v0.11.0 * fix(deps): update module golang.org/x/crypto to v0.12.0 * fix(deps): update module golang.org/x/oauth2 to v0.11.0 * [release-5.27] Preparing 5.27 backport * Update to Go 1.19 * storage.storageImageDestination.Commit(): leverage image options * Rename SKOPEO_CI_TAG to SKOPEO_CI_BRANCH * [CI:DOCS] Add cirrus-cron retry/monitor jobs * chore(deps): update dependency containers/automation_images to v20230807 * [release-5.27] Fix the branch we use for determining a git-validation starting point * fix(deps): update golang.org/x/exp digest to 352e893 * fix(deps): update module github.com/sigstore/sigstore to v1.7.2 * OCI image-spec / distribution-spec v1.1 updates, first round * fix(deps): update module github.com/sylabs/sif/v2 to v2.12.0 * chore(deps): update dependency containers/automation_images to v20230809 * Merge release branch into main * BREAKING: Update for move of github.com/theupdateframework/go-tuf/encrypted * Update module github.com/containers/ocicrypt to v1.1.8 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/containers/storage to v1.49.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.13.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.1 * fix(deps): update golang.org/x/exp digest to d852ddb * fix(deps): update module golang.org/x/term to v0.12.0 * fix(deps): update module github.com/sigstore/sigstore to v1.7.3 * fix removal of temp file in GetBlob on Windows * fix(deps): update module golang.org/x/crypto to v0.13.0 * Fix build with golangci-lint 1.54.2 * fix(deps): update module golang.org/x/oauth2 to v0.12.0 * Implement, and default to, a SQLite BlobInfoCache instead of BoltDB * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * Update dependencies of docker/docker * Correctly handle encryption/decryption changes in non-OCI formats * chore(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 [security] * fix(deps): update module github.com/containers/storage to v1.50.1 - bump c/storage to 1.50.2 * Bump to v1.50.1 * Add an OWNERS file for the merge bot to refer to - bump c/common to 0.55.4 * Bump c/image to v0.55.3 - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - New release 20231204 - bump c/common to 0.57.0 * Bump to v0.56.0 by * Fix typo in comment * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Fix specification of unix:///run * libimage/layer_tree: if parent is empty and a manifest list then ignore check. * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Split up util package into pkg/password, pkg/copy, pkg/version * Remove ActiveDestination method to move into podman * Default machine CPUs to Cores/2 * pkg/config: do NOT set StaticDir and VolumeDir * Implement negated label match function * chore: import packages only once * CoC: fix email link - bump c/storage to 1.51.0 * Bump to v1.50.2 * overlay, composefs: mount loop device RO * Run codespell on code * fix(deps): update module github.com/klauspost/compress to v1.17.0 * store: serialize container deletion * pkg/system: reduce retry timeout for EnsureRemoveAll * overlay, composefs: use data-only lower layers * store: call RecordWrite() before graphDriver Cleanup() * fix(deps): update module golang.org/x/sys to v0.13.0 - bump c/image to 5.29.0 * Bump to v5.28.0 * fix(deps): update module github.com/containers/storage to v1.50.2 * Run codespell on code * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Use constants and types from opencontainers/image-spec/specs-go/v1 * progress: set Current before Refill * copy: fix nil pointer dereference when checking compression algorithm * fix(deps): update module github.com/klauspost/compress to v1.17.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.14.0 * ociarchive: Add new ArchiveFileNotFoundError - New release 20240206 - bump bundled c/common to 0.57.4 - bump bundled c/image to 0.29.2 - conditionally require libcontainers-sles-mounds for product(SLE-Micro) as well (SLE Micro 6.0 now no longer provides product(SUSE_SLE) and instead only provides product(SLE-Micro)), fixes bsc#1216443 - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Enforce BCI verification via Podman on openSUSE distributions using the already shipped container signing keys. (bsc#1197030) - Resolve choice on openSUSE distributions for libcontainer-policy by suggesting the libcontainers-openSUSE-policy explicitly. - Remove unused grep requirement - Disable CNI related configs on ALP (bsc#1213556) (https://github.com/containers/podman/issues/19327) - New release 20230814 - bump c/storage to 1.48.0 * Bump to v1.47.0 * Fix error if continueWrite/continueRead pipe open fails * pkg/regexp: make sure that &Regexp implements the interfaces * Remove use of fillGo18FileTypeBits - bump c/image to 5.27.0 * fix(deps): update module github.com/docker/docker to v23.0.3+incompatible * fix(deps): update module golang.org/x/term to v0.7.0 * fix(deps): update module github.com/klauspost/compress to v1.16.4 * fix(deps): update module github.com/sigstore/sigstore to v1.6.1 * chore(deps): update dependency containers/automation_images to v20230405 * fix(deps): update module golang.org/x/crypto to v0.8.0 * fix(deps): update module golang.org/x/oauth2 to v0.7.0 * fix(deps): update module github.com/containers/storage to v1.46.1 * fix(deps): update module github.com/sigstore/sigstore to v1.6.2 * Don't completely silently ignore non-OCI manifests in OCI layouts * fix(deps): update module github.com/klauspost/compress to v1.16.5 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * fix(deps): update module github.com/docker/docker to v23.0.4+incompatible - bump c/common to 0.55.3 * Change default image volume mode to "nullfs" on FreeBSD * [v0.55][CI-DOCS] remove zstd:chunked from docs * libimage: harden lookup by digest * libimage: HasDifferentDigest: add InsecureSkipTLSVerify option - New release 20230913 - bump c/image to 5.28.0 * Bump to v5.26.0 * fix(deps): update module github.com/sigstore/rekor to v1.2.2 * fix(deps): update module github.com/sigstore/fulcio to v1.3.2 * Adding IO decorator to copy progress bar * Ensure we close HTTP connections on all paths * fix(deps): update module github.com/containers/storage to v1.48.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * fix(deps): update github.com/cyberphone/json-canonicalization digest to 91eb5f1 * fix(deps): update golang.org/x/exp digest to 97b1e66 * fix(deps): update module github.com/klauspost/compress to v1.16.7 * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * fix(deps): update module golang.org/x/oauth2 to v0.10.0 * manifest: ListUpdate add imgspecv1.Platform field * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * pkg/docker: use the same default auth path as macOS on FreeBSD * fix(deps): update module github.com/sigstore/fulcio to v1.3.4 * blob: TryReusingBlobWithOptions consider RequiredCompression if set * Fix tests of the ostree transport * helpers_test,cleanup: correct argument order * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Make temporary names container/image specific * listupdate,oci: instance show read-only annotations and CompressionAlgorithmNames * fix(deps): update module github.com/docker/docker-credential-helpers to v0.8.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Fix TestOCI1IndexChooseInstanc * Refactor data passing in c/image/copy * Update module github.com/sigstore/fulcio to v1.4.0 * copy/multiple: instanceCopyCopy honor UpdateCompressionAlgorithms * Update vendor of containers/storage * copy/single: accept custom *Options and wrap arguments in copySingleImageOptions * Improve transport documentation * fix(deps): update module github.com/vbatts/tar-split to v0.11.5 * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * copy: implement instanceCopyClone for zstd compression * copy/multiple: priority of instanceCopyCopy must be higher than instanceCopyClone * Clarify where mirrors are used * fix(deps): update github.com/cyberphone/json-canonicalization digest to aa7fe85 * fix(deps): update github.com/containers/storage digest to c3da76f * Update x/exp/slices, and some small slice-related cleanups * Use consistent example domains in #2069 * copy: add support for ForceCompressionFormat * fix(deps): update module golang.org/x/term to v0.11.0 * fix(deps): update module golang.org/x/crypto to v0.12.0 * fix(deps): update module golang.org/x/oauth2 to v0.11.0 * [release-5.27] Preparing 5.27 backport * Update to Go 1.19 * storage.storageImageDestination.Commit(): leverage image options * Rename SKOPEO_CI_TAG to SKOPEO_CI_BRANCH * [CI:DOCS] Add cirrus-cron retry/monitor jobs * chore(deps): update dependency containers/automation_images to v20230807 * [release-5.27] Fix the branch we use for determining a git-validation starting point * fix(deps): update golang.org/x/exp digest to 352e893 * fix(deps): update module github.com/sigstore/sigstore to v1.7.2 * OCI image-spec / distribution-spec v1.1 updates, first round * fix(deps): update module github.com/sylabs/sif/v2 to v2.12.0 * chore(deps): update dependency containers/automation_images to v20230809 * Merge release branch into main * BREAKING: Update for move of github.com/theupdateframework/go-tuf/encrypted * Update module github.com/containers/ocicrypt to v1.1.8 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/containers/storage to v1.49.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.13.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.1 * fix(deps): update golang.org/x/exp digest to d852ddb * fix(deps): update module golang.org/x/term to v0.12.0 * fix(deps): update module github.com/sigstore/sigstore to v1.7.3 * fix removal of temp file in GetBlob on Windows * fix(deps): update module golang.org/x/crypto to v0.13.0 * Fix build with golangci-lint 1.54.2 * fix(deps): update module golang.org/x/oauth2 to v0.12.0 * Implement, and default to, a SQLite BlobInfoCache instead of BoltDB * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * Update dependencies of docker/docker * Correctly handle encryption/decryption changes in non-OCI formats * chore(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 [security] * fix(deps): update module github.com/containers/storage to v1.50.1 - bump c/storage to 1.50.2 * Bump to v1.50.1 * Add an OWNERS file for the merge bot to refer to - bump c/common to 0.55.4 * Bump c/image to v0.55.3 - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - New release 20231204 - bump c/common to 0.57.0 * Bump to v0.56.0 by * Fix typo in comment * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Fix specification of unix:///run * libimage/layer_tree: if parent is empty and a manifest list then ignore check. * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Split up util package into pkg/password, pkg/copy, pkg/version * Remove ActiveDestination method to move into podman * Default machine CPUs to Cores/2 * pkg/config: do NOT set StaticDir and VolumeDir * Implement negated label match function * chore: import packages only once * CoC: fix email link - bump c/storage to 1.51.0 * Bump to v1.50.2 * overlay, composefs: mount loop device RO * Run codespell on code * fix(deps): update module github.com/klauspost/compress to v1.17.0 * store: serialize container deletion * pkg/system: reduce retry timeout for EnsureRemoveAll * overlay, composefs: use data-only lower layers * store: call RecordWrite() before graphDriver Cleanup() * fix(deps): update module golang.org/x/sys to v0.13.0 - bump c/image to 5.29.0 * Bump to v5.28.0 * fix(deps): update module github.com/containers/storage to v1.50.2 * Run codespell on code * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Use constants and types from opencontainers/image-spec/specs-go/v1 * progress: set Current before Refill * copy: fix nil pointer dereference when checking compression algorithm * fix(deps): update module github.com/klauspost/compress to v1.17.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.14.0 * ociarchive: Add new ArchiveFileNotFoundError - New release 20240206 - bump bundled c/common to 0.57.4 - bump bundled c/image to 0.29.2 - conditionally require libcontainers-sles-mounds for product(SLE-Micro) as well (SLE Micro 6.0 now no longer provides product(SUSE_SLE) and instead only provides product(SLE-Micro)), fixes bsc#1216443 - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Enforce BCI verification via Podman on openSUSE distributions using the already shipped container signing keys. (bsc#1197030) - Resolve choice on openSUSE distributions for libcontainer-policy by suggesting the libcontainers-openSUSE-policy explicitly. - Remove unused grep requirement - Disable CNI related configs on ALP (bsc#1213556) (https://github.com/containers/podman/issues/19327) - New release 20230814 - bump c/storage to 1.48.0 * Bump to v1.47.0 * Fix error if continueWrite/continueRead pipe open fails * pkg/regexp: make sure that &Regexp implements the interfaces * Remove use of fillGo18FileTypeBits - bump c/image to 5.27.0 * fix(deps): update module github.com/docker/docker to v23.0.3+incompatible * fix(deps): update module golang.org/x/term to v0.7.0 * fix(deps): update module github.com/klauspost/compress to v1.16.4 * fix(deps): update module github.com/sigstore/sigstore to v1.6.1 * chore(deps): update dependency containers/automation_images to v20230405 * fix(deps): update module golang.org/x/crypto to v0.8.0 * fix(deps): update module golang.org/x/oauth2 to v0.7.0 * fix(deps): update module github.com/containers/storage to v1.46.1 * fix(deps): update module github.com/sigstore/sigstore to v1.6.2 * Don't completely silently ignore non-OCI manifests in OCI layouts * fix(deps): update module github.com/klauspost/compress to v1.16.5 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * fix(deps): update module github.com/docker/docker to v23.0.4+incompatible - bump c/common to 0.55.3 * Change default image volume mode to "nullfs" on FreeBSD * [v0.55][CI-DOCS] remove zstd:chunked from docs * libimage: harden lookup by digest * libimage: HasDifferentDigest: add InsecureSkipTLSVerify option - New release 20230913 - bump c/image to 5.28.0 * Bump to v5.26.0 * fix(deps): update module github.com/sigstore/rekor to v1.2.2 * fix(deps): update module github.com/sigstore/fulcio to v1.3.2 * Adding IO decorator to copy progress bar * Ensure we close HTTP connections on all paths * fix(deps): update module github.com/containers/storage to v1.48.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * fix(deps): update github.com/cyberphone/json-canonicalization digest to 91eb5f1 * fix(deps): update golang.org/x/exp digest to 97b1e66 * fix(deps): update module github.com/klauspost/compress to v1.16.7 * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * fix(deps): update module golang.org/x/oauth2 to v0.10.0 * manifest: ListUpdate add imgspecv1.Platform field * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * pkg/docker: use the same default auth path as macOS on FreeBSD * fix(deps): update module github.com/sigstore/fulcio to v1.3.4 * blob: TryReusingBlobWithOptions consider RequiredCompression if set * Fix tests of the ostree transport * helpers_test,cleanup: correct argument order * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Make temporary names container/image specific * listupdate,oci: instance show read-only annotations and CompressionAlgorithmNames * fix(deps): update module github.com/docker/docker-credential-helpers to v0.8.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Fix TestOCI1IndexChooseInstanc * Refactor data passing in c/image/copy * Update module github.com/sigstore/fulcio to v1.4.0 * copy/multiple: instanceCopyCopy honor UpdateCompressionAlgorithms * Update vendor of containers/storage * copy/single: accept custom *Options and wrap arguments in copySingleImageOptions * Improve transport documentation * fix(deps): update module github.com/vbatts/tar-split to v0.11.5 * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * copy: implement instanceCopyClone for zstd compression * copy/multiple: priority of instanceCopyCopy must be higher than instanceCopyClone * Clarify where mirrors are used * fix(deps): update github.com/cyberphone/json-canonicalization digest to aa7fe85 * fix(deps): update github.com/containers/storage digest to c3da76f * Update x/exp/slices, and some small slice-related cleanups * Use consistent example domains in #2069 * copy: add support for ForceCompressionFormat * fix(deps): update module golang.org/x/term to v0.11.0 * fix(deps): update module golang.org/x/crypto to v0.12.0 * fix(deps): update module golang.org/x/oauth2 to v0.11.0 * [release-5.27] Preparing 5.27 backport * Update to Go 1.19 * storage.storageImageDestination.Commit(): leverage image options * Rename SKOPEO_CI_TAG to SKOPEO_CI_BRANCH * [CI:DOCS] Add cirrus-cron retry/monitor jobs * chore(deps): update dependency containers/automation_images to v20230807 * [release-5.27] Fix the branch we use for determining a git-validation starting point * fix(deps): update golang.org/x/exp digest to 352e893 * fix(deps): update module github.com/sigstore/sigstore to v1.7.2 * OCI image-spec / distribution-spec v1.1 updates, first round * fix(deps): update module github.com/sylabs/sif/v2 to v2.12.0 * chore(deps): update dependency containers/automation_images to v20230809 * Merge release branch into main * BREAKING: Update for move of github.com/theupdateframework/go-tuf/encrypted * Update module github.com/containers/ocicrypt to v1.1.8 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/containers/storage to v1.49.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.13.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.1 * fix(deps): update golang.org/x/exp digest to d852ddb * fix(deps): update module golang.org/x/term to v0.12.0 * fix(deps): update module github.com/sigstore/sigstore to v1.7.3 * fix removal of temp file in GetBlob on Windows * fix(deps): update module golang.org/x/crypto to v0.13.0 * Fix build with golangci-lint 1.54.2 * fix(deps): update module golang.org/x/oauth2 to v0.12.0 * Implement, and default to, a SQLite BlobInfoCache instead of BoltDB * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * Update dependencies of docker/docker * Correctly handle encryption/decryption changes in non-OCI formats * chore(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 [security] * fix(deps): update module github.com/containers/storage to v1.50.1 - bump c/storage to 1.50.2 * Bump to v1.50.1 * Add an OWNERS file for the merge bot to refer to - bump c/common to 0.55.4 * Bump c/image to v0.55.3 - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - New release 20231204 - bump c/common to 0.57.0 * Bump to v0.56.0 by * Fix typo in comment * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Fix specification of unix:///run * libimage/layer_tree: if parent is empty and a manifest list then ignore check. * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Split up util package into pkg/password, pkg/copy, pkg/version * Remove ActiveDestination method to move into podman * Default machine CPUs to Cores/2 * pkg/config: do NOT set StaticDir and VolumeDir * Implement negated label match function * chore: import packages only once * CoC: fix email link - bump c/storage to 1.51.0 * Bump to v1.50.2 * overlay, composefs: mount loop device RO * Run codespell on code * fix(deps): update module github.com/klauspost/compress to v1.17.0 * store: serialize container deletion * pkg/system: reduce retry timeout for EnsureRemoveAll * overlay, composefs: use data-only lower layers * store: call RecordWrite() before graphDriver Cleanup() * fix(deps): update module golang.org/x/sys to v0.13.0 - bump c/image to 5.29.0 * Bump to v5.28.0 * fix(deps): update module github.com/containers/storage to v1.50.2 * Run codespell on code * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Use constants and types from opencontainers/image-spec/specs-go/v1 * progress: set Current before Refill * copy: fix nil pointer dereference when checking compression algorithm * fix(deps): update module github.com/klauspost/compress to v1.17.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.14.0 * ociarchive: Add new ArchiveFileNotFoundError - New release 20240206 - bump bundled c/common to 0.57.4 - bump bundled c/image to 0.29.2 - conditionally require libcontainers-sles-mounds for product(SLE-Micro) as well (SLE Micro 6.0 now no longer provides product(SUSE_SLE) and instead only provides product(SLE-Micro)), fixes bsc#1216443 - Add missing comma to previous change - Add missing Requires(post): sed, fixes boo#1200524 - Make %post compatible with dash - Use $() again in %post, but with a space for POSIX compliance - Resync containers.conf / storage.conf with Fedora - Create /etc/containers/registries.conf.d and add 000-shortnames.conf to it. - Fix obvious typo in containers.conf - set detached sigstore attachments for the SUSE controlled registries - postinstall script: slight cleanup, no functional change - add container-storage-driver.sh (bsc#1197093) - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - Update bundled common to 0.50.1 - Update bundled image to 5.23.1 - Update bundled storage to 1.44.0 - Drop bundled podman - Bump version to 20221122 - Install container-storage-driver.sh in /etc/ on Leap & SLE - add requires on util-linux-systemd for findmnt in profile script - only set storage_driver env when no libpod exists - avoid quoting issue - Remove registry.suse.com from search unqualified-search-registries: registry.suse.com responds very slowly to pagination repository listings (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes every `podman search` to take over 90s. We have to remove it until this regression is fixed. - storage.conf: Unset 'driver' and set 'driver_priority' to allow podman to use 'btrfs' if available and fallback to 'overlay' if not. - .spec: rm %post script to set 'btrfs' as storage driver in storage.conf - Reverts https://build.opensuse.org/request/show/1060361 Changes introduced to c/storage's storage.conf which adds a driver_priority attribute would break consumers of libcontainer-common as long as those packages are vendoring an older c/storage version. Instead of patching every consumer, we're reverting this change, until those packages have been updated downstream. [boo#1207509] - New upstream release 20230214 - bump c/storage to 1.45.3 - bump c/image to 5.24.1 - bump c/common to 0.51.0 - containers.conf: * add commented out options containers.read_only, engine.platform_to_oci_runtime, engine.events_container_create_inspect_data, network.volume_plugin_timeout, engine.runtimes.youki, machine.provider * remove deprecated setting containers.userns_size * add youki to engine.runtime_supports_json - shortnames.conf: pull in latest upstream version - storage.conf: add commented out option storage.transient_store - correct license to APACHE-2.0 only (there's no GPLv3 code to be found) - add source URLs to spec - drop pointless copyright year - Add registry.suse.com to the unqualified-search-registries - Remove obsolete Requires(post): util-linux-systemd - Remove container-storage-driver.sh, we want to default to the overlay driver instead of btrfs. The btrfs driver is not really supported upstream (see e.g. https://github.com/containers/podman/issues/16882), there is no real development anymore and it appears to have subtle bugs (e.g. the one linked previously). To prevent further such issues, we will from now on default to the overlay driver. - Own /etc/containers/systemd and /usr/share/containers/systemd, useful for podman quadlet. - Introduce new subpackage that adds SLE-specific mounts only on SLE systems (if sles-release) hence avoiding superfluous warnings on non-SLE systems while running podman commands. (bsc#1211124) - Enforce BCI verification via Podman on openSUSE distributions using the already shipped container signing keys. (bsc#1197030) - Resolve choice on openSUSE distributions for libcontainer-policy by suggesting the libcontainers-openSUSE-policy explicitly. - Remove unused grep requirement - Disable CNI related configs on ALP (bsc#1213556) (https://github.com/containers/podman/issues/19327) - New release 20230814 - bump c/storage to 1.48.0 * Bump to v1.47.0 * Fix error if continueWrite/continueRead pipe open fails * pkg/regexp: make sure that &Regexp implements the interfaces * Remove use of fillGo18FileTypeBits - bump c/image to 5.27.0 * fix(deps): update module github.com/docker/docker to v23.0.3+incompatible * fix(deps): update module golang.org/x/term to v0.7.0 * fix(deps): update module github.com/klauspost/compress to v1.16.4 * fix(deps): update module github.com/sigstore/sigstore to v1.6.1 * chore(deps): update dependency containers/automation_images to v20230405 * fix(deps): update module golang.org/x/crypto to v0.8.0 * fix(deps): update module golang.org/x/oauth2 to v0.7.0 * fix(deps): update module github.com/containers/storage to v1.46.1 * fix(deps): update module github.com/sigstore/sigstore to v1.6.2 * Don't completely silently ignore non-OCI manifests in OCI layouts * fix(deps): update module github.com/klauspost/compress to v1.16.5 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * fix(deps): update module github.com/docker/docker to v23.0.4+incompatible - bump c/common to 0.55.3 * Change default image volume mode to "nullfs" on FreeBSD * [v0.55][CI-DOCS] remove zstd:chunked from docs * libimage: harden lookup by digest * libimage: HasDifferentDigest: add InsecureSkipTLSVerify option - New release 20230913 - bump c/image to 5.28.0 * Bump to v5.26.0 * fix(deps): update module github.com/sigstore/rekor to v1.2.2 * fix(deps): update module github.com/sigstore/fulcio to v1.3.2 * Adding IO decorator to copy progress bar * Ensure we close HTTP connections on all paths * fix(deps): update module github.com/containers/storage to v1.48.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * fix(deps): update github.com/cyberphone/json-canonicalization digest to 91eb5f1 * fix(deps): update golang.org/x/exp digest to 97b1e66 * fix(deps): update module github.com/klauspost/compress to v1.16.7 * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * fix(deps): update module golang.org/x/oauth2 to v0.10.0 * manifest: ListUpdate add imgspecv1.Platform field * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * pkg/docker: use the same default auth path as macOS on FreeBSD * fix(deps): update module github.com/sigstore/fulcio to v1.3.4 * blob: TryReusingBlobWithOptions consider RequiredCompression if set * Fix tests of the ostree transport * helpers_test,cleanup: correct argument order * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Make temporary names container/image specific * listupdate,oci: instance show read-only annotations and CompressionAlgorithmNames * fix(deps): update module github.com/docker/docker-credential-helpers to v0.8.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Fix TestOCI1IndexChooseInstanc * Refactor data passing in c/image/copy * Update module github.com/sigstore/fulcio to v1.4.0 * copy/multiple: instanceCopyCopy honor UpdateCompressionAlgorithms * Update vendor of containers/storage * copy/single: accept custom *Options and wrap arguments in copySingleImageOptions * Improve transport documentation * fix(deps): update module github.com/vbatts/tar-split to v0.11.5 * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * copy: implement instanceCopyClone for zstd compression * copy/multiple: priority of instanceCopyCopy must be higher than instanceCopyClone * Clarify where mirrors are used * fix(deps): update github.com/cyberphone/json-canonicalization digest to aa7fe85 * fix(deps): update github.com/containers/storage digest to c3da76f * Update x/exp/slices, and some small slice-related cleanups * Use consistent example domains in #2069 * copy: add support for ForceCompressionFormat * fix(deps): update module golang.org/x/term to v0.11.0 * fix(deps): update module golang.org/x/crypto to v0.12.0 * fix(deps): update module golang.org/x/oauth2 to v0.11.0 * [release-5.27] Preparing 5.27 backport * Update to Go 1.19 * storage.storageImageDestination.Commit(): leverage image options * Rename SKOPEO_CI_TAG to SKOPEO_CI_BRANCH * [CI:DOCS] Add cirrus-cron retry/monitor jobs * chore(deps): update dependency containers/automation_images to v20230807 * [release-5.27] Fix the branch we use for determining a git-validation starting point * fix(deps): update golang.org/x/exp digest to 352e893 * fix(deps): update module github.com/sigstore/sigstore to v1.7.2 * OCI image-spec / distribution-spec v1.1 updates, first round * fix(deps): update module github.com/sylabs/sif/v2 to v2.12.0 * chore(deps): update dependency containers/automation_images to v20230809 * Merge release branch into main * BREAKING: Update for move of github.com/theupdateframework/go-tuf/encrypted * Update module github.com/containers/ocicrypt to v1.1.8 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/containers/storage to v1.49.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.13.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.0 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.1 * fix(deps): update golang.org/x/exp digest to d852ddb * fix(deps): update module golang.org/x/term to v0.12.0 * fix(deps): update module github.com/sigstore/sigstore to v1.7.3 * fix removal of temp file in GetBlob on Windows * fix(deps): update module golang.org/x/crypto to v0.13.0 * Fix build with golangci-lint 1.54.2 * fix(deps): update module golang.org/x/oauth2 to v0.12.0 * Implement, and default to, a SQLite BlobInfoCache instead of BoltDB * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * Update dependencies of docker/docker * Correctly handle encryption/decryption changes in non-OCI formats * chore(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 [security] * fix(deps): update module github.com/containers/storage to v1.50.1 - bump c/storage to 1.50.2 * Bump to v1.50.1 * Add an OWNERS file for the merge bot to refer to - bump c/common to 0.55.4 * Bump c/image to v0.55.3 - Require libcontainers-sles-mounts for *all* SLE products, and not just SLES. (bsc#1215291) - New release 20231204 - bump c/common to 0.57.0 * Bump to v0.56.0 by * Fix typo in comment * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Fix specification of unix:///run * libimage/layer_tree: if parent is empty and a manifest list then ignore check. * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Split up util package into pkg/password, pkg/copy, pkg/version * Remove ActiveDestination method to move into podman * Default machine CPUs to Cores/2 * pkg/config: do NOT set StaticDir and VolumeDir * Implement negated label match function * chore: import packages only once * CoC: fix email link - bump c/storage to 1.51.0 * Bump to v1.50.2 * overlay, composefs: mount loop device RO * Run codespell on code * fix(deps): update module github.com/klauspost/compress to v1.17.0 * store: serialize container deletion * pkg/system: reduce retry timeout for EnsureRemoveAll * overlay, composefs: use data-only lower layers * store: call RecordWrite() before graphDriver Cleanup() * fix(deps): update module golang.org/x/sys to v0.13.0 - bump c/image to 5.29.0 * Bump to v5.28.0 * fix(deps): update module github.com/containers/storage to v1.50.2 * Run codespell on code * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Use constants and types from opencontainers/image-spec/specs-go/v1 * progress: set Current before Refill * copy: fix nil pointer dereference when checking compression algorithm * fix(deps): update module github.com/klauspost/compress to v1.17.0 * fix(deps): update module github.com/sylabs/sif/v2 to v2.14.0 * ociarchive: Add new ArchiveFileNotFoundError - New release 20240206 - bump bundled c/common to 0.57.4 - bump bundled c/image to 0.29.2 - conditionally require libcontainers-sles-mounds for product(SLE-Micro) as well (SLE Micro 6.0 now no longer provides product(SUSE_SLE) and instead only provides product(SLE-Micro)), fixes bsc#1216443 - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - Fix static compilation and sysfs_read_file mess A cpupower_fix_compilation_and_sysfs_read_file_mess.patch - Add bash completion for cpupower command (from mainline submit) A cpupower_bash-completion_for_cpupower_tool.patch - Run spec-cleaner - Don't disable as-needed, it works now. - Description updates. - Update to latest kernel HEAD sources (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d) Patches included mainline: D cpupower_fix_compilation_and_sysfs_read_file_mess.patch D cpupower_bash-completion_for_cpupower_tool.patch Adjusted patches: M turbostat_makefile_fix_asm_header.patch M x86_perf_makefile_fix_asm_header.patch M rapl_monitor.patch M cpupower_rapl.patch - jira#5244 Turbostat for Ice Lake - Remove very old cpufrequtils provides and requires (predecessor) - Update libcpupower description - Sidenote about fate#321274 - This feature is on the kernel side and got wrongly mentioned in cpupower in a released product. - Add intel-speed-select tool (jsc#SLE-5364) A intel-speed-select-1.0.tar.bz2 A intel-speed-select_remove_DATE_TIME.patch - Fix missing governors when running cpupower frequency-info (bsc#1117709) M rapl_monitor.patch - Update turbostat to latest version 19.08.31 - Update intel-speed-select to latest 5.5-rc1 kernel version latest mainline commit: commit b3abfd778bf1dbdd - Update cpupower to latest 5.5-rc1 kernel version latest mainline commit: commit 4611a4fb0cce3 Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967) - Fix library API breakage (bsc#1154240) A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch - Add mainline patch with proper patch header and filename: D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch - Fix manpage (bsc#1162142) A Correction-to-manpage-of-cpupower.patch - Do not show 0 boost states if boost states are supported, but could not be read from PCI registers. bsc#1165712, bsc#1164983 A amd_do_not_show_amount_of_boost_states_if_zero.patch - Update to latest: turbostat 20.03.20 intel-speed-select 1.3 (bsc#1171810) verions - Adjust needed kernel and userspace requirements in: cpupower_export_tarball_from_git.sh and BuildRequires: libcap-devel A remove_bits_h.patch - Add -fcommon to allow building against GCC10 - Update intel-speed-select to version 1.6 (jsc#SLE-13334) - Add AMD Fam 19h support (bsc#1177394) - Update turbostat to latest version 20.09.30 including: * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support) * jsc#SLE-13448 (Alder Lake support) * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support) * Support AMD Fam 19h - Touched patches: Deleted mainline integrated patches: D Correction-to-manpage-of-cpupower.patch D cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch Patches refreshed: M rapl_monitor.patch M turbostat_makefile_fix_asm_header.patch - Update (jsc#SLE-18392, jsc#SLE-18906, jsc#SLE-18393, jsc#SLE-18410): * turbostat to 21.05.04 * intel speed select to 1.10 * cpupower to 5.14-rcX (kernel sources state) - Already upstream and included in the update: D intel-speed-select_remove_DATE_TIME.patch - SLE patches for jsc#SLE-17797 dropped (in fact never been applied to factory), due to inclusion in upstream version: cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch cpupower-Update-family-checks-when-decoding-HW-pstates.patch cpupower-Remove-family-arg-to-decode_pstates.patch cpupower-Correct-macro-name-for-CPB-caps-flag.patch cpupower-Update-msr_pstate-union-struct-naming.patch cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch cpupower-Remove-unused-pscur-variable.patch - Update to latest turbostat version 2022.07.28 jsc#PED-1028 Includes: Add ADL-N platform to Turbostat jsc#PED-1027 Add RPL-P platform to Turbostat jsc#PED-1029 Add RPL-S platform to Turbostat jsc#PED-1026 - Explicitly add patch to support Raptorlake-S jsc#PED-2066 A tools-power-turbostat-add-support-for-RPL-S.diff - Update to latest intel-speed-select package version from 1.10 to 1.13 (jsc#PED-2137): 1.13: * Fix build failure when using gcc options -Wl,--as-needed * Fix warning for perf_cap.cpu may be uninitialized * Fix off by one check for MAX_DIE_PER_PACKAGE * Fix issue with use of get_physical_die_id instead of get_physical_die_id * Warn if turbo is disabled and SST turbo-freq feature is requested 1.12: * Allows out of band SST support, where some remote agent changes SST profiles via some Board Management Controller. * HFI support to process config level changes in oob mode 1.11: * Update max performance when BIOS disabled turbo - Add Emerald Ridge Intel CPU model support: * jsc#PED-4393 intel-speed-select tool support for EMR A tools-power-turbostat-Introduce-support-for-EMR.patch A add_emerald_ridge_intel_family.patch * jsc#PED-4395 Add EMR CPU support to turbostat A tools-power-x86-intel-speed-select-Add-Emerald-Rapid-quirk.patch - Fix uncore frequency file string (bsc#1221765) * Print uncore config also for machines using the new cluster API A tools-power-turbostat-Expand-probe_intel_uncore_frequency.patch - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Version upgrade to 2.2.6: CUPS 2.2.6 is a general bug fix release. For details see https://github.com/apple/cups/releases Changes include: * DBUS notifications could crash the scheduler (Issue #5143) (see also bsc#1061066 "DBUS library aborts caller process") - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - Make sure cups-libs-<targettype> is removed - Version upgrade to 2.2.7: CUPS 2.2.7 is a general bug fix release. For details see https://github.com/apple/cups/releases or the CHANGES.md file. Changes include: * Additional security fixes for: bsc#1061066 DBUS library aborts caller process in _dbus_check_is_valid_utf8 (in particular that aborts cupsd) and bsc#1087018 CVE-2017-18248: cups: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification which are the CUPS upstream issues https://github.com/apple/cups/issues/5143 Remote DoS attack against cupsd via invalid username and malicious D-Bus library and https://github.com/apple/cups/issues/5186 squash non-UTF-8 strings into ASCII on plain IPP level and https://github.com/apple/cups/issues/5229 persistently substitute invalid job attributes with default values - not only in add_job see also bsc#1087072 dbus-1: Disable assertions to prevent un-expected DDoS attacks * NOTICE: Raw print queues are now deprecated (Issue #5269) so that now there is a warning message when you add or modify a queue to use the "raw driver" but raw printing will continue to work through CUPS 2.3.x, cf. https://lists.cups.org/pipermail/cups/2018-March/074060.html * Fixed an Avahi crash bug in the scheduler (Issue #5268) * Systemd did not restart cupsd when configuration changes were made that required a restart (Issue #5263) * The scheduler could crash while adding an IPP Everywhere printer (Issue #5258) * The scheduler now supports using temporary print queues for older IPP/1.1 print queues like those shared by CUPS 1.3 and earlier (Issue #5241) * Kerberized printing to another CUPS server did not work correctly (Issue #5233) * More fixes for printing to old CUPS servers (Issue #5211) * The scheduler now substitutes default values for invalid job attributes when running in "relaxed conformance" mode (Issue #5186) * The cups-driverd program incorrectly stopped scanning PPDs as soon as a loop was seen (Issue #5170) * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS` options to control the minimum and maximum TLS versions that will be allowed, respectively (Issue #5119) * The scheduler did not write out dirty configuration and state files if there were open client connections (Issue #5118) * The `lpadmin` command now provides a better error message when an unsupported System V interface script is used (Issue #5111) * No longer support backslash, question mark, or quotes in printer names (Issue #4966) * The CUPS library now supports the latest HTTP Digest authentication specification including support for SHA-256 (Issue #4862) * TLS connections now properly timeout (rdar://34938533) - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954 (except the not needed hunk for patching CHANGES.md which fails) that fixes local privilege escalation to root and sandbox bypasses in scheduler (Apple's internal issues rdar://37836779, rdar://37836995, rdar://37837252, rdar://37837581) in the CUPS 2.2 branch bsc#1096405 CVE-2018-4180: Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN) bsc#1096406 CVE-2018-4181: Limited Local File Reads as Root via cupsd.conf Include Directive bsc#1096407 CVE-2018-4182: cups-exec Sandbox Bypass Due to Insecure Error Handling bsc#1096408 CVE-2018-4183: cups-exec Sandbox Bypass Due to Profile Misconfiguration - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session cookie is extremely predictable, effectively breaking the CSRF protection of the CUPS web interface (bsc#1115750) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118) Fixes https://github.com/apple/cups/issues/5509 - cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359) and some other security/disclosure issues https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109 (Apple's internal issues rdar://51685251, rdar://50035411, rdar://51373853, rdar://51373929) - cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422) heap-buffer-overflow in libcups ppdFindOption() function - cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001 access to uninitialized buffer in ipp.c (bsc#1180520) - cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671) the ippReadIO function may under-read an extension field - cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960) Fix web UI kerberos authentication - When cupsd creates directories with specific owner group and permissions (usually owner is 'root' and group matches "configure --with-cups-group=lp") specify same owner group and permissions in the RPM spec file to ensure those directories are installed by RPM with the right settings because if those directories were installed by RPM with different settings then cupsd would use them as is and not adjust its specific owner group and permissions which could lead to privilege escalation from 'lp' user to 'root' via symlink attacks e.g. if owner is falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161) - SUSE_bsc_1189517.patch is https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79 which belongs to https://github.com/apple/cups/issues/5288 that fixes bsc#1189517 "cups printservice takes much longer than before with a big number of printers" see in particular https://github.com/apple/cups/issues/5288#issuecomment-921626381 - SUSE_bsc_1195115.patch is https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44 which belongs to https://github.com/apple/cups/issues/5538 that fixes bsc#1195115 "CUPS PreserveJobHistory doesn't work with seconds" - cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691 cups: authentication bypass and code execution (bsc#1199474) - cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b (except the not needed hunk for patching CHANGES.md which fails) that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch bsc#1201511: Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0 - cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7 which belongs to https://github.com/OpenPrinting/cups/issues/308 that fixes bsc#1191525, bsc#1203446: "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)" "/usr/bin/lpr: Error - The printer or class does not exist." - 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error that fixes bsc#1191467, bsc#1198932: "lpr reports 'No such file or directory' for missing catalogue files" "/usr/bin/lpr: No such file or directory" - after-network_target-sssd_service.patch is derived from https://github.com/apple/cups/issues/5550 with its https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch to add "After=network.target sssd.service" to the systemd unit source files cupsd.service.in and cups.cups-lpdAT.service.in to fix bsc#1201234, bsc#1200321: "Missing network dependency in systemd unit for cups-2.2.7" "CUPS may not always start if sssd is in use" - cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324 "Heap buffer overflow in cupsd" https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7 bsc#1211643 - cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241 "use-after-free in cupsdAcceptClient()" https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25 bsc#1212230 - cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360 "Information leak through Cups-Get-Document operation" by requiring authentication for CUPS-Get-Document in cupsd.conf https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913 https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g bsc#1214254 - cups-2.2.7-additional_policies.patch is an updated version of cups-2.0.3-additional_policies.patch that replaces it to add the 'allowallforanybody' policy to cupsd.conf after cups-2.2.7-CVE-2023-32360.patch was applied - cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504 "CUPS PostScript Parsing Heap Overflow" https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h bsc#1215204 - Remove '--enable-debug-printfs' from configure options, see https://github.com/OpenPrinting/cups/issues/875 (bsc#1217119). - cups-2.2.7-web-ui-kerberos-authentication.patch, update patch to handle local 'Negotiate' authentication response for cli clients. (bsc#1223179). - cups-2.2.7-CVE-2024-35235.patch is derived from the upstream patch against master (CUPS 2.5) to behave backward compatible for CUPS 2.2.7 in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235 "cupsd Listen port arbitrary chmod 0140777" without the more secure but backward-incompatible behaviour of the upstream patch for CUPS 2.5 that ignores domain sockets specified in 'Listen' entries in /etc/cups/cupsd.conf when cupsd is lauched via systemd (in particular when launched on-demand by systemd) https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f bsc#1225365 - Require the exact matching version-release of all libcups* sub-packages (bsc#1226192) - cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1 which was added in CUPS 2.2.8 that fixed a parsing bug in cups_auth_find() in cups/auth.c which lead to cupsd failing to authenticate users when group membership is required by cupsd configuration like 'Require user @GROUP' which lead to CUPS related commands requesting password from group users even if it is not needed (bsc#1226227) - In cups.changes replaced one place where UTF-8 characters were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017" for what should be ' - ' by ASCII to avoid RPMLINT warning about 'non-break-space' which "can lead to obscure errors". - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Change the deprecated configure option --enable-hidden-symbols to the new --enable-symbol-hiding. - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Update connection info when using UNIX socket as endpoint connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security Fix: [bsc#1204386, CVE-2022-42916] * HSTS bypass via IDN * Add curl-CVE-2022-42916.patch - Update to 7.86.0: * Security fixes: - POST following PUT confusion [bsc#1204383, CVE-2022-32221] - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260] - HTTP proxy double-free [bsc#1204385, CVE-2022-42915] - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916] * Changes: - NPN: remove support for and use of - Websockets: initial support * Bugfixes: - altsvc: reject bad port numbers - autotools: reduce brute-force when detecting recv/send arg list - aws_sigv4: fix header computation - cli tool: do not use disabled protocols - connect: change verbose IPv6 address:port to [address]:port - connect: fix builds without AF_INET6 - connect: fix Curl_updateconninfo for TRNSPRT_UNIX - connect: fix the wrong error message on connect failures - content_encoding: use writer struct subclasses for different encodings - cookie: reject cookie names or content with TAB characters - curl/add_file_name_to_url: use the libcurl URL parser - curl/get_url_file_name: use libcurl URL parser - curl: warn for --ssl use, considered insecure - docs/libcurl/symbols-in-versions: add several missing symbols - ftp: ignore a 550 response to MDTM - functypes: provide the recv and send arg and return types - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled - header: define public API functions as extern c - headers: reset the requests counter at transfer start - hostip: guard PF_INET6 use - hostip: lazily wait to figure out if IPv6 works until needed - http, vauth: always provide Curl_allow_auth_to_host() functionality - http2: make nghttp2 less picky about field whitespace - http: try parsing Retry-After: as a number first - http_proxy: restore the protocol pointer on error - lib: add missing limits.h includes - lib: prepare the incoming of additional protocols - lib: sanitize conditional exclusion around MIME - libssh: if sftp_init fails, don't get the sftp error code - mprintf: reject two kinds of precision for the same argument - mqtt: return error for too long topic - netrc: compare user name case sensitively - netrc: replace fgets with Curl_get_line - netrc: use the URL-decoded user - ngtcp2: fix build errors due to changes in ngtcp2 library - noproxy: support proxies specified using cidr notation - openssl: make certinfo available for QUIC - resolve: make forced IPv4 resolve only use A queries - schannel: ban server ALPN change during recv renegotiation - schannel: don't reset recv/send function pointers on renegotiation - schannel: when importing PFX, disable key persistence - setopt: use the handler table for protocol name to number conversions - setopt: when POST is set, reset the 'upload' field - single_transfer: use the libcurl URL parser when appending query parts - smb: replace CURL_WIN32 with WIN32 - tool: avoid generating ambiguous escaped characters in --libcurl - tool_main: exit at once if out of file descriptors - tool_operate: more transfer cleanup after parallel transfer fail - tool_operate: prevent over-queuing in parallel mode - tool_paramhelp: asserts verify maximum sizes for string loading - tool_xattr: save the original URL, not the final redirected one - url: a zero-length userinfo part in the URL is still a (blank) user - url: allow non-HTTPS HSTS-matching for debug builds - url: rename function due to name-clash in Watt-32 - url: use IDN decoded names for HSTS checks - urlapi: detect scheme better when not guessing - urlapi: fix parsing URL without slash with CURLU_URLENCODE - urlapi: reject more bad characters from the host name field * Remove patch upstream: - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Add 1.50.0 as the minimum libnghttp2 build requirement version as a bandaid. Curl's 7.86.0 release introduces the use of nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation, introduced by nghttp2 1.50.0 release, without introducing a check for the function/right version in their build scripts. This will make Zypper/cURL unusable in some corner cases where users installing something that requires libcurl4 before doing full system upgrade, thus updating the cURL stack, but not libnghttp2's. Background: boo#1204983, Factory mailing list threadd: "? broken dependency in curl and/or *zyp* ?", and forums thread: Curl-is-broken-after-an-update-which-subsequently-breaks-zypper. - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206308, CVE-2022-43551] * Fix Another HSTS bypass via IDN * Add curl-CVE-2022-43551.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Security Fix: [bsc#1206309, CVE-2022-43552] * HTTP Proxy deny use-after-free * Add curl-CVE-2022-43552.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Update to 7.87.0: * Security fixes: - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free * Changes - curl: add --url-query - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit - lib: add CURL_WRITEFUNC_ERROR to signal write callback error - openssl: reduce CA certificate bundle reparsing by caching - version: add a feature names array to curl_version_info_data * Bugfixes - altsvc: fix rejection of negative port numbers - aws_sigv4: consult x-%s-content-sha256 for payload hash - aws_sigv4: fix typos in aws_sigv4.c - base64: better alloc size - base64: encode without using snprintf - base64: faster base64 decoding - build: assume assert.h is always available - build: assume errno.h is always available - c-hyper: CONNECT respones are not server responses - c-hyper: fix multi-request mechanism - CI: Change FreeBSD image from 12.3 to 12.4 - CI: LGTM.com will be shut down in December 2022 - ci: Remove zuul fuzzing job as it's superseded by CIFuzz - cmake: check for cross-compile, not for toolchain - CMake: fix build with `CURL_USE_GSSAPI` - cmake: really enable warnings with clang - cmake: set the soname on the shared library - cmdline-opts/gen.pl: fix the linkifier - cmdline-opts/page-footer: remove long option nroff formatting - config-mac: define HAVE_SYS_IOCTL_H - config-mac: fix typo: size_T -> size_t - config-mac: remove HAVE_SYS_SELECT_H - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW - configure: require fork for NTLM-WB - contributors.sh: actually use $CURLWWW instead of just setting it - cookie: compare cookie prefixes case insensitively - cookie: expire cookies at once when max-age is negative - cookie: open cookie jar as a binary file - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS - curl-rustls.m4: on macOS, rustls also needs the Security framework - curl.h: include <sys/select.h> on SerenityOS - curl.h: name all public function parameters - curl.h: reword comment to not use deprecated option - curl: override the numeric locale and set "C" by force - curl: timeout in the read callback - curl_endian: remove Curl_write64_le from header - curl_get_line: allow last line without newline char - curl_path: do not add '/' if homedir ends with one - curl_url_get.3: remove spurious backtick - curl_url_set.3: document CURLU_DISALLOW_USER - curl_url_set.3: fix typo - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE - CURLOPT_COOKIEFILE.3: advice => advise - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw" - CURLOPT_POST.3: Explain setting to 0 changes request type - docs/curl_ws_send: Fixed typo in websocket docs - docs/EARLY-RELEASE.md: how to determine an early release - docs/examples: spell correction ('Retrieve') - docs/INSTALL.md: expand on static builds - docs/WEBSOCKET.md: explain the URL use - docs: add missing parameters for --retry flag - docs: add more "SEE ALSO" links to CA related pages - docs: explain the noproxy CIDR notation support - docs: extend the dump-header documentation - docs: remove performance note in CURLOPT_SSL_VERIFYPEER - examples/10-at-a-time: fix possible skipped final transfers - examples: update descriptions - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH - gen.pl: do not generate CURLHELP bitmask lines > 79 characters - GHA: clarify workflows permissions, set least possible privilege - GHA: NSS use clang instead of clang-9 - gnutls: use common gnutls init and verify code for ngtcp2 - headers: add endif comments - HTTP-COOKIES.md: mention that http://localhost is a secure context - HTTP-COOKIES.md: update the 6265bis link to draft-11 - http: do not send PROXY more than once - http: fix the ::1 comparison for IPv6 localhost for cookies - http: set 'this_is_a_follow' in the Location: logic - http: use the IDN decoded name in HSTS checks - hyper: classify headers as CONNECT and 1XX - hyper: fix handling of hyper_task's when reusing the same address - idn: remove Curl_win32_ascii_to_idn - INSTALL: update operating systems and CPU archs - KNOWN_BUGS: remove eight entries - lib1560: add some basic IDN host name tests - lib: connection filters (cfilter) addition to curl: - lib: feature deprecation warnings in gcc >= 4.3 - lib: fix some type mismatches and remove unneeded typecasts - lib: parse numbers with fixed known base 10 - lib: remove bad set.opt_no_body assignments - lib: rewind BEFORE request instead of AFTER previous - lib: sync guard for Curl_getaddrinfo_ex() definition and use - lib: use size_t or int etc instead of longs - libcurl-errors.3: remove duplicate word - libssh2: return error when ssh_hostkeyfunc returns error - limit-rate.d: see also --rate - log2changes.pl: wrap long lines at 80 columns - Makefile.mk: address minor issues - Makefile.mk: improve a GNU Make hack - Makefile.mk: portable Makefile.m32 - maketgz: set the right version in lib/libcurl.plist - mime: relax easy/mime structures binding - misc: Fix incorrect spelling - misc: remove duplicated include files - misc: typo and grammar fixes - negtelnetserver.py: have it call its close() method - netrc.d: provide mutext info - netware: remove leftover traces - noproxy: also match with adjacent comma - noproxy: guard against empty hostnames in noproxy check - noproxy: tailmatch like in 7.85.0 and earlier - nroff-scan.pl: detect double highlights - ntlm: improve comment for encrypt_des - ntlm: silence ubsan warning about copying from null target_info pointer - openssl/mbedtls: use %d for outputing port with failf (int) - openssl: prefix errors with '[lib]/[version]: ' - os400: use platform socklen_t in Curl_getnameinfo_a - page-header: grammar improvement (display transfer rate) - proxy: refactor haproxy protocol handling as connection filter - README.md: remove badges and xmas-tree garnish - rtsp: fix RTSP auth - runtests: --no-debuginfod now disables DEBUGINFOD_URLS - runtests: do CRLF replacements per section only - scripts/checksrc.pl: detect duplicated include files - sendf: change Curl_read_plain to wrap Curl_recv_plain - sendf: remove unnecessary if condition - setup: do not require __MRC__ defined for Mac OS 9 builds - smb/telnet: do not free the protocol struct in *_done() - socks: fix username max size is 255 (0xFF) - spellcheck.words: remove 'github' as an accepted word - ssl-reqd.d: clarify that this is for upgrading connections only - strcase: use curl_str(n)equal for case insensitive matches - styled-output.d: this option does not work on Windows - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS - system.h: support 64-bit curl_off_t for NonStop 32-bit - test1421: fix typo - test3026: reduce runtime in legacy mingw builds - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+ - tests: add authorityInfoAccess to generated certs - tests: add HTTP/3 test case, custom location for proper nghttpx - tls: backends use connection filters for IO, enabling HTTPS-proxy - tool: determine the correct fopen option for -D - tool_cfgable: free the ssl_ec_curves on exit - tool_cfgable: make socks5_gssapi_nec a boolean - tool_formparse: avoid clobbering on function params - tool_getparam: make --no-get work as the opposite of --get - tool_operate: provide better errmsg for -G with bad URL - tool_operate: when aborting, make sure there is a non-NULL error buffer - tool_paramhlp: free the proto strings on exit - url: move back the IDN conversion of proxy names - urlapi: reject more bad letters from the host name: &+() - urldata: change port num storage to int and unsigned short - vms: remove SIZEOF_SHORT - vtls: fix build without proxy support - vtls: localization of state data in filters - WEBSOCKET.md: fix broken link - Websocket: fixes for partial frames and buffer updates - websockets: fix handling of partial frames - windows: fail early with a missing windres in autotools - windows: fix linking .rc to shared curl with autotools - winidn: drop WANT_IDN_PROTOTYPES - ws: if no connection is around, return error - ws: return CURLE_NOT_BUILT_IN when websockets not built in - x509asn1: avoid freeing unallocated pointers - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fixes: * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914] * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915] * Add curl-CVE-2023-23914-23915.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - Security Fix: [bsc#1207992, CVE-2023-23916] * HTTP multi-header compression denial of service * Add curl-CVE-2023-23916.patch - Update to 7.88.0: [bsc#1207990, CVE-2023-23914] [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916] * Security fixes: - CVE-2023-23914: HSTS ignored on multiple requests - CVE-2023-23915: HSTS amnesia with --parallel - CVE-2023-23916: HTTP multi-header compression denial of service * Changes: - curl.h: add CURL_HTTP_VERSION_3ONLY - share: add sharing of HSTS cache among handles - src: add --http3-only - tool_operate: share HSTS between handles - urlapi: add CURLU_PUNYCODE - writeout: add %{certs} and %{num_certs} * Bugfixes: - cf-socket: keep sockaddr local in the socket filters - cfilters:Curl_conn_get_select_socks: use the first non-connected filter - curl.h: allow up to 10M buffer size - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated - curl/websockets.h: extend the websocket frame struct - curl: output warning at --verbose output for debug-enabled version - curl_free.3: fix return type of `curl_free` - curl_log: for failf/infof and debug logging implementations - dict: URL decode the entire path always - docs/DEPRECATE.md: deprecate gskit - easyoptions: fix header printing in generation script - haxproxy: send before TLS handhshake - hsts.d: explain hsts more - hsts: handle adding the same host name again - HTTP/[23]: continue upload when state.drain is set - http: decode transfer encoding first - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro - http_proxy: do not assign data->req.p.http use local copy - lib: connect/h2/h3 refactor - libssh2: try sha2 algos for hostkey methods - md4: fix build with GnuTLS + OpenSSL v1 - ngtcp2: replace removed define and stop using removed function - noproxy: support for space-separated names is deprecated - nss: implement data_pending method - openldap: fix missing sasl symbols at build in specific configs - openssl: adapt to boringssl's error code type - openssl: don't ignore CA paths when using Windows CA store (redux) - openssl: don't log raw record headers - openssl: make the BIO_METHOD a local variable in the connection filter - openssl: only use CA_BLOB if verifying peer - openssl: remove attached easy handles from SSL instances - openssl: store the CA after first send (ClientHello) - setopt: use >, not >=, when checking if uarg is larger than uint-max - smb: return error on upload without size - socketpair: allow localhost MITM sniffers - strdup: name it Curl_strdup - tool_getparam: fix hiding of command line secrets - tool_operate: fix error codes on bad URL & OOM - tool_operate: repair --rate - transfer: break the read loop when RECV is cleared - typecheck: accept expressions for option/info parameters - urlapi: avoid Curl_dyn_addf() for hex outputs - urlapi: skip path checks if path is just "/" - urlapi: skip the extra dedotdot alloc if no dot in path - urldata: cease storing TLS auth type - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP - urldata: make set.http200aliases conditional on HTTP being present - urldata: move the cookefilelist to the 'set' struct - urldata: remove unused struct fields, made more conditional - vquic: stabilization and improvements - vtls: fix hostname handling in filters - vtls: manage current easy handle in nested cfilter calls - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used * Rebase libcurl-ocloexec.patch * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091 - runtests: fix "uninitialized value $port" - Add curl-fix-uninitialized-value-in-tests.patch - Update to 7.88.1: * Bugfix release - Drop upstreamed patch: * curl-fix-uninitialized-value-in-tests.patch - Security fixes: * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy Add curl-CVE-2023-27534.patch * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse Add curl-CVE-2023-27535.patch * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use Add curl-CVE-2023-27536.patch * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still Add curl-CVE-2023-27538.patch - Update to 8.0.0: * Security fixes: - TELNET option IAC injection [bsc#1209209, CVE-2023-27533] - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534] - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535] - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536] - HSTS double-free [bsc#1209213, CVE-2023-27537] - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538] * Changes: - build: remove support for curl_off_t < 8 bytes * Bugfixes: - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3 - BINDINGS: add Fortran binding - cf-socket: use port 80 when resolving name for local bind - cookie: don't load cookies again when flushing - curl_path: create the new path with dynbuf - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure - ftp: active mode with SSL, add the filter - hostip: avoid sscanf and extra buffer copies - http2: fix for http2-prior-knowledge when reusing connections - http2: fix handling of RST and GOAWAY to recognize partial transfers - http: don't send 100-continue for short PUT requests - http: fix unix domain socket use in https connects - libssh: use dynbuf instead of realloc - ngtcp2-gnutls.yml: bump to gnutls 3.8.0 - sectransp: make read_cert() use a dynbuf when loading - telnet: only accept option arguments in ascii - telnet: parse telnet options without sscanf - url: fix the SSH connection reuse check - url: only reuse connections with same GSS delegation - urlapi: '%' is illegal in host names - ws: keep the socket non-blocking * Rebase libcurl-ocloexec.patch - Update to 8.0.1: * Bugfixes: - fix crash in curl_easy_cleanup - Update to 8.0.1: [jsc#PED-2580] * Rebase curl-secure-getenv.patch * Remove patches fixed in the update: - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch - curl-CVE-2022-27774-disabletest-1568.patch - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch - Security fixes: * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256 fingerprint check. - Add curl-CVE-2023-28319.patch * [bsc#1211231, CVE-2023-28320] siglongjmp race condition - Add curl-CVE-2023-28320.patch * [bsc#1211232, CVE-2023-28321] IDN wildcard matching - Add curl-CVE-2023-28321.patch * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion - Add curl-CVE-2023-28322.patch - Security fix: [bsc#1213237, CVE-2023-32001] * fopen race condition: libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called 'stat()' followed by 'fopen()' in a way that made it vulnerable to a TOCTOU race condition problem. * Add curl-CVE-2023-32001.patch - Security fix: [bsc#1215026, CVE-2023-38039] * http: return error when receiving too large header * Add curl-CVE-2023-38039.patch - Security fixes: * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow * [bsc#1215889, CVE-2023-38546] Cookie injection with none file * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch - Security fixes: * [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass * [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents * Add curl-CVE-2023-46218.patch curl-CVE-2023-46219.patch - Fix: libssh: Implement SFTP packet size limit (bsc#1216987) * Add curl-libssh_Implement_SFTP_packet_size_limit.patch - Security fix: [bsc#1221667, CVE-2024-2398] * curl: HTTP/2 push headers memory-leak * Add curl-CVE-2024-2398.patch - Security fix: [bsc#1221665, CVE-2024-2004] * Usage of disabled protocol * Add curl-CVE-2024-2004.patch - Security fix: [bsc#1228535, CVE-2024-7264] * curl: ASN.1 date parser overread * Add curl-CVE-2024-7264.patch - Security fix: [bsc#1230093, CVE-2024-8096] * curl: OCSP stapling bypass with GnuTLS * Add curl-CVE-2024-8096.patch - Make special characters in URL work with aws-sigv4 [bsc#1230516] * http_aws_sigv4: canonicalize the query [fc76a24c] * test439: verify query canonization for aws-sigv4 [65661016] * http_aws_sigv4: skip the op if the query pair is zero bytes [16bdc09e] * aws_sigv4: the query canon code miscounted URL encoded input [a1532a33] * http_aws_sigv4: canonicalise valueless query params [bbba69da] * aws-sigv4: url encode the canonical path [768909d8] * Add upstream patches: - curl-aws_sigv4-canonicalize-the-query.patch - curl-aws_sigv4-verify-query-canonization.patch - curl-aws_sigv4-skip-the-op-if-the-query-pair-is-zero-bytes.patch - curl-aws_sigv4-the-query-canon-code-miscounted-url-encoded-input.patch - curl-aws_sigv4-canonicalise-valueless-query-params.patch - curl-aws_sigv4-url-encode-the-canonical-path.patch - Security fix: [bsc#1232528, CVE-2024-9681] * HSTS subdomain overwrites parent cache entry * Add curl-CVE-2024-9681.patch - Security fix: [bsc#1234068, CVE-2024-11053] * curl could leak the password used for the first host to the followed-to host under certain circumstances. * netrc: address several netrc parser flaws * Add curl-CVE-2024-11053.patch - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Init libdbusmenu package - license update: GPL-3.0 and (LGPL-2.1 or LGPL-3.0) Interaction is not aggregation (^and^) but rather option (^or^). Also, the GPL-3.0 components are in the separate tools/ subdirectory - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Init libdbusmenu package - license update: GPL-3.0 and (LGPL-2.1 or LGPL-3.0) Interaction is not aggregation (^and^) but rather option (^or^). Also, the GPL-3.0 components are in the separate tools/ subdirectory - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - Update to version 12.10.3+14.10.20140610 + No changelog available - Update to 12.10.3+bzr20150410 (changes since 12.10.3+bzr20140610): * Use the configure-generated libtool script instead of /usr/bin/libtool, which might not match what we have. * Use gi's typelibdir pkgconfig variable and install into this directory, now that gi supports multiarch. * Parser: don't override the label for stock items if a custom one is provided. - Minor spec cleanup. - Update to 12.10.3+bzr20160223 (changes since 12.10.3+bzr20150410): * Disable test-json-instruction, hangs on builds (lp#1429291). * gtk: Look for GtkImages on regular GtkMenuItems too (lp#1549021). - Use proper libdbusmenu 16.04.0 tarball directly from launchpad: + The old tarball's configure.ac happened to still use an old version, causing the .pc file to advertise insufficient capabilities. - Modernize spec-file by calling spec-cleaner - Drop superfluous hard pkgconfig(gtk+-2.0) Requires from libdebusmenu-glib-devel sub-package. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - Drop dependency on deprecated gnome-common, just run autoreconf - Do not include unused tree_index.sgml, fix build with gtk-doc >= 1.32, see https://gitlab.gnome.org/GNOME/gtk-doc/issues/103 * add 0001-Fix-build-with-gtk-doc-1.32-due-to-non-existing-tree.patch - Fix missing accelerators, add 0002-genericmenuitem-Make-accelerator-text-appear-again.patch - Split Gtk2 and Gtk3 build - glib, tools and doc subpackage are created from the Gtk2 flavor. * Fix building with disabled tests, add 0003-Fix-HAVE_VALGRIND-AM_CONDITIONAL.patch - Work around OBS idiosyncrasies regarding packages name. - Disable testtools on %arm since Valgrind is broken on armv6/7 atm - Require the tyeplib packages from the -devel packages: typelibs are shared libraries and consumers of the -devel package have a right to assume the libraries are present. - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Ship libduktape206-32bit: needed by libproxy since version 0.5. - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Ship libduktape206-32bit: needed by libproxy since version 0.5. - Initial package - Correct RPM group. - Update to 2.1.1: * maintenance release - Update to 2.2.0: * call handling, API improvements, performance - Update to 2.2.1: * maintenance release - Update to 2.3.0: * ES2015 improvements - Update to 2.4.0: * Minor fixes and improvements - Update to 2.5.0: * CBOR support, minor fixes and improvements - spec file changes * change http to https in URLs * use RPM macros - Update to 2.6.0: * Various fixes and portability improvements. - duktape-link-m.patch: link against libm for sin() and related functions, in case the compiler with -Os creates external references. bsc#1205805 - Ship libduktape206-32bit: needed by libproxy since version 0.5. - Update to version 0.3.8+git20200710.5126fff: * Add CMake build scripts, remove autotools support * Move C++ ABI compatibility section - explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh On TW it's pulled in implicitly by libxcrypt-devel which is not the case on 15.2 - Update to version 0.4.0+git20210408.6d33e5e: * Man pages libeconf.3 and econftool.8. * Handling multiline strings. * Added libeconf_ext which returns more information like line_nr, comments, path of the configuration file,... * Econftool, an command line interface for handling configuration files. * Generating HTML API documentation with doxygen. * Improving error handling and semantic file check. * Joining entries with the same key to one single entry if env variable ECONF_JOIN_SAME_ENTRIES has been set. - Update to version 0.4.0+git20210412.1513a26: * Added econftool cat option (#146) * new API call: econf_readDirsHistory (showing ALL locations) * new API call: econf_getPath (absolute path of the configuration file) - Update to version 0.4.0+git20210413.fdb8025: * Installing man pages via meson. (#147) - Removed doxygen from build requires. - Update to version 0.4.0+git20210707.537a8a: * Fixed resource leaks found by Iker Pedrosa. - Update to version 0.4.0+git20210708.6918ea1: * Fixed covscan FORWARD_NULL_issues warnings - Update to version 0.4.1+git20210709.cf671f2: * CMake fixes regarding installation of econftool and man pages. - Update to version libeconf-0.4.2+git20211111.c7a2c52: * CMake fixes regarding document installation. * Fixed different issues while writing string values to file. * Writing comments to file too. * Fixed memory leaks. * Fixed crash while merging values. - Update to version 0.4.2+git20220104.5dfd69d: * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157) - Update to version 0.4.4+git20220104.962774f: * Fixed i586 build (#158) - Update to version 0.4.5+git20220406.c9658f2: * econftool: * * New call "syntax" for checking the configuration files only. Returns an error string with line number if an error occurs. * * New options "--comment" and "--delimeters" * * Parsing one file only if needed. - Update to version 0.4.6+git20220427.3016f4e: * econftool: * * Parsing error: Reporting file and line nr. * * --delimeters=spaces Taking all kind of spaces for delimiter * libeconf: Fixed bsc#1198165: Parsing files correctly which have space characters AND none space characters as delimiters. - Update to version 0.4.8+git20221114.7ff7704: * Parsing files which are containing keys only (#170) All delimiters are allowed now : "", " =", " ", "=". But the user should use "" in order to be distinct. * /usr/etc/shells.d/<file_name> will not be parsed if /etc/shells.d/<file_name> is defined too. * Lto build fixed (#168) * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag, econf_set_delimiter_tag * Checking UID,GroupID, permissions,... of the parsed files (#165) New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164) * Error handling improved for nums and booleans (#163) - Update to version 0.4.9: * libeconf.h: added missing sys/types.h header (#171) * new API calls: econf_readFileWithCallback, econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172) * Checking NULL comment parameter in the parsing functions. - Update to version 0.5.0: * API calls econf_read*WithCallback supporting a general (void *) argument for user defined data with which the callback function is called. * Tagged following functions deprecated: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks, econf_reset_security_settings Use one of the econf_read*WithCallback functions instead. - Update to version 0.5.1: * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless there is a /etc/_example_._suffix_ file. (#175) - Update to version 0.5.2: * Fixed build for aarch64 and gcc13. * Making the output verbose when a test fails. * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. * Fixed a stack-buffer-overflow vulnerability in "read_file" function. * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list) Sets a list of directory structures (with order) which describes the directories in which the files have to be parsed. E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following directories will be parsed: "<default_dirs>/<project_name>.<suffix>.d/" "<default_dirs>/<project_name>/conf.d/" "<default_dirs>/<project_name>.d/" "<default_dirs>/<project_name>/" The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added automatically. * General code cleanup. - Additional info for version 0.5.2: * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078) * Fixed a stack-buffer-overflow vulnerability in "read_file" function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078) - Update to version 0.3.8+git20200710.5126fff: * Add CMake build scripts, remove autotools support * Move C++ ABI compatibility section - explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh On TW it's pulled in implicitly by libxcrypt-devel which is not the case on 15.2 - Update to version 0.4.0+git20210408.6d33e5e: * Man pages libeconf.3 and econftool.8. * Handling multiline strings. * Added libeconf_ext which returns more information like line_nr, comments, path of the configuration file,... * Econftool, an command line interface for handling configuration files. * Generating HTML API documentation with doxygen. * Improving error handling and semantic file check. * Joining entries with the same key to one single entry if env variable ECONF_JOIN_SAME_ENTRIES has been set. - Update to version 0.4.0+git20210412.1513a26: * Added econftool cat option (#146) * new API call: econf_readDirsHistory (showing ALL locations) * new API call: econf_getPath (absolute path of the configuration file) - Update to version 0.4.0+git20210413.fdb8025: * Installing man pages via meson. (#147) - Removed doxygen from build requires. - Update to version 0.4.0+git20210707.537a8a: * Fixed resource leaks found by Iker Pedrosa. - Update to version 0.4.0+git20210708.6918ea1: * Fixed covscan FORWARD_NULL_issues warnings - Update to version 0.4.1+git20210709.cf671f2: * CMake fixes regarding installation of econftool and man pages. - Update to version libeconf-0.4.2+git20211111.c7a2c52: * CMake fixes regarding document installation. * Fixed different issues while writing string values to file. * Writing comments to file too. * Fixed memory leaks. * Fixed crash while merging values. - Update to version 0.4.2+git20220104.5dfd69d: * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157) - Update to version 0.4.4+git20220104.962774f: * Fixed i586 build (#158) - Update to version 0.4.5+git20220406.c9658f2: * econftool: * * New call "syntax" for checking the configuration files only. Returns an error string with line number if an error occurs. * * New options "--comment" and "--delimeters" * * Parsing one file only if needed. - Update to version 0.4.6+git20220427.3016f4e: * econftool: * * Parsing error: Reporting file and line nr. * * --delimeters=spaces Taking all kind of spaces for delimiter * libeconf: Fixed bsc#1198165: Parsing files correctly which have space characters AND none space characters as delimiters. - Update to version 0.4.8+git20221114.7ff7704: * Parsing files which are containing keys only (#170) All delimiters are allowed now : "", " =", " ", "=". But the user should use "" in order to be distinct. * /usr/etc/shells.d/<file_name> will not be parsed if /etc/shells.d/<file_name> is defined too. * Lto build fixed (#168) * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag, econf_set_delimiter_tag * Checking UID,GroupID, permissions,... of the parsed files (#165) New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164) * Error handling improved for nums and booleans (#163) - Update to version 0.4.9: * libeconf.h: added missing sys/types.h header (#171) * new API calls: econf_readFileWithCallback, econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172) * Checking NULL comment parameter in the parsing functions. - Update to version 0.5.0: * API calls econf_read*WithCallback supporting a general (void *) argument for user defined data with which the callback function is called. * Tagged following functions deprecated: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks, econf_reset_security_settings Use one of the econf_read*WithCallback functions instead. - Update to version 0.5.1: * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless there is a /etc/_example_._suffix_ file. (#175) - Update to version 0.5.2: * Fixed build for aarch64 and gcc13. * Making the output verbose when a test fails. * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. * Fixed a stack-buffer-overflow vulnerability in "read_file" function. * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list) Sets a list of directory structures (with order) which describes the directories in which the files have to be parsed. E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following directories will be parsed: "<default_dirs>/<project_name>.<suffix>.d/" "<default_dirs>/<project_name>/conf.d/" "<default_dirs>/<project_name>.d/" "<default_dirs>/<project_name>/" The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added automatically. * General code cleanup. - Additional info for version 0.5.2: * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078) * Fixed a stack-buffer-overflow vulnerability in "read_file" function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078) - Update to version 0.3.8+git20200710.5126fff: * Add CMake build scripts, remove autotools support * Move C++ ABI compatibility section - explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh On TW it's pulled in implicitly by libxcrypt-devel which is not the case on 15.2 - Update to version 0.4.0+git20210408.6d33e5e: * Man pages libeconf.3 and econftool.8. * Handling multiline strings. * Added libeconf_ext which returns more information like line_nr, comments, path of the configuration file,... * Econftool, an command line interface for handling configuration files. * Generating HTML API documentation with doxygen. * Improving error handling and semantic file check. * Joining entries with the same key to one single entry if env variable ECONF_JOIN_SAME_ENTRIES has been set. - Update to version 0.4.0+git20210412.1513a26: * Added econftool cat option (#146) * new API call: econf_readDirsHistory (showing ALL locations) * new API call: econf_getPath (absolute path of the configuration file) - Update to version 0.4.0+git20210413.fdb8025: * Installing man pages via meson. (#147) - Removed doxygen from build requires. - Update to version 0.4.0+git20210707.537a8a: * Fixed resource leaks found by Iker Pedrosa. - Update to version 0.4.0+git20210708.6918ea1: * Fixed covscan FORWARD_NULL_issues warnings - Update to version 0.4.1+git20210709.cf671f2: * CMake fixes regarding installation of econftool and man pages. - Update to version libeconf-0.4.2+git20211111.c7a2c52: * CMake fixes regarding document installation. * Fixed different issues while writing string values to file. * Writing comments to file too. * Fixed memory leaks. * Fixed crash while merging values. - Update to version 0.4.2+git20220104.5dfd69d: * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157) - Update to version 0.4.4+git20220104.962774f: * Fixed i586 build (#158) - Update to version 0.4.5+git20220406.c9658f2: * econftool: * * New call "syntax" for checking the configuration files only. Returns an error string with line number if an error occurs. * * New options "--comment" and "--delimeters" * * Parsing one file only if needed. - Update to version 0.4.6+git20220427.3016f4e: * econftool: * * Parsing error: Reporting file and line nr. * * --delimeters=spaces Taking all kind of spaces for delimiter * libeconf: Fixed bsc#1198165: Parsing files correctly which have space characters AND none space characters as delimiters. - Update to version 0.4.8+git20221114.7ff7704: * Parsing files which are containing keys only (#170) All delimiters are allowed now : "", " =", " ", "=". But the user should use "" in order to be distinct. * /usr/etc/shells.d/<file_name> will not be parsed if /etc/shells.d/<file_name> is defined too. * Lto build fixed (#168) * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag, econf_set_delimiter_tag * Checking UID,GroupID, permissions,... of the parsed files (#165) New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164) * Error handling improved for nums and booleans (#163) - Update to version 0.4.9: * libeconf.h: added missing sys/types.h header (#171) * new API calls: econf_readFileWithCallback, econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172) * Checking NULL comment parameter in the parsing functions. - Update to version 0.5.0: * API calls econf_read*WithCallback supporting a general (void *) argument for user defined data with which the callback function is called. * Tagged following functions deprecated: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks, econf_reset_security_settings Use one of the econf_read*WithCallback functions instead. - Update to version 0.5.1: * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless there is a /etc/_example_._suffix_ file. (#175) - Update to version 0.5.2: * Fixed build for aarch64 and gcc13. * Making the output verbose when a test fails. * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. * Fixed a stack-buffer-overflow vulnerability in "read_file" function. * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list) Sets a list of directory structures (with order) which describes the directories in which the files have to be parsed. E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following directories will be parsed: "<default_dirs>/<project_name>.<suffix>.d/" "<default_dirs>/<project_name>/conf.d/" "<default_dirs>/<project_name>.d/" "<default_dirs>/<project_name>/" The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added automatically. * General code cleanup. - Additional info for version 0.5.2: * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078) * Fixed a stack-buffer-overflow vulnerability in "read_file" function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078) - Update to version 0.3.8+git20200710.5126fff: * Add CMake build scripts, remove autotools support * Move C++ ABI compatibility section - explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh On TW it's pulled in implicitly by libxcrypt-devel which is not the case on 15.2 - Update to version 0.4.0+git20210408.6d33e5e: * Man pages libeconf.3 and econftool.8. * Handling multiline strings. * Added libeconf_ext which returns more information like line_nr, comments, path of the configuration file,... * Econftool, an command line interface for handling configuration files. * Generating HTML API documentation with doxygen. * Improving error handling and semantic file check. * Joining entries with the same key to one single entry if env variable ECONF_JOIN_SAME_ENTRIES has been set. - Update to version 0.4.0+git20210412.1513a26: * Added econftool cat option (#146) * new API call: econf_readDirsHistory (showing ALL locations) * new API call: econf_getPath (absolute path of the configuration file) - Update to version 0.4.0+git20210413.fdb8025: * Installing man pages via meson. (#147) - Removed doxygen from build requires. - Update to version 0.4.0+git20210707.537a8a: * Fixed resource leaks found by Iker Pedrosa. - Update to version 0.4.0+git20210708.6918ea1: * Fixed covscan FORWARD_NULL_issues warnings - Update to version 0.4.1+git20210709.cf671f2: * CMake fixes regarding installation of econftool and man pages. - Update to version libeconf-0.4.2+git20211111.c7a2c52: * CMake fixes regarding document installation. * Fixed different issues while writing string values to file. * Writing comments to file too. * Fixed memory leaks. * Fixed crash while merging values. - Update to version 0.4.2+git20220104.5dfd69d: * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157) - Update to version 0.4.4+git20220104.962774f: * Fixed i586 build (#158) - Update to version 0.4.5+git20220406.c9658f2: * econftool: * * New call "syntax" for checking the configuration files only. Returns an error string with line number if an error occurs. * * New options "--comment" and "--delimeters" * * Parsing one file only if needed. - Update to version 0.4.6+git20220427.3016f4e: * econftool: * * Parsing error: Reporting file and line nr. * * --delimeters=spaces Taking all kind of spaces for delimiter * libeconf: Fixed bsc#1198165: Parsing files correctly which have space characters AND none space characters as delimiters. - Update to version 0.4.8+git20221114.7ff7704: * Parsing files which are containing keys only (#170) All delimiters are allowed now : "", " =", " ", "=". But the user should use "" in order to be distinct. * /usr/etc/shells.d/<file_name> will not be parsed if /etc/shells.d/<file_name> is defined too. * Lto build fixed (#168) * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag, econf_set_delimiter_tag * Checking UID,GroupID, permissions,... of the parsed files (#165) New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164) * Error handling improved for nums and booleans (#163) - Update to version 0.4.9: * libeconf.h: added missing sys/types.h header (#171) * new API calls: econf_readFileWithCallback, econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172) * Checking NULL comment parameter in the parsing functions. - Update to version 0.5.0: * API calls econf_read*WithCallback supporting a general (void *) argument for user defined data with which the callback function is called. * Tagged following functions deprecated: econf_requireOwner, econf_requireGroup, econf_requirePermissions, econf_followSymlinks, econf_reset_security_settings Use one of the econf_read*WithCallback functions instead. - Update to version 0.5.1: * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless there is a /etc/_example_._suffix_ file. (#175) - Update to version 0.5.2: * Fixed build for aarch64 and gcc13. * Making the output verbose when a test fails. * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. * Fixed a stack-buffer-overflow vulnerability in "read_file" function. * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list) Sets a list of directory structures (with order) which describes the directories in which the files have to be parsed. E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following directories will be parsed: "<default_dirs>/<project_name>.<suffix>.d/" "<default_dirs>/<project_name>/conf.d/" "<default_dirs>/<project_name>.d/" "<default_dirs>/<project_name>/" The entry "<default_dirs>/<project_name>.<suffix>.d/" will be added automatically. * General code cleanup. - Additional info for version 0.5.2: * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile" function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078) * Fixed a stack-buffer-overflow vulnerability in "read_file" function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078) - Updated read_values.c for z16 machine type (bsc#1206832) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied a patch (bsc#1231003) * ziomon/ziorep_config: fix warning when multipath device is not there * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-warning-when-multipath-devi.patch - Version update to 2.2.7 (CVE-2018-20843, bsc#1139937) * Security fixes: - CVE-2018-20843 - Fix extraction of namespace prefixes from XML names; XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks * Other changes: - Autotools/CMake: Utilize -fvisibility=hidden to stop exporting non-API symbols - Autotools: Add --without-examples and --without-tests - Autotools: Modernize configure.ac - Autotools: Fix check for -fvisibility=hidden for Clang - Autotools: Fix compilation for lack of docbook2x-man - CMake: Make libdir of pkgconfig expat.pc support multilib - CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR - Remove fallback to bcopy, assume that memmove(3) exists - Removed expat-2.2.6-fix-make-clean.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Version update to 2.2.7 (CVE-2018-20843, bsc#1139937) * Security fixes: - CVE-2018-20843 - Fix extraction of namespace prefixes from XML names; XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks * Other changes: - Autotools/CMake: Utilize -fvisibility=hidden to stop exporting non-API symbols - Autotools: Add --without-examples and --without-tests - Autotools: Modernize configure.ac - Autotools: Fix check for -fvisibility=hidden for Clang - Autotools: Fix compilation for lack of docbook2x-man - CMake: Make libdir of pkgconfig expat.pc support multilib - CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR - Remove fallback to bcopy, assume that memmove(3) exists - Removed expat-2.2.6-fix-make-clean.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Version update to 2.2.7 (CVE-2018-20843, bsc#1139937) * Security fixes: - CVE-2018-20843 - Fix extraction of namespace prefixes from XML names; XML names with multiple colons could end up in the wrong namespace, and take a high amount of RAM and CPU resources while processing, opening the door to use for denial-of-service attacks * Other changes: - Autotools/CMake: Utilize -fvisibility=hidden to stop exporting non-API symbols - Autotools: Add --without-examples and --without-tests - Autotools: Modernize configure.ac - Autotools: Fix check for -fvisibility=hidden for Clang - Autotools: Fix compilation for lack of docbook2x-man - CMake: Make libdir of pkgconfig expat.pc support multilib - CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR - Remove fallback to bcopy, assume that memmove(3) exists - Removed expat-2.2.6-fix-make-clean.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - Security fix (CVE-2019-15903, bsc#1149429) * Crafted XML input results in heap-based buffer over-read by fooling the parser into changing from DTD parsing to document parsing * Added patches: - expat-CVE-2019-15903.patch - expat-CVE-2019-15903-tests.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - security update - added patches fix CVE-2024-50602 [bsc#1232579], DoS via XML_ResumeParser + expat-CVE-2024-50602.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - security update - added patches fix CVE-2024-50602 [bsc#1232579], DoS via XML_ResumeParser + expat-CVE-2024-50602.patch - Version update to 2.2.8 * Security fixes: (CVE-2019-15903, bsc#1149429) - CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype; * Bug fixes: - Fix cases where XML_StopParser did not have any effect when called from inside of an end element handler - xmlwf: Fix exit code for operation without "-d DIRECTORY"; previously, only "-d DIRECTORY" would give you a proper exit code: Now both cases return exit code 2. * Other changes: - examples: Improve elements.c - Autotools: Add argument --enable-xml-attr-info - Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom - Autotools: Fix linking issues with "./configure LD=clang" - Autotools: Fix "make run-xmltest" for out-of-source builds - CMake: Pull all options from Expat <=2.2.7 into namespace - CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF - CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF - CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO - CMake: Install expat_config.h to include directory - CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..]) - CMake: Now produces a summary of applied configuration - CMake: Require C++ compiler only when tests are enabled - CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON) - CMake: Port "make run-xmltest" from GNU Autotools to CMake - CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF - Removed patches fixed in the update: * expat-CVE-2019-15903.patch * expat-CVE-2019-15903-tests.patch - Version update to 2.2.9 * Other changes: - examples: Drop executable bits from elements.c [#349] Windows: Change the name of the Windows DLLs from expat*.dll to libexpat*.dll once more (regression from 2.2.8, first fixed in 1.95.3, issue #61 on SourceForge today, was issue #432456 back then); needs a fix due case-insensitive file systems on Windows and the fact that Perl's XML::Parser::Expat compiles into Expat.dll. [#347] Windows: Only define _CRT_RAND_S if not defined Version info bumped from 7:10:6 to 7:11:6 - Update to 2.2.10: * Bug fixes: - Fix undefined behavior during parsing caused by pointer arithmetic with NULL pointers - Fix reading uninitialized variable during parsing - xmlwf: Add missing check for malloc NULL return * Other changes: - xmlwf: Document exit codes in xmlwf manpage and exit with code 3 (rather than code 1) for output errors when used with "-d DIRECTORY" - Autotools: Use -Werror while configure tests the compiler for supported compile flags to avoid false positives - Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g. ensure that they have the last word over flags added while running ./configure - CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Detect and deny unsupported build combinations involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t) - CMake: Install pre-compiled shipped xmlwf.1 manpage in case of -DEXPAT_BUILD_DOCS=OFF - CMake: Fix use of Expat by means of add_subdirectory - CMake: Keep expat target name constant at "expat" (i.e. refrain from using the target name to control build artifact filenames) - CMake: Expose man page compilation as target "xmlwf-manpage" - CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control generation of pkg-config file "expat.pc" - CMake: Add minimalistic support for building binary packages with CMake target "package"; based on CPack - CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default OFF to build fuzzer code against OSS-Fuzz and related environment variable LIB_FUZZING_ENGINE - Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF - Address compiler warnings - Address pngcheck warnings with doc/*.png images: Version info bumped from 7:11:6 to 7:12:6 - update to 2.3.0: * When calling XML_ParseBuffer without a prior successful call to XML_GetBuffer as a user, no longer trigger undefined behavior (by adding an integer to a NULL pointer) but rather return XML_STATUS_ERROR and set the error code to (new) code XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer) of Clang 11 (but not Clang 9). * xmlwf: Exit status 2 was used for both: - malformed input files (documented) and - invalid command-line arguments (undocumented). case of invalid command-line arguments now has its own exit status 4, resolving the ambiguity. * Other changes - Do not BuildRequire cmake: expat is part of the distro bootstrap cycle and any additional dependency makes the ring larger. In this case here, cmake was even only used to own a directory. - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"] * Security fixes: - CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks (denial-of-service; flavors targeting CPU time or RAM or both, leveraging general entities or parameter entities or both) by tracking and limiting the input amplification factor (<amplification> := (<direct> + <indirect>) / <direct>). By conservative default, amplification up to a factor of 100.0 is tolerated and rejection only starts after 8 MiB of output bytes (=<direct> + <indirect>) have been processed. The fix adds the following to the API: - A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to signals this specific condition. - Two new API functions .. - XML_SetBillionLaughsAttackProtectionMaximumAmplification and - XML_SetBillionLaughsAttackProtectionActivationThreshold .. to further tighten billion laughs protection parameters when desired. Please see file "doc/reference.html" for details. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. - Two new XML_FEATURE_* constants .. - that can be queried using the XML_GetFeatureList function, and - that are shown in "xmlwf -v" output. - Two new environment variable switches .. - EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and - EXPAT_ENTITY_DEBUG=(0|1) .. for runtime debugging of accounting and entity processing. Specific behavior of these values may change in the future. - Two new command line arguments "-a FACTOR" and "-b BYTES" for xmlwf to further tighten billion laughs protection parameters when desired. If you ever need to increase the defaults for non-attack XML payload, please file a bug report with libexpat. * Bug fixes: - For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake) or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault for UTF-16 payloads containing CDATA sections. - Autotools: Fix generated CMake files for non-64bit and non-Linux platforms (e.g. macOS and MinGW in particular) that were introduced with release 2.3.0 * Other changes: - xmlwf: Improve help output and the xmlwf man page - xmlwf: Improve maintainability through some refactoring - xmlwf: Fix man page DocBook validity - CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR - CMake: Add support for standard variable BUILD_SHARED_LIBS - Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters - Resolve macro HAVE_EXPAT_CONFIG_H - Delete unused legacy helper file "conftools/PrintPath" - doc/reference.html: Fix XHTML validity - doc/reference.html: Replace the 90s look by OK.css - Version info bumped from 8:0:7 to 9:0:8 due to addition of new symbols and error codes; see https://verbump.de/ for what these numbers do - Update to 2.4.1: * Bug fixes: - Autotools: Fix installed header expat_config.h for multilib systems; regression introduced in 2.4.0 by pull request #486 * Other changes: - Version info bumped from 9:0:8 to 9:1:8; see https://verbump.de/ for what these numbers do - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253] * Remove expat-CVE-2018-20843.patch upstream - update to 2.4.2: * Link againgst libm for function "isnan" * Include expat_config.h as early as possible * Autotools: Include files with release archives: - buildconf.sh - fuzz/*.c * Autotools: Sync CMake templates * docs: Document that function XML_GetBuffer may return NULL when asking for a buffer of 0 (zero) bytes size * docs: Fix return value docs for both XML_SetBillionLaughsAttackProtection* functions * Version info bumped from 9:1:8 to 9:2:8 - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. - update to 2.4.4 (bsc#1195217, bsc#1195054): * Security fixes: - CVE-2022-23852 -- Fix signed integer overflow (undefined behavior) in function XML_GetBuffer that is also called by function XML_Parse internally) for when XML_CONTEXT_BYTES is defined to >0 (which is both common and default). Impact is denial of service or more. - CVE-2022-23990 -- Fix unsigned integer overflow in function doProlog triggered by large content in element type declarations when there is an element declaration handler present (from a prior call to XML_SetElementDeclHandler). Impact is denial of service or more. * Bug fixes: - xmlwf: Fix a memory leak on output file opening error * Other changes: - Version info bumped from 9:3:8 to 9:4:8; see https://verbump.de/ for what these numbers do * Drop unused file valid-xhtml10.png - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - Security fixes: * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs - Added expat-CVE-2022-25236.patch * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before 2.4.5 does not check whether a UTF-8 character is valid in a certain context. - Added expat-CVE-2022-25235.patch * (CVE-2022-25313, bsc#1196168) Stack exhaustion in build_model() via uncontrolled recursion - Added expat-CVE-2022-25313.patch - The fix upstream introduced a regression that was later amended in 2.4.6 version + Added expat-CVE-2022-25313-fix-regression.patch * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString - Added expat-CVE-2022-25314.patch * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames - Added expat-CVE-2022-25315.patch - Security fixes: * (CVE-2022-25236, bsc#1196784) [>=2.4.5] Fix to CVE-2022-25236 breaks biboumi, ClairMeta, jxmlease, libwbxml, openleadr-python, rnv, xmltodict - Added expat-CVE-2022-25236-relax-fix.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2023-52425, bsc#1219559) denial of service (resource consumption) caused by processing large tokens. - Added patch expat-CVE-2023-52425-1.patch - Added patch expat-CVE-2023-52425-2.patch - Added patch expat-CVE-2023-52425-backport-parser-changes.patch - Added patch expat-CVE-2023-52425-fix-tests.patch - Security fix (boo#1221289, CVE-2024-28757): XML Entity Expansion attack when there is isolated use of external parsers. * Added expat-CVE-2024-28757.patch - Security fix (bsc#1229932, CVE-2024-45492): detect integer overflow in function nextScaffoldPart * Added expat-CVE-2024-45492.patch - Security fix (bsc#1229931, CVE-2024-45491): detect integer overflow in dtdCopy * Added expat-CVE-2024-45491.patch - Security fix (bsc#1229930, CVE-2024-45490): reject negative len for XML_ParseBuffer * Added expat-CVE-2024-45490.patch - security update - added patches fix CVE-2024-50602 [bsc#1232579], DoS via XML_ResumeParser + expat-CVE-2024-50602.patch - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Package e2scrub unit files and separate scrubbing bits into a separate subpackage e2fsprogs-scrub - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - Use FAT LTO objects in order to provide proper static library. - Fix build with gettext 0.20: * Add e2fsprogs-1.45.2-gettext.patch. * Exclude in-sources intl/ directory from build. - Fix install_info_delete usage: It must be called in preun. - Update to 1.45.3: * Whether or not automatic online scrubbing will be called is now controlled in /etc/e2scrub.conf. * Fix e2fsck handling of filesystems with large_dir and inline directories * Fix e2scrub_all for encrypted LUKS partitions * Fix e2scrub_all volume cleanup * Regression tests cleanups and improvements * Fixed compiler warnings * Translation fixes and updates (boo#1170964) - Update to 1.45.4: * A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck. (Addresses CVE-2019-5094) * E2fsck now checks to make sure the casefold flag is only set on directories, and only when the casefold feature is enabled * E2fsck will not disable the low dtime checks when using a backup superblock where the last mount time is zero * Scrubbing scripts fixes * Update translations - Update to 1.45.5: * Fix out of bounds write when checking maliciously corrupted filesystem * Remove unnecessary sleep in e2scrub * Fix spurious emails from e2scrub_all * Fix crash in e2fsck when rebuilding very large directories * Improve resize2fs minimum fs size estimates when the fs is mounted * Fix UBSAN failures when fuzzing filesystem images * Fix potential memory leak in read_bitmap() in libext2fs * Speedup e2fsck on file systems with a very large number of inodes * fuse2fs fixes - Update to 1.45.6: * Debugfs will ignore lines in its command files which start with a comment character ("#") * Fix a number of potential out of bounds memory accesses caused by fuzzed / malicious file systems * Fix a spurious complaint from e2fsck when a directory which previously had more than 32000 subdirectories has the number of subdirectories drops below 32000 * Fix an ismounted check when an LVM device is renamed while the device is mounted * Mke2fs -d now correctly sets permission with files where the owner permissions are not rwx * Improve e2fsck's ability to deal with file systems with very large number of directories, such that various data structures take more than 2GiB of memory. Use better structure packing to improve the memory efficiency of these data structures. * Fix debugfs so it correctly prints inode numbers > 2**31. * Filefrag now supports very large files (with > 4 billion blocks), as well as block sizes up to 1 GiB. * Update and clarify various man pages * Reserved the error code EXT2_ET_NO_GDESC (which will be used in e2fsprogs v1.46+) * Add a thread-safe variant of e2p_feature2string(), e2p_feature_to_string() to the libe2p library. * Fixed portability problems caused by gcc 10. * Synchroniz changes from Android's AOSP e2fsprogs tree * Update the Malay translation from the translation project - add upstream signing key and verify source signature - prepare usrmerge (boo#1029961) - Fix usage of info macros on openSUSE, we use file triggers today - Use file requires for post section - Update to 1.46.1: * Fix setting extended attributes in libext2fs and debugfs * Fix e2fsck to accept large_dir directories greater than 4G * Fix fast commit support on big endian architectures * Fix mke2fs -d to correctly import a small file stored using inline_data feature and which has ACL or extended attribute * Various compilation fixes * Speedup bitmap loading for large filesystems using multiple threads * Speedup mke2fs for bigalloc filesystems * E2fsck fixes when rehashing directories * Fix e2fsck crashes on maliciously corrupted filesystems * Fix e2fsck handling of duplicated case-folded file names * Implement hashed directory support in libext2fs * Support for fast commit feature * Support for combination of casefolding and encryption * Support for stable inodes feature * Add support for per-inode DAX flag * Fix tune2fs to unlock MMP on failure * Fix e2fsck buffer overflow when scanning directory blocks * Fix resize2fs overflowing block group descriptors with 1k block size - delete e2fsprogs-1.45.2-gettext.patch - it was merged upstream - Add autoconf-archive to build requirements - Fix installation of info files for older distros - Remove autoreconf (and resulting dependencies) from the spec file. The upstream configure script should be fine. - e2fsprogs 1.46.2: * tune2fs -c now takes "random" argument * Add support for the FS_NOCOMP_FL flag to chattr and lsattr * Fix warnings when resizing small file systems to a super-large * Fix the debugfs rdump and ls commands so they will work correctly for uid's and gid's => 65536 * Fix the debugfs write and symlink commands so they support targets which contain a pathname * Fix Direct I/O support on block devices where the logical block size is greater 1k * Fix debugfs's logdump so it works on file systems whose block size is greater than 8k * Fix a crash when there is error while e2fsck is trying to open the file system, and e2fsck calls ext2fs_mmp_stop() before MMP has been initialized * Improved error checking in the fast commit replay code in e2fsck * Fix various compiler and Coverity warnings * Update the Spanish translation from the translation project - Fix the %doc files. RELEASE-NOTES is a symlink to doc/RelNotes/v%version. - Update to 1.46.3: * Add -V and -VV options to filefrag * Fix fs corruption cause by resize2fs on filesystems with MMP blocks * Fast commit portability fixes * Fix direct IO support in Unix IO manager * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices * Fix mke2fs to not discard blocks beyond end of filesystem * Make e2fsck set filetype of '.' and '..' entries * Fix QCOW image generation in e2image for very large filesystems * Update translations - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_e2scrub@.service.patch * harden_e2scrub_all.service.patch * harden_e2scrub_fail@.service.patch * harden_e2scrub_reap.service.patch - Update to 1.46.4: * Default to 256-byte inodes for all filesystems, not only larger ones * Bigalloc is considered supported now for small cluster sizes * E2fsck and e2image fixes for quota feature * Fix mke2fs creation of filesystem into non-existent file - libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer libreadline.so.8 to dlopen path (bsc#1189453) - quota-Add-support-to-version-0-quota-format.patch: quota: Add support to version 0 quota format (jsc#SLE-17360) quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360) quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360) tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota files (jsc#SLE-17360) e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not trash user limits when processing orphan list (jsc#SLE-17360) debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota commands (jsc#SLE-17360) quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360) - add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships with them - Add references from old package: Autoreconf removed from the spec file, just without bsc reference (bsc#1183791) Fix po-remove-unnecessary-buggy-positional-parameter-spe.patch in 1.45.3 (bsc#1170964) Fix e2fsck-clarify-overflow-link-count-error-message.patch in 1.46.0 (bsc#1160979) Fix ext2fs-update-allocation-info-earlier-in-ext2fs_mkdi.patch in 1.46.0 (bsc#1160979) Fix ext2fs-implement-dir-entry-creation-in-htree-directo.patch in 1.46.0 (bsc#1160979) Fix tests-add-test-to-excercise-indexed-directories-with.patch in 1.46.0 (bsc#1160979) Fix tune2fs-update-dir-checksums-when-clearing-dir_index.patch in 1.46.0 (bsc#1160979) Fix e2fsck-abort-if-there-is-a-corrupted-directory-block.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix e2fsck-don-t-try-to-rehash-a-deleted-directory.patch in 1.45.5 (bsc#1160571 CVE-2019-5188) Fix resize2fs-Make-minimum-size-estimates-more-reliable.patch in 1.45.5 (bsc#1154295) Fix libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch in 1.45.4 (bsc#1152101 CVE-2019-5094) Fix libext2fs-call-fsync-2-to-clear-stale-errors-for-a-n.patch in 1.44.3 (bsc#1145716) Fix e2fsck-check-and-fix-tails-of-all-bitmaps.patch in 1.45.1 (bsc#1128383) Fix libext2fs-Fix-fsync-2-detection.patch in 1.44.0 (bsc#1038194) Fix resize2fs-Fix-32-64-bit-overflow-when-multiplying-by-blocks-cl.patch in 1.42.12 (bsc#1009532) Fix libext2fs-fix-potential-buffer-overflow-in-closefs.patch in 1.42.13 (bsc#918346 CVE-2015-1572) Fix libext2fs-avoid-buffer-overflow-if-s_first_meta_bg-i.patch in 1.42.12 (bsc#915402 CVE-2015-0247) Got specfile fix through Factory (bsc#960273) Fix libext2fs-don-t-ignore-fsync-errors.patch in 1.43.4 (bsc#1038194) - libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add sanity check to extent manipulation (bsc#1198446 CVE-2022-1304) EA Inode handling fixes: - ext2fs-avoid-re-reading-inode-multiple-times.patch: ext2fs: avoid re-reading inode multiple times (bsc#1223596) - e2fsck-fix-potential-out-of-bounds-read-in-inc_ea_in.patch: e2fsck: fix potential out-of-bounds read in inc_ea_inode_refs() (bsc#1223596) - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more checks for ea inode consistency (bsc#1223596) - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output of several tests (bsc#1223596) - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check number of group descriptors only if meta_bg is disabled (bsc#1230145) - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - Version 1.1.0 (released 2019-05-08) * EdDSA (Ed25519) support. * fido_dev_make_cred: fix order of CBOR map keys. * fido_dev_get_assert: plug memory leak when operating on U2F devices. - Version 1.2.0 (released 2019-07-26) * Credential management support. * New API reflecting FIDO’s 3-state booleans (true, false, absent): - fido_assert_set_up; - fido_assert_set_uv; - fido_cred_set_rk; - fido_cred_set_uv. * Command-line tools for Windows. * Documentation and reliability fixes. * fido_{assert,cred}_set_options() are now marked as deprecated. - Version 1.3.0 (2019-11-28) * assert/hmac: encode public key as per spec, gh#60. * fido2-cred: fix creation of resident keys. * fido2-{assert,cred}: support for hmac-secret extension. * hid_osx: detect device removal, gh#56. * hid_osx: fix device detection in MacOS Catalina. * New API calls: - fido_assert_set_authdata_raw; - fido_assert_sigcount; - fido_cred_set_authdata_raw; - fido_dev_cancel. * Middleware library for use by OpenSSH. * Support for biometric enrollment. * Support for OpenBSD. * Support for self-attestation. - Version 1.3.1 - fix zero-ing of le1 and le2 when talking to a U2F device. - dropping sk-libfido2 middleware, please find it in the openssh tree. - Update to version 1.4.0 * hid_hidapi: hidapi backend; enable with -DUSE_HIDAPI=1. * Fall back to U2F if the key claims to, but does not support FIDO2. * FIDO2 credential protection (credprot) support. * New API calls: + fido_cbor_info_fwversion; + fido_cred_prot; + fido_cred_set_prot; + fido_dev_set_transport_functions; + fido_set_log_handler. * Fixed EdDSA and RSA self-attestation. - Don't build with hidapi support to fix issues with Yubikey 5Ci https://github.com/Yubico/libfido2/issues/190 - Create a udev subpackage and ship the udev rule - Cleanup udev rules, trying to use the Debian specific plugdev group fills up the journal. - Make the udev rules package noarch, correct Summary - Update to version 1.5.0 * hid_linux: return FIDO_OK if no devices are found. * hid_osx: + repair communication with U2F tokens, gh#166; + reliability fixes. * fido2-{assert,cred}: new options to explicitly toggle UP, UV. * Support for configurable report lengths. * New API calls: + fido_cbor_info_maxcredcntlst + fido_cbor_info_maxcredidlen + fido_cred_aaguid_len + fido_cred_aaguid_ptr + fido_dev_get_touch_begin + fido_dev_get_touch_status * Use COSE_ECDH_ES256 with CTAP_CBOR_CLIENT_PIN; gh#154. * Allow CTAP messages up to 2048 bytes; gh#171. * Ensure we only list USB devices by default. - Add 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch from upstream to fix 32bit compilation issues. - Add Conflicts: to supersede version 1.0.0. This is needed for a clean upgrade path on SLE. - Update to version 1.6.0: * Fix OpenSSL 1.0 and Cygwin builds. * hid_linux: fix build on 32-bit systems. * hid_osx: allow reads from spawned threads. * Documentation and reliability fixes. * New API calls: + fido_cred_authdata_raw_len; + fido_cred_authdata_raw_ptr; + fido_cred_sigcount; + fido_dev_get_uv_retry_count; + fido_dev_supports_credman. * Hardened Windows build. * Native FreeBSD and NetBSD support. * Use CTAP2 canonical CBOR when combining hmac-secret and credProtect. - Drop 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch - Do not build examples as their build fails - Update to version 1.7.0: * hid_win: detect devices with vendor or product IDs > 0x7fff * Support for FIDO 2.1 authenticator configuration. * Support for FIDO 2.1 UV token permissions. * Support for FIDO 2.1 "credBlobs" and "largeBlobs" extensions. * New API calls * New fido_init flag to disable fido_dev_open’s U2F fallback * Experimental NFC support on Linux. - Enabled hidapi again, issues related to hidapi are fixed upstream * Added fix-cmake-linking.patch to fix linking - Update to version 1.8.0: * Dropped 'Requires.private' entry from pkg-config file. * Better support for FIDO 2.1 authenticators. * Support for Windows's native webauthn API. * Support for attestation format 'none'. * New API calls: - fido_assert_set_clientdata; - fido_cbor_info_algorithm_cose; - fido_cbor_info_algorithm_count; - fido_cbor_info_algorithm_type; - fido_cbor_info_transports_len; - fido_cbor_info_transports_ptr; - fido_cred_set_clientdata; - fido_cred_set_id; - fido_credman_set_dev_rk; - fido_dev_is_winhello. * fido2-token: new -Sc option to update a resident credential. * Documentation and reliability fixes. * HID access serialisation on Linux. - disable fix-cmake-linking.patch, not needed currently - Removed fix-cmake-linking.patch because no longer needed - Version 1.9.0 (2021-10-27) * Enabled NFC support on Linux. * Added OpenSSL 3.0 compatibility. * Removed OpenSSL 1.0 compatibility. * Support for FIDO 2.1 "minPinLength" extension. * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation. * Support for TPM 2.0 attestation. * Support for device timeouts; see fido_dev_set_timeout(). * New API calls: - es256_pk_from_EVP_PKEY; - fido_cred_attstmt_len; - fido_cred_attstmt_ptr; - fido_cred_pin_minlen; - fido_cred_set_attstmt; - fido_cred_set_pin_minlen; - fido_dev_set_pin_minlen_rpid; - fido_dev_set_timeout; - rs256_pk_from_EVP_PKEY. * Reliability and portability fixes. * Better handling of HID devices without identification strings; gh#381. * Fixed detection of Windows’s native webauthn API; gh#382. - Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x is now supported. - Version 1.10.0 (2022-01-17) * hid_osx: handle devices with paths > 511 bytes; gh#462. * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480. * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails. * winhello: fallback to hid_win.c if webauthn.dll isn’t available. * New API calls: - fido_dev_info_set; - fido_dev_io_handle; - fido_dev_new_with_info; - fido_dev_open_with_info. * Cygwin and NetBSD build fixes. * Documentation and reliability fixes. * Support for TPM 2.0 attestation of COSE_ES256 credentials. - Version 1.12.0 (2022-09-22) * Support for COSE_ES384. * Support for hidraw(4) on FreeBSD; gh#597. * Improved support for FIDO 2.1 authenticators. * New API calls: + es384_pk_free; + es384_pk_from_EC_KEY; + es384_pk_from_EVP_PKEY; + es384_pk_from_ptr; + es384_pk_new; + es384_pk_to_EVP_PKEY; + fido_cbor_info_certs_len; + fido_cbor_info_certs_name_ptr; + fido_cbor_info_certs_value_ptr; + fido_cbor_info_maxrpid_minpinlen; + fido_cbor_info_minpinlen; + fido_cbor_info_new_pin_required; + fido_cbor_info_rk_remaining; + fido_cbor_info_uv_attempts; + fido_cbor_info_uv_modality. * Documentation and reliability fixes. - Version 1.11.0 (2022-05-03) * Experimental PCSC support; enable with -DUSE_PCSC. * Improved OpenSSL 3.0 compatibility. * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs. * winhello: advertise "uv" instead of "clientPin". * winhello: support hmac-secret in fido_dev_get_assert(). * New API calls: + fido_cbor_info_maxlargeblob. * Documentation and reliability fixes. * Separate build and regress targets. - Version 1.13.0 (2023-02-20) * Support for linking against OpenSSL on Windows; gh#668. * New API calls: + fido_assert_empty_allow_list; + fido_cred_empty_exclude_list. * fido2-token: fix issue when listing large blobs. * Improved support for different fuzzing engines. - Version 1.1.0 (released 2019-05-08) * EdDSA (Ed25519) support. * fido_dev_make_cred: fix order of CBOR map keys. * fido_dev_get_assert: plug memory leak when operating on U2F devices. - Version 1.2.0 (released 2019-07-26) * Credential management support. * New API reflecting FIDO’s 3-state booleans (true, false, absent): - fido_assert_set_up; - fido_assert_set_uv; - fido_cred_set_rk; - fido_cred_set_uv. * Command-line tools for Windows. * Documentation and reliability fixes. * fido_{assert,cred}_set_options() are now marked as deprecated. - Version 1.3.0 (2019-11-28) * assert/hmac: encode public key as per spec, gh#60. * fido2-cred: fix creation of resident keys. * fido2-{assert,cred}: support for hmac-secret extension. * hid_osx: detect device removal, gh#56. * hid_osx: fix device detection in MacOS Catalina. * New API calls: - fido_assert_set_authdata_raw; - fido_assert_sigcount; - fido_cred_set_authdata_raw; - fido_dev_cancel. * Middleware library for use by OpenSSH. * Support for biometric enrollment. * Support for OpenBSD. * Support for self-attestation. - Version 1.3.1 - fix zero-ing of le1 and le2 when talking to a U2F device. - dropping sk-libfido2 middleware, please find it in the openssh tree. - Update to version 1.4.0 * hid_hidapi: hidapi backend; enable with -DUSE_HIDAPI=1. * Fall back to U2F if the key claims to, but does not support FIDO2. * FIDO2 credential protection (credprot) support. * New API calls: + fido_cbor_info_fwversion; + fido_cred_prot; + fido_cred_set_prot; + fido_dev_set_transport_functions; + fido_set_log_handler. * Fixed EdDSA and RSA self-attestation. - Don't build with hidapi support to fix issues with Yubikey 5Ci https://github.com/Yubico/libfido2/issues/190 - Create a udev subpackage and ship the udev rule - Cleanup udev rules, trying to use the Debian specific plugdev group fills up the journal. - Make the udev rules package noarch, correct Summary - Update to version 1.5.0 * hid_linux: return FIDO_OK if no devices are found. * hid_osx: + repair communication with U2F tokens, gh#166; + reliability fixes. * fido2-{assert,cred}: new options to explicitly toggle UP, UV. * Support for configurable report lengths. * New API calls: + fido_cbor_info_maxcredcntlst + fido_cbor_info_maxcredidlen + fido_cred_aaguid_len + fido_cred_aaguid_ptr + fido_dev_get_touch_begin + fido_dev_get_touch_status * Use COSE_ECDH_ES256 with CTAP_CBOR_CLIENT_PIN; gh#154. * Allow CTAP messages up to 2048 bytes; gh#171. * Ensure we only list USB devices by default. - Add 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch from upstream to fix 32bit compilation issues. - Add Conflicts: to supersede version 1.0.0. This is needed for a clean upgrade path on SLE. - Update to version 1.6.0: * Fix OpenSSL 1.0 and Cygwin builds. * hid_linux: fix build on 32-bit systems. * hid_osx: allow reads from spawned threads. * Documentation and reliability fixes. * New API calls: + fido_cred_authdata_raw_len; + fido_cred_authdata_raw_ptr; + fido_cred_sigcount; + fido_dev_get_uv_retry_count; + fido_dev_supports_credman. * Hardened Windows build. * Native FreeBSD and NetBSD support. * Use CTAP2 canonical CBOR when combining hmac-secret and credProtect. - Drop 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch - Do not build examples as their build fails - Update to version 1.7.0: * hid_win: detect devices with vendor or product IDs > 0x7fff * Support for FIDO 2.1 authenticator configuration. * Support for FIDO 2.1 UV token permissions. * Support for FIDO 2.1 "credBlobs" and "largeBlobs" extensions. * New API calls * New fido_init flag to disable fido_dev_open’s U2F fallback * Experimental NFC support on Linux. - Enabled hidapi again, issues related to hidapi are fixed upstream * Added fix-cmake-linking.patch to fix linking - Update to version 1.8.0: * Dropped 'Requires.private' entry from pkg-config file. * Better support for FIDO 2.1 authenticators. * Support for Windows's native webauthn API. * Support for attestation format 'none'. * New API calls: - fido_assert_set_clientdata; - fido_cbor_info_algorithm_cose; - fido_cbor_info_algorithm_count; - fido_cbor_info_algorithm_type; - fido_cbor_info_transports_len; - fido_cbor_info_transports_ptr; - fido_cred_set_clientdata; - fido_cred_set_id; - fido_credman_set_dev_rk; - fido_dev_is_winhello. * fido2-token: new -Sc option to update a resident credential. * Documentation and reliability fixes. * HID access serialisation on Linux. - disable fix-cmake-linking.patch, not needed currently - Removed fix-cmake-linking.patch because no longer needed - Version 1.9.0 (2021-10-27) * Enabled NFC support on Linux. * Added OpenSSL 3.0 compatibility. * Removed OpenSSL 1.0 compatibility. * Support for FIDO 2.1 "minPinLength" extension. * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation. * Support for TPM 2.0 attestation. * Support for device timeouts; see fido_dev_set_timeout(). * New API calls: - es256_pk_from_EVP_PKEY; - fido_cred_attstmt_len; - fido_cred_attstmt_ptr; - fido_cred_pin_minlen; - fido_cred_set_attstmt; - fido_cred_set_pin_minlen; - fido_dev_set_pin_minlen_rpid; - fido_dev_set_timeout; - rs256_pk_from_EVP_PKEY. * Reliability and portability fixes. * Better handling of HID devices without identification strings; gh#381. * Fixed detection of Windows’s native webauthn API; gh#382. - Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x is now supported. - Version 1.10.0 (2022-01-17) * hid_osx: handle devices with paths > 511 bytes; gh#462. * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480. * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails. * winhello: fallback to hid_win.c if webauthn.dll isn’t available. * New API calls: - fido_dev_info_set; - fido_dev_io_handle; - fido_dev_new_with_info; - fido_dev_open_with_info. * Cygwin and NetBSD build fixes. * Documentation and reliability fixes. * Support for TPM 2.0 attestation of COSE_ES256 credentials. - Version 1.12.0 (2022-09-22) * Support for COSE_ES384. * Support for hidraw(4) on FreeBSD; gh#597. * Improved support for FIDO 2.1 authenticators. * New API calls: + es384_pk_free; + es384_pk_from_EC_KEY; + es384_pk_from_EVP_PKEY; + es384_pk_from_ptr; + es384_pk_new; + es384_pk_to_EVP_PKEY; + fido_cbor_info_certs_len; + fido_cbor_info_certs_name_ptr; + fido_cbor_info_certs_value_ptr; + fido_cbor_info_maxrpid_minpinlen; + fido_cbor_info_minpinlen; + fido_cbor_info_new_pin_required; + fido_cbor_info_rk_remaining; + fido_cbor_info_uv_attempts; + fido_cbor_info_uv_modality. * Documentation and reliability fixes. - Version 1.11.0 (2022-05-03) * Experimental PCSC support; enable with -DUSE_PCSC. * Improved OpenSSL 3.0 compatibility. * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs. * winhello: advertise "uv" instead of "clientPin". * winhello: support hmac-secret in fido_dev_get_assert(). * New API calls: + fido_cbor_info_maxlargeblob. * Documentation and reliability fixes. * Separate build and regress targets. - Version 1.13.0 (2023-02-20) * Support for linking against OpenSSL on Windows; gh#668. * New API calls: + fido_assert_empty_allow_list; + fido_cred_empty_exclude_list. * fido2-token: fix issue when listing large blobs. * Improved support for different fuzzing engines. - Version 1.1.0 (released 2019-05-08) * EdDSA (Ed25519) support. * fido_dev_make_cred: fix order of CBOR map keys. * fido_dev_get_assert: plug memory leak when operating on U2F devices. - Version 1.2.0 (released 2019-07-26) * Credential management support. * New API reflecting FIDO’s 3-state booleans (true, false, absent): - fido_assert_set_up; - fido_assert_set_uv; - fido_cred_set_rk; - fido_cred_set_uv. * Command-line tools for Windows. * Documentation and reliability fixes. * fido_{assert,cred}_set_options() are now marked as deprecated. - Version 1.3.0 (2019-11-28) * assert/hmac: encode public key as per spec, gh#60. * fido2-cred: fix creation of resident keys. * fido2-{assert,cred}: support for hmac-secret extension. * hid_osx: detect device removal, gh#56. * hid_osx: fix device detection in MacOS Catalina. * New API calls: - fido_assert_set_authdata_raw; - fido_assert_sigcount; - fido_cred_set_authdata_raw; - fido_dev_cancel. * Middleware library for use by OpenSSH. * Support for biometric enrollment. * Support for OpenBSD. * Support for self-attestation. - Version 1.3.1 - fix zero-ing of le1 and le2 when talking to a U2F device. - dropping sk-libfido2 middleware, please find it in the openssh tree. - Update to version 1.4.0 * hid_hidapi: hidapi backend; enable with -DUSE_HIDAPI=1. * Fall back to U2F if the key claims to, but does not support FIDO2. * FIDO2 credential protection (credprot) support. * New API calls: + fido_cbor_info_fwversion; + fido_cred_prot; + fido_cred_set_prot; + fido_dev_set_transport_functions; + fido_set_log_handler. * Fixed EdDSA and RSA self-attestation. - Don't build with hidapi support to fix issues with Yubikey 5Ci https://github.com/Yubico/libfido2/issues/190 - Create a udev subpackage and ship the udev rule - Cleanup udev rules, trying to use the Debian specific plugdev group fills up the journal. - Make the udev rules package noarch, correct Summary - Update to version 1.5.0 * hid_linux: return FIDO_OK if no devices are found. * hid_osx: + repair communication with U2F tokens, gh#166; + reliability fixes. * fido2-{assert,cred}: new options to explicitly toggle UP, UV. * Support for configurable report lengths. * New API calls: + fido_cbor_info_maxcredcntlst + fido_cbor_info_maxcredidlen + fido_cred_aaguid_len + fido_cred_aaguid_ptr + fido_dev_get_touch_begin + fido_dev_get_touch_status * Use COSE_ECDH_ES256 with CTAP_CBOR_CLIENT_PIN; gh#154. * Allow CTAP messages up to 2048 bytes; gh#171. * Ensure we only list USB devices by default. - Add 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch from upstream to fix 32bit compilation issues. - Add Conflicts: to supersede version 1.0.0. This is needed for a clean upgrade path on SLE. - Update to version 1.6.0: * Fix OpenSSL 1.0 and Cygwin builds. * hid_linux: fix build on 32-bit systems. * hid_osx: allow reads from spawned threads. * Documentation and reliability fixes. * New API calls: + fido_cred_authdata_raw_len; + fido_cred_authdata_raw_ptr; + fido_cred_sigcount; + fido_dev_get_uv_retry_count; + fido_dev_supports_credman. * Hardened Windows build. * Native FreeBSD and NetBSD support. * Use CTAP2 canonical CBOR when combining hmac-secret and credProtect. - Drop 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch - Do not build examples as their build fails - Update to version 1.7.0: * hid_win: detect devices with vendor or product IDs > 0x7fff * Support for FIDO 2.1 authenticator configuration. * Support for FIDO 2.1 UV token permissions. * Support for FIDO 2.1 "credBlobs" and "largeBlobs" extensions. * New API calls * New fido_init flag to disable fido_dev_open’s U2F fallback * Experimental NFC support on Linux. - Enabled hidapi again, issues related to hidapi are fixed upstream * Added fix-cmake-linking.patch to fix linking - Update to version 1.8.0: * Dropped 'Requires.private' entry from pkg-config file. * Better support for FIDO 2.1 authenticators. * Support for Windows's native webauthn API. * Support for attestation format 'none'. * New API calls: - fido_assert_set_clientdata; - fido_cbor_info_algorithm_cose; - fido_cbor_info_algorithm_count; - fido_cbor_info_algorithm_type; - fido_cbor_info_transports_len; - fido_cbor_info_transports_ptr; - fido_cred_set_clientdata; - fido_cred_set_id; - fido_credman_set_dev_rk; - fido_dev_is_winhello. * fido2-token: new -Sc option to update a resident credential. * Documentation and reliability fixes. * HID access serialisation on Linux. - disable fix-cmake-linking.patch, not needed currently - Removed fix-cmake-linking.patch because no longer needed - Version 1.9.0 (2021-10-27) * Enabled NFC support on Linux. * Added OpenSSL 3.0 compatibility. * Removed OpenSSL 1.0 compatibility. * Support for FIDO 2.1 "minPinLength" extension. * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation. * Support for TPM 2.0 attestation. * Support for device timeouts; see fido_dev_set_timeout(). * New API calls: - es256_pk_from_EVP_PKEY; - fido_cred_attstmt_len; - fido_cred_attstmt_ptr; - fido_cred_pin_minlen; - fido_cred_set_attstmt; - fido_cred_set_pin_minlen; - fido_dev_set_pin_minlen_rpid; - fido_dev_set_timeout; - rs256_pk_from_EVP_PKEY. * Reliability and portability fixes. * Better handling of HID devices without identification strings; gh#381. * Fixed detection of Windows’s native webauthn API; gh#382. - Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x is now supported. - Version 1.10.0 (2022-01-17) * hid_osx: handle devices with paths > 511 bytes; gh#462. * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480. * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails. * winhello: fallback to hid_win.c if webauthn.dll isn’t available. * New API calls: - fido_dev_info_set; - fido_dev_io_handle; - fido_dev_new_with_info; - fido_dev_open_with_info. * Cygwin and NetBSD build fixes. * Documentation and reliability fixes. * Support for TPM 2.0 attestation of COSE_ES256 credentials. - Version 1.12.0 (2022-09-22) * Support for COSE_ES384. * Support for hidraw(4) on FreeBSD; gh#597. * Improved support for FIDO 2.1 authenticators. * New API calls: + es384_pk_free; + es384_pk_from_EC_KEY; + es384_pk_from_EVP_PKEY; + es384_pk_from_ptr; + es384_pk_new; + es384_pk_to_EVP_PKEY; + fido_cbor_info_certs_len; + fido_cbor_info_certs_name_ptr; + fido_cbor_info_certs_value_ptr; + fido_cbor_info_maxrpid_minpinlen; + fido_cbor_info_minpinlen; + fido_cbor_info_new_pin_required; + fido_cbor_info_rk_remaining; + fido_cbor_info_uv_attempts; + fido_cbor_info_uv_modality. * Documentation and reliability fixes. - Version 1.11.0 (2022-05-03) * Experimental PCSC support; enable with -DUSE_PCSC. * Improved OpenSSL 3.0 compatibility. * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs. * winhello: advertise "uv" instead of "clientPin". * winhello: support hmac-secret in fido_dev_get_assert(). * New API calls: + fido_cbor_info_maxlargeblob. * Documentation and reliability fixes. * Separate build and regress targets. - Version 1.13.0 (2023-02-20) * Support for linking against OpenSSL on Windows; gh#668. * New API calls: + fido_assert_empty_allow_list; + fido_cred_empty_exclude_list. * fido2-token: fix issue when listing large blobs. * Improved support for different fuzzing engines. - Version 1.1.0 (released 2019-05-08) * EdDSA (Ed25519) support. * fido_dev_make_cred: fix order of CBOR map keys. * fido_dev_get_assert: plug memory leak when operating on U2F devices. - Version 1.2.0 (released 2019-07-26) * Credential management support. * New API reflecting FIDO’s 3-state booleans (true, false, absent): - fido_assert_set_up; - fido_assert_set_uv; - fido_cred_set_rk; - fido_cred_set_uv. * Command-line tools for Windows. * Documentation and reliability fixes. * fido_{assert,cred}_set_options() are now marked as deprecated. - Version 1.3.0 (2019-11-28) * assert/hmac: encode public key as per spec, gh#60. * fido2-cred: fix creation of resident keys. * fido2-{assert,cred}: support for hmac-secret extension. * hid_osx: detect device removal, gh#56. * hid_osx: fix device detection in MacOS Catalina. * New API calls: - fido_assert_set_authdata_raw; - fido_assert_sigcount; - fido_cred_set_authdata_raw; - fido_dev_cancel. * Middleware library for use by OpenSSH. * Support for biometric enrollment. * Support for OpenBSD. * Support for self-attestation. - Version 1.3.1 - fix zero-ing of le1 and le2 when talking to a U2F device. - dropping sk-libfido2 middleware, please find it in the openssh tree. - Update to version 1.4.0 * hid_hidapi: hidapi backend; enable with -DUSE_HIDAPI=1. * Fall back to U2F if the key claims to, but does not support FIDO2. * FIDO2 credential protection (credprot) support. * New API calls: + fido_cbor_info_fwversion; + fido_cred_prot; + fido_cred_set_prot; + fido_dev_set_transport_functions; + fido_set_log_handler. * Fixed EdDSA and RSA self-attestation. - Don't build with hidapi support to fix issues with Yubikey 5Ci https://github.com/Yubico/libfido2/issues/190 - Create a udev subpackage and ship the udev rule - Cleanup udev rules, trying to use the Debian specific plugdev group fills up the journal. - Make the udev rules package noarch, correct Summary - Update to version 1.5.0 * hid_linux: return FIDO_OK if no devices are found. * hid_osx: + repair communication with U2F tokens, gh#166; + reliability fixes. * fido2-{assert,cred}: new options to explicitly toggle UP, UV. * Support for configurable report lengths. * New API calls: + fido_cbor_info_maxcredcntlst + fido_cbor_info_maxcredidlen + fido_cred_aaguid_len + fido_cred_aaguid_ptr + fido_dev_get_touch_begin + fido_dev_get_touch_status * Use COSE_ECDH_ES256 with CTAP_CBOR_CLIENT_PIN; gh#154. * Allow CTAP messages up to 2048 bytes; gh#171. * Ensure we only list USB devices by default. - Add 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch from upstream to fix 32bit compilation issues. - Add Conflicts: to supersede version 1.0.0. This is needed for a clean upgrade path on SLE. - Update to version 1.6.0: * Fix OpenSSL 1.0 and Cygwin builds. * hid_linux: fix build on 32-bit systems. * hid_osx: allow reads from spawned threads. * Documentation and reliability fixes. * New API calls: + fido_cred_authdata_raw_len; + fido_cred_authdata_raw_ptr; + fido_cred_sigcount; + fido_dev_get_uv_retry_count; + fido_dev_supports_credman. * Hardened Windows build. * Native FreeBSD and NetBSD support. * Use CTAP2 canonical CBOR when combining hmac-secret and credProtect. - Drop 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch - Do not build examples as their build fails - Update to version 1.7.0: * hid_win: detect devices with vendor or product IDs > 0x7fff * Support for FIDO 2.1 authenticator configuration. * Support for FIDO 2.1 UV token permissions. * Support for FIDO 2.1 "credBlobs" and "largeBlobs" extensions. * New API calls * New fido_init flag to disable fido_dev_open’s U2F fallback * Experimental NFC support on Linux. - Enabled hidapi again, issues related to hidapi are fixed upstream * Added fix-cmake-linking.patch to fix linking - Update to version 1.8.0: * Dropped 'Requires.private' entry from pkg-config file. * Better support for FIDO 2.1 authenticators. * Support for Windows's native webauthn API. * Support for attestation format 'none'. * New API calls: - fido_assert_set_clientdata; - fido_cbor_info_algorithm_cose; - fido_cbor_info_algorithm_count; - fido_cbor_info_algorithm_type; - fido_cbor_info_transports_len; - fido_cbor_info_transports_ptr; - fido_cred_set_clientdata; - fido_cred_set_id; - fido_credman_set_dev_rk; - fido_dev_is_winhello. * fido2-token: new -Sc option to update a resident credential. * Documentation and reliability fixes. * HID access serialisation on Linux. - disable fix-cmake-linking.patch, not needed currently - Removed fix-cmake-linking.patch because no longer needed - Version 1.9.0 (2021-10-27) * Enabled NFC support on Linux. * Added OpenSSL 3.0 compatibility. * Removed OpenSSL 1.0 compatibility. * Support for FIDO 2.1 "minPinLength" extension. * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation. * Support for TPM 2.0 attestation. * Support for device timeouts; see fido_dev_set_timeout(). * New API calls: - es256_pk_from_EVP_PKEY; - fido_cred_attstmt_len; - fido_cred_attstmt_ptr; - fido_cred_pin_minlen; - fido_cred_set_attstmt; - fido_cred_set_pin_minlen; - fido_dev_set_pin_minlen_rpid; - fido_dev_set_timeout; - rs256_pk_from_EVP_PKEY. * Reliability and portability fixes. * Better handling of HID devices without identification strings; gh#381. * Fixed detection of Windows’s native webauthn API; gh#382. - Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x is now supported. - Version 1.10.0 (2022-01-17) * hid_osx: handle devices with paths > 511 bytes; gh#462. * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480. * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails. * winhello: fallback to hid_win.c if webauthn.dll isn’t available. * New API calls: - fido_dev_info_set; - fido_dev_io_handle; - fido_dev_new_with_info; - fido_dev_open_with_info. * Cygwin and NetBSD build fixes. * Documentation and reliability fixes. * Support for TPM 2.0 attestation of COSE_ES256 credentials. - Version 1.12.0 (2022-09-22) * Support for COSE_ES384. * Support for hidraw(4) on FreeBSD; gh#597. * Improved support for FIDO 2.1 authenticators. * New API calls: + es384_pk_free; + es384_pk_from_EC_KEY; + es384_pk_from_EVP_PKEY; + es384_pk_from_ptr; + es384_pk_new; + es384_pk_to_EVP_PKEY; + fido_cbor_info_certs_len; + fido_cbor_info_certs_name_ptr; + fido_cbor_info_certs_value_ptr; + fido_cbor_info_maxrpid_minpinlen; + fido_cbor_info_minpinlen; + fido_cbor_info_new_pin_required; + fido_cbor_info_rk_remaining; + fido_cbor_info_uv_attempts; + fido_cbor_info_uv_modality. * Documentation and reliability fixes. - Version 1.11.0 (2022-05-03) * Experimental PCSC support; enable with -DUSE_PCSC. * Improved OpenSSL 3.0 compatibility. * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs. * winhello: advertise "uv" instead of "clientPin". * winhello: support hmac-secret in fido_dev_get_assert(). * New API calls: + fido_cbor_info_maxlargeblob. * Documentation and reliability fixes. * Separate build and regress targets. - Version 1.13.0 (2023-02-20) * Support for linking against OpenSSL on Windows; gh#668. * New API calls: + fido_assert_empty_allow_list; + fido_cred_empty_exclude_list. * fido2-token: fix issue when listing large blobs. * Improved support for different fuzzing engines. - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Amend License: field with BSD2c, from https://github.com/libfuse/libfuse/commit/4c699e7debd99b178b9574e7dd20f36937ef296e#diff-3f1e2bdc537057b6ac2f74d095a431b8 - Update to 3.5.0: * Changed ioctl commands to "unsigned int" in order to support commands which do not fit into a signed int. Commands issued by applications are still truncated to 32 bits. * Added SMB2 to whitelist (so users can now mount FUSE filesystems on mountpoints within SMB 2.0 filesystems). * Added a new cache_readdir flag to fuse_file_info to enable caching of readdir results. Supported by kernels 4.20 and newer. * Add support and documentation for FUSE_CAP_NO_OPENDIR_SUPPORT. - Update to version 3.6.0 * Added a new example (passthrough_hp). The functionality is similar to passthrough_ll, but the implementation focuses on performance and correctness rather than simplicity. * Added support for fuse kernel feature max_pages which allows to increase the maximum number of pages that can be used per request. This feature was introduced in kernel 4.20. max_pages is set based on the value in max_write. By default max_write will be 1MiB now for kernels that support max_pages. If you want smaller buffers or writes you have to set max_write manually. - Update to version 3.6.1 (bsc#1137860) * Fixed version number (release 3.6.0 was shipped with a declared version of 3.0.0). - Disable LTO due to symbol versioning (boo#1138803). - Update to version 3.6.2 * The init script is now installed to /etc/ rather than /usr/local/etc by default. * Minor bugfixes - Drop fuse-install-fix.patch, not needed with -Duseroot=false - Add conf-rename.patch, which is split from the above now removed patch - Update to version 3.8.0 * Added support for FUSE_LSEEK operation which can be used to report holes in sparse files. - Update to version 3.9.0 * Added support for FUSE_EXPLICIT_INVAL_DATA to enable onl invalidate cached pages on explicit request. - Update to version 3.9.1 * Fixed memory leak in fuse_session_new(). * Fixed an issue with the linker version script. * Make ioctl prototype conditional on FUSE_USE_VERSION. Define FUSE_USE_VERSION < 35 to get old ioctl prototype with int commands; define FUSE_USE_VERSION >= 35 to get new ioctl prototype with unsigned int commands. * Various small bugfixes. - Update to version 3.9.2 * Remove obsolete workarounds in examples. * Do not require C++ compiler for building. * Minor bugfixes. - Drop BR on c++_compiler - Update to version 3.9.3 * Minor bugfixes, documentation updates - Update to release 3.10.0 * Add FUSE_CAP_CACHE_SYMLINKS: allow caching symlinks in kernel page cache. - Drop /sbin links; they do not seem to be used from anywhere. - Package "permission" is required in %post, not %pre. - Update descriptions. - Update to release 3.10.1 * Unspecified "various minor fixes" - prepare usrmerge (boo#1029961) - Update to release 3.10.2 * Allow "nonempty" as a mount option, for backwards compatibility with fusermount 2. The option has no effect since mounting over non-empty directories is allowed by default. * FUSE filesystems can now be mounted underneath EXFAT mountpoints. - Update to release 3.10.3 * Fix returning d_ino and d_type from readdir(3) in non-plus mode - Update to release 3.10.4 * Source code: fixed memory leaks in examples. - Update to release 3.10.5 * Various improvements to make unit tests more robust. - Update fuse3 to the version >= 3.9.1 (jsc#SLE-21826) - Amend License: field with BSD2c, from https://github.com/libfuse/libfuse/commit/4c699e7debd99b178b9574e7dd20f36937ef296e#diff-3f1e2bdc537057b6ac2f74d095a431b8 - Update to 3.5.0: * Changed ioctl commands to "unsigned int" in order to support commands which do not fit into a signed int. Commands issued by applications are still truncated to 32 bits. * Added SMB2 to whitelist (so users can now mount FUSE filesystems on mountpoints within SMB 2.0 filesystems). * Added a new cache_readdir flag to fuse_file_info to enable caching of readdir results. Supported by kernels 4.20 and newer. * Add support and documentation for FUSE_CAP_NO_OPENDIR_SUPPORT. - Update to version 3.6.0 * Added a new example (passthrough_hp). The functionality is similar to passthrough_ll, but the implementation focuses on performance and correctness rather than simplicity. * Added support for fuse kernel feature max_pages which allows to increase the maximum number of pages that can be used per request. This feature was introduced in kernel 4.20. max_pages is set based on the value in max_write. By default max_write will be 1MiB now for kernels that support max_pages. If you want smaller buffers or writes you have to set max_write manually. - Update to version 3.6.1 (bsc#1137860) * Fixed version number (release 3.6.0 was shipped with a declared version of 3.0.0). - Disable LTO due to symbol versioning (boo#1138803). - Update to version 3.6.2 * The init script is now installed to /etc/ rather than /usr/local/etc by default. * Minor bugfixes - Drop fuse-install-fix.patch, not needed with -Duseroot=false - Add conf-rename.patch, which is split from the above now removed patch - Update to version 3.8.0 * Added support for FUSE_LSEEK operation which can be used to report holes in sparse files. - Update to version 3.9.0 * Added support for FUSE_EXPLICIT_INVAL_DATA to enable onl invalidate cached pages on explicit request. - Update to version 3.9.1 * Fixed memory leak in fuse_session_new(). * Fixed an issue with the linker version script. * Make ioctl prototype conditional on FUSE_USE_VERSION. Define FUSE_USE_VERSION < 35 to get old ioctl prototype with int commands; define FUSE_USE_VERSION >= 35 to get new ioctl prototype with unsigned int commands. * Various small bugfixes. - Update to version 3.9.2 * Remove obsolete workarounds in examples. * Do not require C++ compiler for building. * Minor bugfixes. - Drop BR on c++_compiler - Update to version 3.9.3 * Minor bugfixes, documentation updates - Update to release 3.10.0 * Add FUSE_CAP_CACHE_SYMLINKS: allow caching symlinks in kernel page cache. - Drop /sbin links; they do not seem to be used from anywhere. - Package "permission" is required in %post, not %pre. - Update descriptions. - Update to release 3.10.1 * Unspecified "various minor fixes" - prepare usrmerge (boo#1029961) - Update to release 3.10.2 * Allow "nonempty" as a mount option, for backwards compatibility with fusermount 2. The option has no effect since mounting over non-empty directories is allowed by default. * FUSE filesystems can now be mounted underneath EXFAT mountpoints. - Update to release 3.10.3 * Fix returning d_ino and d_type from readdir(3) in non-plus mode - Update to release 3.10.4 * Source code: fixed memory leaks in examples. - Update to release 3.10.5 * Various improvements to make unit tests more robust. - Update fuse3 to the version >= 3.9.1 (jsc#SLE-21826) - Amend License: field with BSD2c, from https://github.com/libfuse/libfuse/commit/4c699e7debd99b178b9574e7dd20f36937ef296e#diff-3f1e2bdc537057b6ac2f74d095a431b8 - Update to 3.5.0: * Changed ioctl commands to "unsigned int" in order to support commands which do not fit into a signed int. Commands issued by applications are still truncated to 32 bits. * Added SMB2 to whitelist (so users can now mount FUSE filesystems on mountpoints within SMB 2.0 filesystems). * Added a new cache_readdir flag to fuse_file_info to enable caching of readdir results. Supported by kernels 4.20 and newer. * Add support and documentation for FUSE_CAP_NO_OPENDIR_SUPPORT. - Update to version 3.6.0 * Added a new example (passthrough_hp). The functionality is similar to passthrough_ll, but the implementation focuses on performance and correctness rather than simplicity. * Added support for fuse kernel feature max_pages which allows to increase the maximum number of pages that can be used per request. This feature was introduced in kernel 4.20. max_pages is set based on the value in max_write. By default max_write will be 1MiB now for kernels that support max_pages. If you want smaller buffers or writes you have to set max_write manually. - Update to version 3.6.1 (bsc#1137860) * Fixed version number (release 3.6.0 was shipped with a declared version of 3.0.0). - Disable LTO due to symbol versioning (boo#1138803). - Update to version 3.6.2 * The init script is now installed to /etc/ rather than /usr/local/etc by default. * Minor bugfixes - Drop fuse-install-fix.patch, not needed with -Duseroot=false - Add conf-rename.patch, which is split from the above now removed patch - Update to version 3.8.0 * Added support for FUSE_LSEEK operation which can be used to report holes in sparse files. - Update to version 3.9.0 * Added support for FUSE_EXPLICIT_INVAL_DATA to enable onl invalidate cached pages on explicit request. - Update to version 3.9.1 * Fixed memory leak in fuse_session_new(). * Fixed an issue with the linker version script. * Make ioctl prototype conditional on FUSE_USE_VERSION. Define FUSE_USE_VERSION < 35 to get old ioctl prototype with int commands; define FUSE_USE_VERSION >= 35 to get new ioctl prototype with unsigned int commands. * Various small bugfixes. - Update to version 3.9.2 * Remove obsolete workarounds in examples. * Do not require C++ compiler for building. * Minor bugfixes. - Drop BR on c++_compiler - Update to version 3.9.3 * Minor bugfixes, documentation updates - Update to release 3.10.0 * Add FUSE_CAP_CACHE_SYMLINKS: allow caching symlinks in kernel page cache. - Drop /sbin links; they do not seem to be used from anywhere. - Package "permission" is required in %post, not %pre. - Update descriptions. - Update to release 3.10.1 * Unspecified "various minor fixes" - prepare usrmerge (boo#1029961) - Update to release 3.10.2 * Allow "nonempty" as a mount option, for backwards compatibility with fusermount 2. The option has no effect since mounting over non-empty directories is allowed by default. * FUSE filesystems can now be mounted underneath EXFAT mountpoints. - Update to release 3.10.3 * Fix returning d_ino and d_type from readdir(3) in non-plus mode - Update to release 3.10.4 * Source code: fixed memory leaks in examples. - Update to release 3.10.5 * Various improvements to make unit tests more robust. - Update fuse3 to the version >= 3.9.1 (jsc#SLE-21826) - Amend the spec file to detect SLE/openSUSE (bsc#990228) - Relax the requirement of efivar-devel and disable the efivar API patch for openSUSE Leap 42.x and SLE - Enable efivar API patch based on pkg-config data and require at least gnu-efi-3.0.2. (ramification of FATE#322108) - Remove the debug source and info of the EFI files when disabling the debug build (bsc#1031554) + Also remove the efi-debuginfo subpackage since the debug file is packaged correctly now. - Update to 9+git21.gcd8f7d7 (FATE#322805) - Add the new BuildRequires: libsmbios-devel - Update the so version of libfwup - Refresh fwupdate-suse-build.patch - Remove the upstream patches + fwupdate-fix-efivar-0.24-api.patch + fwupdate-bsc988000-set-a-mode-with-efi_set_variable.patch + fwupdate-unset-immutable-flag.patch - Drop fwupdate-bsc988886-add-leading-space.patch (Need shim >= 11) - Add fwupdate-list-firmware-types.patch to list the supported firmware types - Add back fwupdate-bsc988886-add-leading-space.patch due to the long pending shim signature request. Also drop the shim version requirement. - disable _unique_debug_names fow now fwupdate wants to install it's own debug files, but doesn't know about this option yet - EFI updates through fwupdate are also possible on Aarch64. smbios support is only relevant for some Dell machines, i.e. x86 only. - bring back accidental removed needssslcertforbuild - Remove fwupdate-bsc988886-add-leading-space.patch and bump the shim version requirement since we got the new signature for shim (bsc#1054712) - Require shim only for x86_64 (bsc#1088434) - Update to version 11 + lots of fixes from cov-scan and clang analyzer + support for Lenovo machines + experimental support for UI Capsules + Dell WMI support + lots of bugfixes + configurable EFI ESP location by setting ESPMOUNTPOINT or the git config property fwupdate.espmountdir during the build. + Lots of coverity work + ABI compatibility checking during the release process + Make subdirectory builds work - removed fwupdate-list-firmware-types.patch - Correct the requirement of efivar-devel version - Update to version 12 (FATE#326702) + Better CI. + Limit how large our WMI buffer can be. + Add fwup_version() because fwupd wants it. + Fix linking on (some) platforms that need libgcc_eh.a. + abicheck improvements. + Default to creating a UX capsule, whatever it may actually do. - Refresh fwupdate-suse-build.patch with quilt. - Use url for source tarball and license tag for COPYING. - Amend the spec file to avoid fwup*.efi from being removed mistakenly (bsc#1112832) - Move 'efi'-executables to '/usr/share/efi' (FATE#326960) - Fix the destination of 'efi'-executables for i586 (FATE#326960) - Add fwupdate-bsc1152928-update-aarch64-linker-script.patch to update the linker script for AArch64 to match the one in gnu-efi (bsc#1152928) - Add fwupdate-bsc1182057-add-sbat-support.patch to add SBAT section to EFI images (bsc#1182057) + Also specify the vendor SBAT - Update the email address of security team in SBAT (bsc#1221301) - Update fwupdate-bsc1182057-add-sbat-support.patch for elf_aarch64_efi.lds to set the memory permission explicitly to avoid ld warning like "LOAD segment with RWX permissions" - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - third bugfix release * some regressions in CI worked out * a bit of everything, and nothing too crazy - supersedes u_0001-gallivm-Fix-LLVM-optimization-with-the-new-pass-mana.patch - supersedes u_nouveau-corrupted-colors-boo1203949.patch - get rid of Mesa-libVulkan-devel(-32bit) package, which is no longer needed at all by providing/obsoleting it by libvulkan_intel - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - try to fix build on ppc64le due to running OOM (boo#1205441) * let's request 20G of physical memory via _constraints file - update to 22.2.4: * clover: windows: library filename has \`-1` suffix and a \`lib` prefix when built with mingw * radv, dxvk: Rendering errors in World of Tanks after "Switch to dynamic rendering only" * gen9 gt3e/gt4e skus fail dEQP-VK.pipeline.multisample.sample_locations_ext.* * v3d: Wrong colors (pink) in videos in Firefox (likely YUV->RGB shader issue) * panfrost t860 glmark-es2 regression * radv: Flickering in Spider-Man Remastered (Regression) (Bisected) * radv: Hitman 2 using Direct3D 12 has discolored squares on RDNA2 with DCC enabled * panfrost/midgard - on Duckstation PSX emulator: segfault on GLES 3.0 and bad shader compilations on 3.3 - spefile: removed Release lines from libxatracker2, libxatracker-devel packages in the hope to have reproducibly builds also on Tumbleweed (boo#1205998) - Update to version 22.3.0: * See https://docs.mesa3d.org/relnotes/22.3.0.html - Update to version 22.3.1: * See https://docs.mesa3d.org/relnotes/22.3.1.html - Update to version 22.3.2: * See https://docs.mesa3d.org/relnotes/22.3.2.html - Remove the libXvMC_nouveau and libXvMC_r600 packages as XVMC support was removed. - Add libvdpau_virtio_gpu package for VirtIO GPU. - Rebase n_drirc-disable-rgb10-for-chromium-on-amd.patch. - Rebase u_dep_xcb.patch. - Rebase U_fix-mpeg1_2-decode-mesa-20.2.patch. - Drop n_buildfix-21.3.0.patch: fixed upstream. - don't try to generate libvdpau_virtio_gpu package on ppc64le; for some reason this driver doesn't get built on this platform - Update list of gallium-drivers to match default list - Update to version 22.3.3: * See https://docs.mesa3d.org/relnotes/22.3.3.html - Fix some deprecation warnings * WARNING: option "false" deprecated, please use "disabled" instead. * WARNING: option "true" deprecated, please use "enabled" instead. - Compile with gcc12 on Leaps: building drivers fails with: /usr/include/dxguids/dxguids.h:70:1: internal compiler error: in cxx_eval_bit_field_ref, at cp/constexpr.c:2578 - Add support for Rusticl - Mesa's new OpenCL implementation. * See https://docs.mesa3d.org/rusticl You will need to set your environment to use it * See https://docs.mesa3d.org/envvars#rusticl-environment-variables - re-enable build on Leap, but only for 15.5; there is no gcc12 on Leap 15.4, which is now officially required by Mesa 22.3 - Add BuildRequires for x264 and x265 in case video_codecs should be built. - force usage of gcc 12 only on Leap 15.5; there is no gcc12 on Leap 15.4 - using gcc 12 now also on Leap 15.4; after changing build project to openSUSE:Leap:15.4:Update gcc 12 packages are found now ... - removing again BuildRequires for x264 and x265 in case video_codecs should be built (these were never needed nor used for build) - Update to version 22.3.4 * bug fix release which fixes bugs found since Mesa 22.3.3 * see https://docs.mesa3d.org/relnotes/22.3.4.html for more details - Don't enable rusticl without opencl - Update to version 22.3.5 * bug fix release which fixes bugs found since Mesa 22.3.4 * see https://docs.mesa3d.org/relnotes/22.3.5.html for more details - refreshed u_dep_xcb.patch - U_ReturnME.patch * fixes blackscreen in Return To Monkey Island on Intel graphics (boo#1208145) - u_mesa-CVE-2023-45913.patch * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId() (CVE-2023-45913, bsc#1222040) - u_mesa-CVE-2023-45919.patch * buffer over-read in glXQueryServerString() (CVE-2023-45919, bsc#1222041) - u_mesa-CVE-2023-45922.patch * segmentation violation in __glXGetDrawableAttribute() (CVE-2023-45922, bsc#1222042) - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: Add missing requirements for the SLI [bsc#1190698] * Remove 3DES from FIPS approved algorithms: - gnutls-Remove-3DES-from-FIPS-approved-algos.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1570 * DRBG service (gnutls_rnd) should be considered approved: - gnutls-Add-missing-FIPS-service-indicator-transitions.patch - gnutls-Add-missing-FIPS-service-indicator-transitions-tests.patch - gnutls-pkcs12-tighten-algorithm-checks-under-FIPS.patch - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1569 - FIPS: Make sure zeroization is performed in all API functions * Add gnutls-zeroization-API-functions.patch [bsc#1191021] * Upsream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1573 - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: * Add gnutls_ECDSA_signing.patch [bsc#1190698] - Check minimum keylength for symmetric key generation - Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) * Add gnutls-FIPS-force-self-test.patch [bsc#1198979] - Provides interface for running library self tests on-demand - Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1598 - FIPS: * Modify gnutls-FIPS-force-self-test.patch [bsc#1198979] - gnutls_fips140_run_self_tests now properly releases fips_context - Security fix: [bsc#1202020, CVE-2022-2509] * Fixed double free during verification of pkcs7 signatures * Add gnutls-CVE-2022-2509.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - FIPS: Port GnuTLS to use jitterentropy [bsc#1202146, jsc#SLE-24941] * Add new dependency on jitterentropy * Add gnutls-FIPS-jitterentropy.patch - FIPS: Additional modifications to the SLI. [bsc#1190698] * Mark CMAC and GMAC and non-approved in gnutls_pbkfd2(). * Mark HMAC keylength less than 112 bits as non-approved in gnutls_pbkfd2(). * Adapt the pbkdf2 selftest and the regression tests accordingly. * Add gnutls-FIPS-SLI-pbkdf2-verify-keylengths-only-SHA.patch - FIPS: Zeroize the calculated hmac and new_hmac in the check_binary_integrity() function. [bsc#1191021] * Add gnutls-FIPS-Zeroize-check_binary_integrity.patch - FIPS: Make XTS key check failure not fatal [bsc#1203779] * Add gnutls-Make-XTS-key-check-failure-not-fatal.patch - FIPS: Set error state when jent init failed in FIPS mode [bsc#1202146] * Add patch gnutls-FIPS-Set-error-state-when-jent-init-failed.patch - Fix AVX CPU feature detection for OSXSAVE [bsc#1203299] * Fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virutal systems. * Upstream bug: https://gitlab.com/gnutls/gnutls/issues/1282 * Add gnutls-clear-AVX-bits-if-it-cannot-be-queried-XSAVE.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Add gnutls-FIPS-PCT-DH.patch gnutls-FIPS-PCT-ECDH.patch - FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346] * Add gnutls-FIPS-140-3-references.patch - Security Fix: [bsc#1208143, CVE-2023-0361] * Bleichenbacher oracle in TLS RSA key exchange * Add gnutls-CVE-2023-0361.patch - FIPS: GnuTLS DH/ECDH PCT public key regeneration [bsc#1207183] * Rebase patches with the version submitted upstream. * Avoid copying the key material: gnutls-FIPS-PCT-DH.patch * Improve logic around memory release: gnutls-FIPS-PCT-ECDH.patch - FIPS: Make the jitterentropy calls thread-safe [bsc#1208146] * Add gnutls-FIPS-jitterentropy-threadsafe.patch - FIPS: Fix pct_test() return code in case of error [bsc#1207183] * Rebase with the upstream version: gnutls-FIPS-PCT-DH.patch - libgnutls: Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562] * Upstream: https://gitlab.com/gnutls/gnutls/commit/f032324a * Add gnutls-increase-TLS-PSK-username-limit.patch - FIPS: PBKDF2 additional requirements [bsc#1209001] * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N) * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1) * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2) * Set the minimum passlen of 20 characters (SP SP800-132 sec 5) * Add regression tests for the new PBKDF2 requirements. * Add gnutls-FIPS-pbkdf2-additional-requirements.patch - Security fix: [bsc#1217277, CVE-2023-5981] * Fix timing side-channel inside RSA-PSK key exchange. * auth/rsa_psk: side-step potential side-channel * Add curl-CVE-2023-5981.patch - Security fix: [bsc#1218865, CVE-2024-0553] * Incomplete fix for CVE-2023-5981. * The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. * Add gnutls-CVE-2024-0553.patch - Security fix: [bsc#1218862, CVE-2024-0567] * gnutls: rejects certificate chain with distributed trust * Cockpit (which uses gnuTLS) rejects certificate chain with distributed trust. * Add gnutls-CVE-2024-0567.patch - jitterentropy: Release the memory of the entropy collector when using jitterentropy with phtreads as there is also a pre-intitization done in the main thread. [bsc#1221242] * Add gnutls-FIPS-jitterentropy-deinit-threads.patch - Security fix: [bsc#1221746, CVE-2024-28834] * gnutls: side-channel in the deterministic ECDSA * Add gnutls-CVE-2024-28834.patch - Security fix: [bsc#1221747, CVE-2024-28835] * gnutls: certtool crash when verifying a certificate chain * Add gnutls-CVE-2024-28835.patch - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Drop patches fixed upstream on SLE and Leap 15.4: + glib2-add-support-for-slim-timezone-format.patch + glib2-fix-6-days-until-the-end-of-the-month.patch + glib2-CVE-2021-27218.patch + glib2-CVE-2021-27219-add-g_memdup2.patch - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add 63e7864.patch: Fix build with glibc 2.34: use 3 parameters for close_range (boo#1189088). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 2.68.4: + Various bugfixes and backports from master. + Updated translations. - Drop 63e7864.patch: fixed upstream. - Update to version 2.69.0: + Fix a crash in `GKeyFile` when parsing a file which contains translations using a `GKeyFile` instance which has loaded another file previously. + Ensure `dlerror()` is used with locking as it’s not thread-safe in some libc implementations. + Drop internal libpcre copy in favour of a subproject from wrapdb. + Optimise grefcount atomic operations. + Fix `g_date_time_format()` return value encoding if `LC_TIME` is not a UTF-8 locale but other locale settings are. + Set app name in freedesktop.org notifications with `GNotification`. + Add PKCS#11 flags to `GTlsPasswordFlags`. - Drop -Dinternal_pcre=false meson parameter: follow upstreams build recipe changes. - Update to version 2.69.1: + Support categories in desktop notifications (`GNotification`) + Add `GPowerProfileMonitor` for monitoring when to use less power (due to being on battery power, electricity being expensive or high-carbon, etc.) + Allow static names to be set for `GSource`s to avoid unnecessary string copies + Various bugs fixed + Updated translations. - Update to version 2.69.2: + The `DBUS_SESSION_BUS_ADDRESS` environment variable is once more not used if the process is `AT_SECURE` (setuid/setgid/setcap); this change was previously applied and then reverted because it broke gnome-keyring + Add `g_test_fail_printf()`, `g_test_skip_printf()`, `g_test_incomplete_printf()` helper functions for printing messages when tests end prematurely + Add portal implementation of `GPowerProfileMonitor` + Various bugs fixed + Updated translations. - Update to version 2.69.3: + g_settings_schema_key_range_check() misbehaves for int versus bool. + Compiling anything with GCC <4.6 spews deprecation warnings. + `g_invoke_closure` bindings API break.. + GPowerProfileMonitorPortal does not notice initial power-saver-enabled status. + doc: Explicitly said, that no null term. is needed. + ci: Use C.UTF-8 locale on FreeBSD 12. + gio: Fix conditions in memory-monitor test. + Updated translations. - desktop-file-utils: add Pantheon desktop environment - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 2.70.0: + Bug fixed: ci: Replace FreeBSD 11 with FreeBSD 13. + Updated translations. - Update to version 2.70.1: + Fix network changes not being signalled from NetworkManager. + Fix build when building with --fatal-meson-warnings. + Bugs fixed: glgo#GNOME/GLib#2505, glgo#GNOME/GLib!2245, glgo#GNOME/GLib!2253, glgo#GNOME/GLib!2256, glgo#GNOME/GLib!2259, glgo#GNOME/GLib!2262, glgo#GNOME/GLib!2271, glgo#GNOME/GLib!2276, glgo#GNOME/GLib!2300, glgo#GNOME/GLib!2301, glgo#GNOME/GLib!2302, glgo#GNOME/GLib!2304. - Refresh patches with quilt. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it’s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ‘remove dot segments’ algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Update to version 2.70.3: + Several important fixes to FD handling in gspawn. + Several important fixes to GDBus message and GVariant parsing of invalid data. + Fix potential data loss due to missing fsync when saving files on btrfs. + Bugs fixed: glgo#GNOME/GLib#2503, glgo#GNOME/GLib#2506, glgo#GNOME/GLib#2557, glgo#GNOME/GLib#2572, glgo#GNOME/GLib#2580, glgo#GNOME/GLib!2394, glgo#GNOME/GLib!2415, glgo#GNOME/GLib!2437, glgo#GNOME/GLib!2444, glgo#GNOME/GLib!2455. + Updated translations. - Update to version 2.70.4: + Bugs fixed: glgo#GNOME/GLib!2462 “Fix memory leak in gio/gdbusauthmechanismsha1.c” to glib-2-70. + Updated translations. - Split gtk-docs from -devel package, these are not needed during building projects using glib2 - Use _multibuild as the meson buildprocess is very awkward regarding the documentation - builds single-jobs only and twice (again during %install). This way the rest of distribution waiting for glib2-devel to be available is not blocked by this - Update to version 2.70.5: Bugs fixed: glgo#GNOME/GLib#2620, glgo#GNOME/GLib!2537, glgo#GNOME/GLib!2555 - Add glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix normal form handling in GVariant. (CVE-2023-24593, CVE-2023-25180, bsc#1209714, bsc#1209713, glgo#GNOME/glib!3125) - Update glib2-fix-normal-form-handling-in-gvariant.patch: Backported from upstream to fix regression on s390x. (bsc#1210135, glgo#GNOME/glib!2978) - Add patches to fix CVE-2024-34397 (boo#1224044): glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268). glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353) - Add glib2-gdbusmessage-cache-arg0.patch: cache the arg0 value in a dbus message. Fixes a possible use after free (boo#1224044). - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461). - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 1.18.2: + gl/eagl: internal view resize fixes for glimagesink + video-converter: increase the number of cache lines for resampling, fixes significant color issues and artefacts with "special" resizing parameters in compositor + compositor: Don't crash in prepare_frame() if the pad was just removed + decodebin3: Properly handle caps query with no filter + videoaggregator: - Guarantee that the output format is supported - Fix locking around vagg->info - Fix renegotiation when using convert pad - document and fix locking in convert pad + gluploadelement: - Avoid race condition of base class' context - Avoid race condition of inside upload creation + gl: Fix prototype of glGetSynciv() + tcpserversink: Don't assume g_socket_get_remote_address() succeeds + audiodecoder, videodecoder: Don't reset max-errors property value in reset() + audioencoder: Fix incorrect GST_LOG_OBJECT usage + pbutils: Fix segfault when using invalid encoding profile + g-i: videometa: gir annotate the size of plane array in new API + examples/gl/gtk: Add missing dependency on gstgl + video: fix doc warning. - Fix the _service file and spec to really use the tarball generated by service. - Update to version 1.18.3: + audiorate: Make buffer writable before changing its metadata + compositor: fix blending of subsampled components + decodebin3: - When reconfiguring a slot make sure that the ghostpad is unlinked - Release selection lock when pushing EOS + encodebasebin: Ensure that parsers are compatible with selected encoders + tagdemux: resize and trim buffer in place to fix interaction with oggdemux + videoaggregator: Pop out old buffers on timeout + video-blend: fix blending 8-bit and 16-bit frames together + appsrc: fix signal documentation + gl: document some GL caps specifics + libvisual: workaround clang compiler warning - Update to version 1.18.4: + tag: id3v2: fix frame size check and potential invalid reads + audio: Fix gst_audio_buffer_truncate() meta handling for non-interleaved audio + audioresample: respect buffer layout when draining + audioaggregator: fix input_buffer ownership + decodebin3: change stream selection message owner, so that the app sends the stream-selection event to the right element + rtspconnection: correct data_size when tunneled mode + uridecodebin3: make caps property work + video-converter: Don't upsample invalid lines + videodecoder: Fix racy critical when pool negotiation occurs during flush + video: Convert gst_video_info_to_caps() to take self as const ptr + examples: added qt core dependency for qt overlay example - don't own appdata dir - comes from filesystem rpm - Add 90903917.patch: Fix build with meson >= 0.58.0rc1 - Update to version 1.18.5: + appsrc: Don't leak buffer list while wrongly unreffing buffer on EOS/flushing + audioaggregator: - Don't overwrite already written samples - Resync on the next buffer when dropping a buffer on discont resyncing + audiobasesink: Fix of double lock release + audiobasesrc: Fix divide by zero assertion + clockoverlay: Fix broken string formatting by strftime() on Windows + compositor: Fix NV12 blend operation + giosrc: Don't leak scheme string in gst_gio_src_query() + giobasesink: Handle incomplete writes in gst_gio_base_sink_render() + gl/wayland: - Use consistent wl_display when creating work queue for proxy wrapper - Provide a dummy global_remove function + gl: Fix build when Meson >= 0.58.0rc1 + playbin2: fix base_time selection when flush seeking live (such as with RTSP) + rtspconnection: - Add IPv6 support for tunneled mode - Consistently translate GIOError to GstRTSPResult (for rtspsrc) + rawbaseparse: check destination format correctly + uridecodebin: Don't force floating reference for future reusable decodebin + parsebin: Put stream flags in GstStream + splitmuxsink: always use factory property when set + video-converter: Set up matrix tables only once. + videoscale: Performance degradation from 1.16.2 -> 1.18.4 + videotestsrc: Fix a leak when computing alpha caps + audio/video-converter: Plug some minor leaks + audio,video-format: Make generate_raw_formats idempotent for assertions + Don't use volatile to mean atomic (fixes compiler warnings with gcc 11) + Fix build issue on MinGW64 - Drop 90903917.patch: Fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop building doc sub-package, we will in the future use upstreams own standalone doc package. Following this: Drop fdupes, gtk-doc and hotdoc BuildRequires, and fdupes call, no longer needed nor usefull. - Update to version 1.18.6: + tagdemux: Fix crash when presented with malformed files (security fix) + videoencoder: make sure the buffer is writable before modifying metadata + video-converter: Fix for broken gamma remap with high bitdepth YUV output + sdpmessage: fix mapping single char fmtp params + oggdemux: fix a race in push mode when performing the duration seek + uridecodebin: Fix critical warnings + audio-converter: Fix resampling when there's nothing to output + tcp: fix build on Solaris + uridecodebin3: Nullify current item after all play items are freed. + audio-resampler: Fix segfault when we can't output any frames + urisourcebin: Handle sources with dynamic pads and pads already present + playbin2/3: autoplug/caps: don't expand caps to ANY + uridecodebin3/urisourcebin: Reusability fixes + rtspconnection: Only reset timeout when socket is unused + gstvideoaggregator.c: fix build with gcc 4.8 - Drop service, use source url, upstream changes in git. - Update to version 1.20.0: + Development in GitLab was switched to a single git repository containing all the modules + GstPlay: new high-level playback library, replaces GstPlayer + WebM Alpha decoding support + Encoding profiles can now be tweaked with additional application-specified element properties + Compositor: multi-threaded video conversion and mixing + RTP header extensions: unified support in RTP depayloader and payloader base classes + SMPTE 2022-1 2-D Forward Error Correction support + Smart encoding (pass through) support for VP8, VP9, H.265 in encodebin and transcodebin + Runtime compatibility support for libsoup2 and libsoup3 (libsoup3 support experimental) + Video decoder subframe support + Video decoder automatic packet-loss, data corruption, and keyframe request handling for RTP / WebRTC / RTSP + mp4 and Matroska muxers now support profile/level/resolution changes for H.264/H.265 input streams (i.e. codec data changing on the fly) + mp4 muxing mode that initially creates a fragmented mp4 which is converted to a regular mp4 on EOS + Audio support for the WebKit Port for Embedded (WPE) web page source element + CUDA based video color space convert and rescale elements and upload/download elements + NVIDIA memory:NVMM support for OpenGL glupload and gldownload elements + Many WebRTC improvements + The new VA-API plugin implementation fleshed out with more decoders and new postproc elements + AppSink API to retrieve events in addition to buffers and buffer lists + AppSrc gained more configuration options for the internal queue (leakiness, limits in buffers and time, getters to read current levels) + Updated Rust bindings and many new Rust plugins + Improved support for custom minimal GStreamer builds + Support build against FFmpeg 5.0 + Linux Stateless CODEC support gained MPEG-2 and VP9 + Windows Direct3D11/DXVA decoder gained AV1 and MPEG-2 support + Lots of new plugins, features, performance improvements and bug fixes - Rebase add_wayland_dep_to_tests.patch. - Drop gstreamer-plugins-base-gl-deps.patch: Fixed upstream - Stop using service due to upstreams new mono-repo, just use tarballs for now. - Update to version 1.20.1: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Add 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch: playsink: Complete reconfiguration on pad release. - Use ldconfig_scriptlets macro for post(un) handling. - Update to version 1.20.2: + appsrc: Clarify buffer ref semantics in signals documentation + appsrc: fix annotations for bindings + typefind: Skip extension parsing for data:// URIs, fixing regression with mp4 files serialised to data uris + playbin3: various fixes + playbin3: fix missing lock when unknown stream type in pad-removed cb + decodebin3: fix collection leaks + decodebin3: Don't duplicate stream selections + discoverer: chain up to parent finalize methods in all our types to fix memory leaks + glmixerbin: slightly better pad/element creation + gltransformation: let graphene alloc its structures memory aligned + ogg: fix possible buffer overrun + rtpbasepayload: Don't write header extensions if there's no corresponding... + rtpbasepayload: always store input buffer meta before negotiation + rtpbasepayload: fix transfer annotation for push and push_list + subparse: don't try to index string with -1 + riff-media: fix memory leak after usage for g_strjoin() + playbin/playbin3: Allow setting a NULL URI + playsink: Complete reconfiguration on pad release. + parsebin: Expose streams of unknown type + pbutils: Fix wmv screen description detection + subparse: don't deref a potentially NULL variable + rawvideoparse: set format from caps in gst_raw_video_parse_set_config_from_caps + videodecoder: release stream lock after handling gap events + videorate: fix assertion when pushing last and only buffer without duration + videorate: Revert "don't reset on segment update" to fix segment handling regressions + gst-play-1.0, gst-launch-1.0: Enable win32 high-resolution timer also for MinGW build - Drop patch already included in 1.20.2: + 5a074a11f90e3d70b24bf0c535ab0480fad9e701.patch - Update to version 1.20.3: + typefindfunctions: Fix WebVTT format detection for very short files + gldisplay: Reorder GST_GL_WINDOW check for egl-device + rtpbasepayload: Copy all buffer metadata instead of just GstMetas for the input meta buffer + codec-utils: Avoid out-of-bounds error + navigation: Fix Since markers for mouse scroll events + videoaggregator: Fix for unhandled negative rate + videoaggregator: Use floor() to calculate current position + video-color: Fix for missing clipping in PQ EOTF function + gst-play-1.0: Fix trick-mode handling in keyboard shortcut + audiovisualizer: shader: Fix out of bound write - Update to version 1.20.4: + decodebin3: - Fix mutex leaks - Fix memory issues with active selection list - uridecodebin3, urisourcebin: Event handling fixes - Fix EOS event sequence + parsebin: - Avoid crash with unknown streams - SIGSEGV during HLS stream using souphttpsrc + glimagesink: - Only allow setting the GL display/context if it is a valid value - Segfault on android devices + gstgl: Fix several memory leaks in macOS + opusenc: improve inband-fec property documentation + playsink: Hold a reference to the soft volume element + pbutils: descriptions: fix gst_pb_utils_get_caps_description_flags() + rtspurl: Use gst_uri_join_strings() in gst_rtsp_url_get_request_uri_with_control() instead of a hand-crafted, wrong version + rtspconnection: protect cancellable by a mutex + sdpmessage: Don't set SDP medias from caps without media/payload/clock-rate fields + samiparse: fix handling of self-closing tags + ssaparse: include required system headers for isspace() and sscanf() functions + subparse: fix crash when parsing invalid timestamps in mpl2 + subparse fixes + textoverlay: Don't miscalculate text running times + videoaggregator: always convert when user provides converter-config + video: Fix scaling in 4x horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) + xmptag: register musicbrainz tags during init to fix critical in jpegparse + xvimagesink: fix image leaks in error code path + tests: skip unit tests for dependency-less elements that have been disabled - Update to version 1.20.5: + audioconvert, audioresample, audiofilter: fix divide by 0 for input buffer without caps + cdparanoia: Ignore compiler warning coming from the cdparanoia header + oggdemux, parsebin: More leak fixes + opengl: - Fix automatic dispmanx detection for rpi4 - Fix usage of eglCreate/DestroyImage - Fix static linking on macOS + Bump core requirement in 1.20 branch to 1.20.4 + oggdemux: Don't leak incoming EOS event + opusdec: Various channel-related fixes + subparse: Fix non-closed tag handling. + textrender: - Don't blindly forward all events and don't blindly forward all events - Negotiate caps on a GAP event if none were negotiated yet + timeoverlay: fix pad leak + videodecoder: Only post latency message if it changed + videoscale: buffer meta handling fixes (NULL-terminate array of valid meta tags) + videosink: Don't return unknown end-time from get_times() - Update to version 1.22.0: + Please see changes in gstreamer main package, major version bump. - Rebase patches with quilt. - Add pkgconfig(xi) BuildRequires: New dependency. - Add patch to reduce the required meson version to 0.61.0 since that's what we have in SLE 15: * reduce-required-meson.patch - Probably because of a problem in SLE's meson, the generated pkgconfig files are missing some variables that are needed by rpm to generate the pkgconfig(...) provides correctly. In order to fix this, we now check for those variables and insert them in the pc files before installation if they're missing. - Add patch from upstream to fix FLAC file parsing integer overflow remote code execution vulnerability (bsc#1213128, CVE-2023-37327): * 0001-flacparse-Avoid-integer-overflow-in-available-data-check.patch - Add patch from upstream to fix SRT subtitle parsing heap-based buffer overflow remote code execution vulnerability (bsc#1213131, CVE-2023-37328): * 0002-subparse-Look-for-the-closing-_-of-a-tag-after-the.patch - Add gstreamer-plugins-base-CVE-2024-4453.patch: Backporting e68eccff from upstream, Prevent integer overflows and out of bounds reads when handling undefined tags. (CVE-2024-4453 ZDI-24-467 ZDI-CAN-23896 bsc#1224806) - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.24.31+20171209.61d5c82f5c: + Fix updating the widget accessible description when using its tooltip + Fix introspection builds on Visual Studio 2017 + imcontextxim: Fix showing glyph in status window + Visual Studio builds: Improve binary security + Fixed: If can’t add child, don’t add to child info + ComboBox: Don’t let modes disconnect each other + Enter submenus when activating their parent item + ComboBox: Don’t pile up ::grab-broken handlers + testcombo: Test grid :row- and :column-span-column + Updated translations. - Switch to git checkout via source service. - Following the above, remove gnome-common BuildRequires and gnome-autogen.sh call. Replace with libtool BuildRequires and autogen.sh call, also add gtk-doc BuildRequires and pass - -enable-gtk-doc to configure. - Clean up patch numbering. - Drop gtk2-window-dragging.patch: Fixed upstream (bgo#554057). - Drop bugzilla-131498-allow-xim-for-all-languages.patch: This patch was only applied to work around a missing recommends for scim-32Bit, stop doing that, as we should not fix errors in other packages in a toolkit. - Conditionally apply translations-update-upstream BuildRequires and macro for non-openSUSE only. - Manually move the position of "Group System/Libraries" line, which was moved automatically by format_spec_file, above the comment of "Requires: hicolor-icon-theme": https://lists.opensuse.org/opensuse-packaging/2017-07/msg00062.html - Sync summaries with gtk4. - Update to version 2.24.32: + Fix abicheck. - Use the release version as revision and set versionformat to PARENT_TAG, ensure we build the upstream released tag. - Use SPDX3.0 license tags and package COPYING as %license - Unconditionally enable translation-update-upstream: on Tumbleweed, this results in a NOP and for Leap in SLE paid translations being used (boo#1086036). - Add 0001-build-support-automake-1.16.patch: Support automake 1.16. - Update _service to point to new https://gitlab.gnome.org/GNOME/gtk.git home. - Fix package name to be uniform immodules -> immodule bsc#1104264 - Update to version 2.24.32+54: + Force redraw on Mojave and later when processing updates. + Fix UAC manifest RC file + atk key: Always convert control character events into key names + icontheme: Fix annotations on array arguments + MSVC introspection: Make more robust and avoid confusion + Revert "gdk: deactivation/activate window on keyboard grabs" + gtk/gtkiconcache.c: Fix running on GLib-2.57.3 or later on Windows + MSVC builds: Fix pkg-config file generation + MSVC builds: Improve pkg-config files generation + [gdk|gtk]/Makefile.am: Fix CFlags passed to introspecion on MSVC - Switch to gitcheckout of stable branch again, upstream is not making releases. - Drop 0001-build-support-automake-1.16.patch: Fixed upstream. - Move RPM macros to %_rpmmacrodir. - Update to version 2.24.32+62 (boo#1147106): * gtk-builder-convert: Update bug report URL. * gtk-builder-convert: Remove compat code for Python 2.3 and * below. * Make gtk-builder-convert compatible with Python 3. * Fix use-after-free due to unexpected unref of context->default_style. * Visual Studio builds: Fix previous commit. * Visual Studio builds: "Add" Visual Studio 2019 projects. - Drop gtk2-converter-python3.patch: fixed upstream. - Replace shebang in ./gtk/gtk-builder-convert using sed (use python3). - Update to version 2.24.32+67: * Do not use VIQR input method for vi locale by default * Add CI for gtk-2-24 * win32: Remove extraneous changes - bsc#1158897: Remove dependency on jasper (due to planned removal) Removes JPEG2000 support. - Add Obsoletes/Provides to baselibs.conf to ensure gtk2-immodule-tigrigna-32bit can be upgraded from old version. - No longer recommend -lang: supplements are in use - Update to version 2.24.32+70: * Resolve GIMP segfault from accessing memory past end of pixbuf Fixes https://gitlab.gnome.org/GNOME/gtk/-/issues/2684 * Use bundle id instead of package name for the macOS preview as filename is now changed. - Update to version 2.24.33: + This is the final GTK 2.x release. There will be no more updates to GTK 2. All users are encouraged to update to GTK 3 or 4. + Make the output of gtk-query-immodules deterministic. + GtkCalendar: Use %OB if supported. + GtkIconTheme: prefer exact matches. + build: - Support automake 1.16. - Fix compiler warnings with newer gcc. - Add gtk2-rpmlintrc (boo#1191758): + Filter wrong split request for libgdk-x11-2.0.so.0: the library shares the version info with gtk2 and is allowed to be in the same library package. + Filter libgail.so.18 split request: the error is actually correct, but gtk2 being a legacy package does not justify the extra efort. The libgtk-2_0-0 package is the only consumer. - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Fix build errors in Factory * Alert ocaml_deprecated_cli: Setting a warning with a sequence of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is deprecated. 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch * Error (warning 6 [labels-omitted]): label verbose was omitted in the application of this function. a4930f5f-customize-Suppress-OCaml-warning.patch - Add python-rpm-macros (bsc#1180125) - bsc#1195415 - libguestfs: consider dropping build requirement on systemd-sysvinit libguestfs.spec - Update to version 1.46.2 * This release has moved many virt tools like virt-builder, virt-cat, virt-customize, virt-df, etc. to the guestfs-tools project. This makes libguestfs a bit easier to build and manage. * The build now uses and requires PCRE2 (instead of PCRE). * This version requires libvirt ≥ 7.1.0, if libvirt is enabled. * gnulib is no longer bundled with libguestfs, making builds from git much simpler. * Perl Sys::Virt (libvirt bindings for Perl) are no longer required by libguestfs. * The code has been compiled with both LTO and GCC -fanalyzer and many bugs and warnings fixed. * Various fixes for qemu 6.1. * Update appliance packages on SUSE and several other improvements to the init script (Olaf Hering). * We now use the qemu / libvirt feature -cpu max to select the best CPU to run the appliance. * When passing the appliance filesystem UUID to supermin we now read it directly out of the appliance instead of using the file(1) program. This is more reliable. * The qemu -enable-fips option is no longer used. It was not needed and has been deprecated by qemu. * We no longer use qemu's sga (Serial Graphics Adapter) option ROM, instead using the equivalent seabios feature. * Various bug fixes - Package changes * New libguestfs.spec file. * Moved guestfs-tools to a new and separate project and package * Renamed packages guestfs-winsupport -> libguestfs-winsupport guestfsd -> libguestfsd * New packages libguestfs, libguestfs-typelib-Guestfs, libguestfs-gobject, libguestfs-gobject-devel libguestfs-rescue, libguestfs-rsync, libguestfs-xfs * Dropped package libguestfs-test - Dropped scripts and patches Pod-Simple-3.23.tar.xz libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh libguestfs.test.simple.create-opensuse-guest.sh libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh libguestfs.test.simple.create-sles12-guest.sh libguestfs.test.simple.run-libugestfs-test-tool.sh 0001-Introduce-a-wrapper-around-xmlParseURI.patch 0002-common-extract-UTF-8-conversion-function.patch 0003-inspector-rpm-summary-and-description-may-not-be-utf.patch 489b14b7-ocaml-examples-Link-examples-to-gnulib.patch 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch 68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch 9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch a4930f5f-customize-Suppress-OCaml-warning.patch c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch e26cfa44-daemon-Build-with--pthread.patch f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch appliance.patch libguestfs.env.patch makefile-ocaml-find-guestfs.patch netconfig.patch - Update to version 1.48.0 * Fix allocation and deallocation of string lists in golang bindings (Laszlo Ersek). * Multiple fixes to the OCaml bindings: * Add support for Kylin (Laszlo Ersek). * Add support for Rocky Linux (Neil Hanlon). * Inspection of guests which use LUKS encryption on top of LVM logical volumes should now work (Laszlo Ersek). * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and now return errors. * "guestfs_remove_drive" has been deprecated and now returns an error. * "guestfs_add_drive" no longer supports hotplugging * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated because it is no longer supported in recent versions of XFS. * The User-mode Linux ("uml") backend has been removed. * Partition APIs now cope with the broken MBR partition tables created by dosfstools ≥ 4.2 (Laszlo Ersek). * Various bug fixes - Avoid useless builds, if ocaml version isn't up to the task libguestfs uses get_uint8(), available since ocaml 4.13.0 - Add relevant %post{,un} sections - Add another rpmlint filter - Add uk man dirs - Update to version 1.48.1 * Updated language files * A few bug fixes in this release * Drop requirement for newer ocaml required by Bytes.get_uint8. It is replaced with a local implementation. - Update to version 1.48.3 * Several bugs fixed in this release since version 1.48.1 * Updated language files - bsc#1190501 - virt-builder fails to install packages when building an image. Add Recommends: dhcp-client for the appliance. libguestfs.spec - bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads to DOS - CVE-2022-2211 CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch CVE-2022-2211-docs-guestfs-security-document.patch - Update to version 1.48.4 * This is a bug fix release - Drop patches included in new tarball CVE-2022-2211-docs-guestfs-security-document.patch CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch - Upstream patch to fix running configure --disable-ocaml f162e47e-m4-Fix-configure-disable-ocaml.patch - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Drop requirement for icoutils in SLE as this package is not available. libguestfs.spec - Drop reiserfs (boo#1191092) - Update to version 1.48.6 * jsc#PED-2113 * This is a bug fix release. No upstream changelog. - Drop f162e47e-m4-Fix-configure-disable-ocaml.patch - bsc#1212972 - cannot find any suitable libguestfs supermin libguestfs.spec (see also bsc#1215664) - bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2 appliances Configure with --enable-appliance-format-auto to allow qcow2-format fixed appliances. libguestfs.spec - bsc#1215543 - guestfs regression: file: Use -S option with -z Omit-file--S-option-on-older-distros-that-lack-support.patch See also bsc#1215461 - bsc#1215586 - guestfs regression: non functional network due to missing sysconfig-netconfig libguestfs.spec - Fix build errors in Factory * Alert ocaml_deprecated_cli: Setting a warning with a sequence of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is deprecated. 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch * Error (warning 6 [labels-omitted]): label verbose was omitted in the application of this function. a4930f5f-customize-Suppress-OCaml-warning.patch - Add python-rpm-macros (bsc#1180125) - bsc#1195415 - libguestfs: consider dropping build requirement on systemd-sysvinit libguestfs.spec - Update to version 1.46.2 * This release has moved many virt tools like virt-builder, virt-cat, virt-customize, virt-df, etc. to the guestfs-tools project. This makes libguestfs a bit easier to build and manage. * The build now uses and requires PCRE2 (instead of PCRE). * This version requires libvirt ≥ 7.1.0, if libvirt is enabled. * gnulib is no longer bundled with libguestfs, making builds from git much simpler. * Perl Sys::Virt (libvirt bindings for Perl) are no longer required by libguestfs. * The code has been compiled with both LTO and GCC -fanalyzer and many bugs and warnings fixed. * Various fixes for qemu 6.1. * Update appliance packages on SUSE and several other improvements to the init script (Olaf Hering). * We now use the qemu / libvirt feature -cpu max to select the best CPU to run the appliance. * When passing the appliance filesystem UUID to supermin we now read it directly out of the appliance instead of using the file(1) program. This is more reliable. * The qemu -enable-fips option is no longer used. It was not needed and has been deprecated by qemu. * We no longer use qemu's sga (Serial Graphics Adapter) option ROM, instead using the equivalent seabios feature. * Various bug fixes - Package changes * New libguestfs.spec file. * Moved guestfs-tools to a new and separate project and package * Renamed packages guestfs-winsupport -> libguestfs-winsupport guestfsd -> libguestfsd * New packages libguestfs, libguestfs-typelib-Guestfs, libguestfs-gobject, libguestfs-gobject-devel libguestfs-rescue, libguestfs-rsync, libguestfs-xfs * Dropped package libguestfs-test - Dropped scripts and patches Pod-Simple-3.23.tar.xz libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh libguestfs.test.simple.create-opensuse-guest.sh libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh libguestfs.test.simple.create-sles12-guest.sh libguestfs.test.simple.run-libugestfs-test-tool.sh 0001-Introduce-a-wrapper-around-xmlParseURI.patch 0002-common-extract-UTF-8-conversion-function.patch 0003-inspector-rpm-summary-and-description-may-not-be-utf.patch 489b14b7-ocaml-examples-Link-examples-to-gnulib.patch 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch 68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch 9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch a4930f5f-customize-Suppress-OCaml-warning.patch c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch e26cfa44-daemon-Build-with--pthread.patch f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch appliance.patch libguestfs.env.patch makefile-ocaml-find-guestfs.patch netconfig.patch - Update to version 1.48.0 * Fix allocation and deallocation of string lists in golang bindings (Laszlo Ersek). * Multiple fixes to the OCaml bindings: * Add support for Kylin (Laszlo Ersek). * Add support for Rocky Linux (Neil Hanlon). * Inspection of guests which use LUKS encryption on top of LVM logical volumes should now work (Laszlo Ersek). * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and now return errors. * "guestfs_remove_drive" has been deprecated and now returns an error. * "guestfs_add_drive" no longer supports hotplugging * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated because it is no longer supported in recent versions of XFS. * The User-mode Linux ("uml") backend has been removed. * Partition APIs now cope with the broken MBR partition tables created by dosfstools ≥ 4.2 (Laszlo Ersek). * Various bug fixes - Avoid useless builds, if ocaml version isn't up to the task libguestfs uses get_uint8(), available since ocaml 4.13.0 - Add relevant %post{,un} sections - Add another rpmlint filter - Add uk man dirs - Update to version 1.48.1 * Updated language files * A few bug fixes in this release * Drop requirement for newer ocaml required by Bytes.get_uint8. It is replaced with a local implementation. - Update to version 1.48.3 * Several bugs fixed in this release since version 1.48.1 * Updated language files - bsc#1190501 - virt-builder fails to install packages when building an image. Add Recommends: dhcp-client for the appliance. libguestfs.spec - bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads to DOS - CVE-2022-2211 CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch CVE-2022-2211-docs-guestfs-security-document.patch - Update to version 1.48.4 * This is a bug fix release - Drop patches included in new tarball CVE-2022-2211-docs-guestfs-security-document.patch CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch - Upstream patch to fix running configure --disable-ocaml f162e47e-m4-Fix-configure-disable-ocaml.patch - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Drop requirement for icoutils in SLE as this package is not available. libguestfs.spec - Drop reiserfs (boo#1191092) - Update to version 1.48.6 * jsc#PED-2113 * This is a bug fix release. No upstream changelog. - Drop f162e47e-m4-Fix-configure-disable-ocaml.patch - bsc#1212972 - cannot find any suitable libguestfs supermin libguestfs.spec (see also bsc#1215664) - bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2 appliances Configure with --enable-appliance-format-auto to allow qcow2-format fixed appliances. libguestfs.spec - bsc#1215543 - guestfs regression: file: Use -S option with -z Omit-file--S-option-on-older-distros-that-lack-support.patch See also bsc#1215461 - bsc#1215586 - guestfs regression: non functional network due to missing sysconfig-netconfig libguestfs.spec - Fix build errors in Factory * Alert ocaml_deprecated_cli: Setting a warning with a sequence of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is deprecated. 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch * Error (warning 6 [labels-omitted]): label verbose was omitted in the application of this function. a4930f5f-customize-Suppress-OCaml-warning.patch - Add python-rpm-macros (bsc#1180125) - bsc#1195415 - libguestfs: consider dropping build requirement on systemd-sysvinit libguestfs.spec - Update to version 1.46.2 * This release has moved many virt tools like virt-builder, virt-cat, virt-customize, virt-df, etc. to the guestfs-tools project. This makes libguestfs a bit easier to build and manage. * The build now uses and requires PCRE2 (instead of PCRE). * This version requires libvirt ≥ 7.1.0, if libvirt is enabled. * gnulib is no longer bundled with libguestfs, making builds from git much simpler. * Perl Sys::Virt (libvirt bindings for Perl) are no longer required by libguestfs. * The code has been compiled with both LTO and GCC -fanalyzer and many bugs and warnings fixed. * Various fixes for qemu 6.1. * Update appliance packages on SUSE and several other improvements to the init script (Olaf Hering). * We now use the qemu / libvirt feature -cpu max to select the best CPU to run the appliance. * When passing the appliance filesystem UUID to supermin we now read it directly out of the appliance instead of using the file(1) program. This is more reliable. * The qemu -enable-fips option is no longer used. It was not needed and has been deprecated by qemu. * We no longer use qemu's sga (Serial Graphics Adapter) option ROM, instead using the equivalent seabios feature. * Various bug fixes - Package changes * New libguestfs.spec file. * Moved guestfs-tools to a new and separate project and package * Renamed packages guestfs-winsupport -> libguestfs-winsupport guestfsd -> libguestfsd * New packages libguestfs, libguestfs-typelib-Guestfs, libguestfs-gobject, libguestfs-gobject-devel libguestfs-rescue, libguestfs-rsync, libguestfs-xfs * Dropped package libguestfs-test - Dropped scripts and patches Pod-Simple-3.23.tar.xz libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh libguestfs.test.simple.create-opensuse-guest.sh libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh libguestfs.test.simple.create-sles12-guest.sh libguestfs.test.simple.run-libugestfs-test-tool.sh 0001-Introduce-a-wrapper-around-xmlParseURI.patch 0002-common-extract-UTF-8-conversion-function.patch 0003-inspector-rpm-summary-and-description-may-not-be-utf.patch 489b14b7-ocaml-examples-Link-examples-to-gnulib.patch 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch 68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch 9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch a4930f5f-customize-Suppress-OCaml-warning.patch c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch e26cfa44-daemon-Build-with--pthread.patch f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch appliance.patch libguestfs.env.patch makefile-ocaml-find-guestfs.patch netconfig.patch - Update to version 1.48.0 * Fix allocation and deallocation of string lists in golang bindings (Laszlo Ersek). * Multiple fixes to the OCaml bindings: * Add support for Kylin (Laszlo Ersek). * Add support for Rocky Linux (Neil Hanlon). * Inspection of guests which use LUKS encryption on top of LVM logical volumes should now work (Laszlo Ersek). * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and now return errors. * "guestfs_remove_drive" has been deprecated and now returns an error. * "guestfs_add_drive" no longer supports hotplugging * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated because it is no longer supported in recent versions of XFS. * The User-mode Linux ("uml") backend has been removed. * Partition APIs now cope with the broken MBR partition tables created by dosfstools ≥ 4.2 (Laszlo Ersek). * Various bug fixes - Avoid useless builds, if ocaml version isn't up to the task libguestfs uses get_uint8(), available since ocaml 4.13.0 - Add relevant %post{,un} sections - Add another rpmlint filter - Add uk man dirs - Update to version 1.48.1 * Updated language files * A few bug fixes in this release * Drop requirement for newer ocaml required by Bytes.get_uint8. It is replaced with a local implementation. - Update to version 1.48.3 * Several bugs fixed in this release since version 1.48.1 * Updated language files - bsc#1190501 - virt-builder fails to install packages when building an image. Add Recommends: dhcp-client for the appliance. libguestfs.spec - bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads to DOS - CVE-2022-2211 CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch CVE-2022-2211-docs-guestfs-security-document.patch - Update to version 1.48.4 * This is a bug fix release - Drop patches included in new tarball CVE-2022-2211-docs-guestfs-security-document.patch CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch - Upstream patch to fix running configure --disable-ocaml f162e47e-m4-Fix-configure-disable-ocaml.patch - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Drop requirement for icoutils in SLE as this package is not available. libguestfs.spec - Drop reiserfs (boo#1191092) - Update to version 1.48.6 * jsc#PED-2113 * This is a bug fix release. No upstream changelog. - Drop f162e47e-m4-Fix-configure-disable-ocaml.patch - bsc#1212972 - cannot find any suitable libguestfs supermin libguestfs.spec (see also bsc#1215664) - bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2 appliances Configure with --enable-appliance-format-auto to allow qcow2-format fixed appliances. libguestfs.spec - bsc#1215543 - guestfs regression: file: Use -S option with -z Omit-file--S-option-on-older-distros-that-lack-support.patch See also bsc#1215461 - bsc#1215586 - guestfs regression: non functional network due to missing sysconfig-netconfig libguestfs.spec - Fix build errors in Factory * Alert ocaml_deprecated_cli: Setting a warning with a sequence of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is deprecated. 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch * Error (warning 6 [labels-omitted]): label verbose was omitted in the application of this function. a4930f5f-customize-Suppress-OCaml-warning.patch - Add python-rpm-macros (bsc#1180125) - bsc#1195415 - libguestfs: consider dropping build requirement on systemd-sysvinit libguestfs.spec - Update to version 1.46.2 * This release has moved many virt tools like virt-builder, virt-cat, virt-customize, virt-df, etc. to the guestfs-tools project. This makes libguestfs a bit easier to build and manage. * The build now uses and requires PCRE2 (instead of PCRE). * This version requires libvirt ≥ 7.1.0, if libvirt is enabled. * gnulib is no longer bundled with libguestfs, making builds from git much simpler. * Perl Sys::Virt (libvirt bindings for Perl) are no longer required by libguestfs. * The code has been compiled with both LTO and GCC -fanalyzer and many bugs and warnings fixed. * Various fixes for qemu 6.1. * Update appliance packages on SUSE and several other improvements to the init script (Olaf Hering). * We now use the qemu / libvirt feature -cpu max to select the best CPU to run the appliance. * When passing the appliance filesystem UUID to supermin we now read it directly out of the appliance instead of using the file(1) program. This is more reliable. * The qemu -enable-fips option is no longer used. It was not needed and has been deprecated by qemu. * We no longer use qemu's sga (Serial Graphics Adapter) option ROM, instead using the equivalent seabios feature. * Various bug fixes - Package changes * New libguestfs.spec file. * Moved guestfs-tools to a new and separate project and package * Renamed packages guestfs-winsupport -> libguestfs-winsupport guestfsd -> libguestfsd * New packages libguestfs, libguestfs-typelib-Guestfs, libguestfs-gobject, libguestfs-gobject-devel libguestfs-rescue, libguestfs-rsync, libguestfs-xfs * Dropped package libguestfs-test - Dropped scripts and patches Pod-Simple-3.23.tar.xz libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh libguestfs.test.simple.create-opensuse-guest.sh libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh libguestfs.test.simple.create-sles12-guest.sh libguestfs.test.simple.run-libugestfs-test-tool.sh 0001-Introduce-a-wrapper-around-xmlParseURI.patch 0002-common-extract-UTF-8-conversion-function.patch 0003-inspector-rpm-summary-and-description-may-not-be-utf.patch 489b14b7-ocaml-examples-Link-examples-to-gnulib.patch 63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch 68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch 9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch a4930f5f-customize-Suppress-OCaml-warning.patch c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch e26cfa44-daemon-Build-with--pthread.patch f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch appliance.patch libguestfs.env.patch makefile-ocaml-find-guestfs.patch netconfig.patch - Update to version 1.48.0 * Fix allocation and deallocation of string lists in golang bindings (Laszlo Ersek). * Multiple fixes to the OCaml bindings: * Add support for Kylin (Laszlo Ersek). * Add support for Rocky Linux (Neil Hanlon). * Inspection of guests which use LUKS encryption on top of LVM logical volumes should now work (Laszlo Ersek). * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and now return errors. * "guestfs_remove_drive" has been deprecated and now returns an error. * "guestfs_add_drive" no longer supports hotplugging * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated because it is no longer supported in recent versions of XFS. * The User-mode Linux ("uml") backend has been removed. * Partition APIs now cope with the broken MBR partition tables created by dosfstools ≥ 4.2 (Laszlo Ersek). * Various bug fixes - Avoid useless builds, if ocaml version isn't up to the task libguestfs uses get_uint8(), available since ocaml 4.13.0 - Add relevant %post{,un} sections - Add another rpmlint filter - Add uk man dirs - Update to version 1.48.1 * Updated language files * A few bug fixes in this release * Drop requirement for newer ocaml required by Bytes.get_uint8. It is replaced with a local implementation. - Update to version 1.48.3 * Several bugs fixed in this release since version 1.48.1 * Updated language files - bsc#1190501 - virt-builder fails to install packages when building an image. Add Recommends: dhcp-client for the appliance. libguestfs.spec - bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads to DOS - CVE-2022-2211 CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch CVE-2022-2211-docs-guestfs-security-document.patch - Update to version 1.48.4 * This is a bug fix release - Drop patches included in new tarball CVE-2022-2211-docs-guestfs-security-document.patch CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch - Upstream patch to fix running configure --disable-ocaml f162e47e-m4-Fix-configure-disable-ocaml.patch - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Drop requirement for icoutils in SLE as this package is not available. libguestfs.spec - Drop reiserfs (boo#1191092) - Update to version 1.48.6 * jsc#PED-2113 * This is a bug fix release. No upstream changelog. - Drop f162e47e-m4-Fix-configure-disable-ocaml.patch - bsc#1212972 - cannot find any suitable libguestfs supermin libguestfs.spec (see also bsc#1215664) - bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2 appliances Configure with --enable-appliance-format-auto to allow qcow2-format fixed appliances. libguestfs.spec - bsc#1215543 - guestfs regression: file: Use -S option with -z Omit-file--S-option-on-older-distros-that-lack-support.patch See also bsc#1215461 - bsc#1215586 - guestfs regression: non functional network due to missing sysconfig-netconfig libguestfs.spec - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Initial version - Add do_not_install_docs.patch: don't let make install docs - Supply LICENSE files with libraries - Update to 0.9.0 - Switch upstream to libusb/hidapi because the original maintainer is not active anymore - Use disabled services to follow Factory guidelines. - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through the -mini flavors. - Update to version 0.10.1 * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI * Add hid_version/hid_version_str API (#192) * Add podspec to support releases via cocoapods * Add support for HID over I2C and uhid devices (#166) * Fix small casting issue * Fix race condition on device close (#189) * Fix API prototype for gcc flag -Wstrict-prototypes (#207) * Fix strict typecast (#206) * Fix -Wall -Wextra -pedantic -Werror compilation (#214) … * Drop workaround for kernel < 2.6.34 * Use pkg-config to find libusb on *freebsd * Reattach kernel driver in hidapi-libusb * Move local variable declaration to the beginning of the function - Initial version - Add do_not_install_docs.patch: don't let make install docs - Supply LICENSE files with libraries - Update to 0.9.0 - Switch upstream to libusb/hidapi because the original maintainer is not active anymore - Use disabled services to follow Factory guidelines. - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through the -mini flavors. - Update to version 0.10.1 * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI * Add hid_version/hid_version_str API (#192) * Add podspec to support releases via cocoapods * Add support for HID over I2C and uhid devices (#166) * Fix small casting issue * Fix race condition on device close (#189) * Fix API prototype for gcc flag -Wstrict-prototypes (#207) * Fix strict typecast (#206) * Fix -Wall -Wextra -pedantic -Werror compilation (#214) … * Drop workaround for kernel < 2.6.34 * Use pkg-config to find libusb on *freebsd * Reattach kernel driver in hidapi-libusb * Move local variable declaration to the beginning of the function - Initial version - Add do_not_install_docs.patch: don't let make install docs - Supply LICENSE files with libraries - Update to 0.9.0 - Switch upstream to libusb/hidapi because the original maintainer is not active anymore - Use disabled services to follow Factory guidelines. - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through the -mini flavors. - Update to version 0.10.1 * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI * Add hid_version/hid_version_str API (#192) * Add podspec to support releases via cocoapods * Add support for HID over I2C and uhid devices (#166) * Fix small casting issue * Fix race condition on device close (#189) * Fix API prototype for gcc flag -Wstrict-prototypes (#207) * Fix strict typecast (#206) * Fix -Wall -Wextra -pedantic -Werror compilation (#214) … * Drop workaround for kernel < 2.6.34 * Use pkg-config to find libusb on *freebsd * Reattach kernel driver in hidapi-libusb * Move local variable declaration to the beginning of the function - update to 2.18 to solve build failures for ppc/ppc64. remove following patches now included in 2.18: libhugetlbfs-ppc64le.patch libhugetlbfs.ppc64le.step2.patch libhugetlbfs.ppc64le.step3.patch libhugetlbfs.ppc64le.step4.patch - Add fix_plt_extrasz_always_returning_0_on_ppc64le.patch already upstream. - Add libhugelbfs-2.18-restrict-is-a-reserved-word.patch which fixes compilation with GCC 5 (and C99/C11 in general). * Add libhugetlbfs-2.18-restrict-is-a-reserved-word.patch - Latest version from git next branch - Add zero_filesize_segment.patch to fix testcase on s390x - Fixes bnc#919680 - Patches already included mainline and now deleted: D libhugetlbfs-2.18-restrict-is-a-reserved-word.patch D fix_plt_extrasz_always_returning_0_on_ppc64le.patch - Update to 2.20 - Bug Fixes: * Fix keyword collisions and warnings from GCC 5 * hugeadm output is parsed for default size in huge_page_setup_helper * Testsuite: fallocate tests - Update summary and descriptions a bit - Move development manpages (*.3) to development subpackage - Avoid ||/&& in %install because it can leave $? at non-zero (unlike if..fi), and %install is run with sh -x. - Run `make install-perlmod` to install/satisfy Perl modules required by /usr/bin/cpupcstat, itself installed by just `make install` [boo#1057963] - Hardening: Link as PIE (bsc#1184123). - Add libhugetlbfs-increase-mount-buffer.patch for upstream issue gh#43 (boo#1216576, bsc#1213639) - Add libhugetlbfs-noexecstack.patch (bsc#1213639) - Increase buffer size in libhugetlbfs-increase-mount-buffer.patch as in the provided fix (bsc#1213639) - update to 2.18 to solve build failures for ppc/ppc64. remove following patches now included in 2.18: libhugetlbfs-ppc64le.patch libhugetlbfs.ppc64le.step2.patch libhugetlbfs.ppc64le.step3.patch libhugetlbfs.ppc64le.step4.patch - Add fix_plt_extrasz_always_returning_0_on_ppc64le.patch already upstream. - Add libhugelbfs-2.18-restrict-is-a-reserved-word.patch which fixes compilation with GCC 5 (and C99/C11 in general). * Add libhugetlbfs-2.18-restrict-is-a-reserved-word.patch - Latest version from git next branch - Add zero_filesize_segment.patch to fix testcase on s390x - Fixes bnc#919680 - Patches already included mainline and now deleted: D libhugetlbfs-2.18-restrict-is-a-reserved-word.patch D fix_plt_extrasz_always_returning_0_on_ppc64le.patch - Update to 2.20 - Bug Fixes: * Fix keyword collisions and warnings from GCC 5 * hugeadm output is parsed for default size in huge_page_setup_helper * Testsuite: fallocate tests - Update summary and descriptions a bit - Move development manpages (*.3) to development subpackage - Avoid ||/&& in %install because it can leave $? at non-zero (unlike if..fi), and %install is run with sh -x. - Run `make install-perlmod` to install/satisfy Perl modules required by /usr/bin/cpupcstat, itself installed by just `make install` [boo#1057963] - Hardening: Link as PIE (bsc#1184123). - Add libhugetlbfs-increase-mount-buffer.patch for upstream issue gh#43 (boo#1216576, bsc#1213639) - Add libhugetlbfs-noexecstack.patch (bsc#1213639) - Increase buffer size in libhugetlbfs-increase-mount-buffer.patch as in the provided fix (bsc#1213639) - Do not include the 268MB testcase /usr/lib/libhugetlbfs/tests/obj32/linkhuge_rw. - Update to version 2.12 * libhugetlbfs usages can now be restricted to certain binary names * libhugetlbfs now supports static linking * hugeadm uses more human readable directory names for mount points * Fix segfault if specified user was not in passwd, failuer in getpwuid() is now checked * Added tests for static linking to testcase * Added missing tests to driver script - Update to version 2.13 * hugeadm can now be used to control Transparent Huge Page tunables * New morecore mode to better support THP * Check permissions on hugetlbfs mount point before marking it as available * Fix shm tests to use random address instead of fixed, old address failed on ARM - Add excludearch for arm due to lacking support - Update to version 2.15 Features: * Some System z functionality went into 2.15 * Updated man pages * Added basic events for core_i7 to oprofile_map_events Fixes: * Disable Unable to verify address range warning when offset < page_size * Remove sscanf in library setup to avoid heap allocation before _morecore override * Revert heap exhaustion patch * hugectl no longer clips LD_LIBRARY_PATH variable * Fix clean on failure code to avoid closing stdout - Update to version 2.16: Features: * ARM Support * s390x Dynamic TASK_SIZE support Bug Fixes: * find_mounts() now properly NULL terminates mount point names - Add support of ppc64le with 4 patches libhugetlbfs-ppc64le.patch libhugetlbfs.ppc64le.step2.patch libhugetlbfs.ppc64le.step3.patch libhugetlbfs.ppc64le.step4.patch - There are no tests installed in s390(x) case, therefore there are no files in %{_libdir}/libhugetlbfs Remove the directory from the file list to fix package build for s390(x) - Tests compile fine for s390(x), also include them in the package, the same way it is done for other archs as well. - update to 2.17: * PPC segement alignment restrictions can be disabled * Added Aarch64 support * Allow compiler overrides for 64 and 32 bit builds * hugeadm now handles /etc/mtab being a simlink properly * ppc64 fixes - remove libhugetlbfs.ia64-libdir.patch: ia64 is no longer supported by openSUSE - add ignore-perl-modules.diff: do not install perl modules, unused and are installed in the wrong place to be found anyway - add ARM support - add disable-rw-on-non-ldscripts.diff: Skip rw tests - Do not install tests anymore - update to 2.18 to solve build failures for ppc/ppc64. remove following patches now included in 2.18: libhugetlbfs-ppc64le.patch libhugetlbfs.ppc64le.step2.patch libhugetlbfs.ppc64le.step3.patch libhugetlbfs.ppc64le.step4.patch - Add fix_plt_extrasz_always_returning_0_on_ppc64le.patch already upstream. - Add libhugelbfs-2.18-restrict-is-a-reserved-word.patch which fixes compilation with GCC 5 (and C99/C11 in general). * Add libhugetlbfs-2.18-restrict-is-a-reserved-word.patch - Latest version from git next branch - Add zero_filesize_segment.patch to fix testcase on s390x - Fixes bnc#919680 - Patches already included mainline and now deleted: D libhugetlbfs-2.18-restrict-is-a-reserved-word.patch D fix_plt_extrasz_always_returning_0_on_ppc64le.patch - Update to 2.20 - Bug Fixes: * Fix keyword collisions and warnings from GCC 5 * hugeadm output is parsed for default size in huge_page_setup_helper * Testsuite: fallocate tests - Update summary and descriptions a bit - Move development manpages (*.3) to development subpackage - Avoid ||/&& in %install because it can leave $? at non-zero (unlike if..fi), and %install is run with sh -x. - Run `make install-perlmod` to install/satisfy Perl modules required by /usr/bin/cpupcstat, itself installed by just `make install` [boo#1057963] - Hardening: Link as PIE (bsc#1184123). - Add libhugetlbfs-increase-mount-buffer.patch for upstream issue gh#43 (boo#1216576, bsc#1213639) - Add libhugetlbfs-noexecstack.patch (bsc#1213639) - Increase buffer size in libhugetlbfs-increase-mount-buffer.patch as in the provided fix (bsc#1213639) - update to 2.18 to solve build failures for ppc/ppc64. remove following patches now included in 2.18: libhugetlbfs-ppc64le.patch libhugetlbfs.ppc64le.step2.patch libhugetlbfs.ppc64le.step3.patch libhugetlbfs.ppc64le.step4.patch - Add fix_plt_extrasz_always_returning_0_on_ppc64le.patch already upstream. - Add libhugelbfs-2.18-restrict-is-a-reserved-word.patch which fixes compilation with GCC 5 (and C99/C11 in general). * Add libhugetlbfs-2.18-restrict-is-a-reserved-word.patch - Latest version from git next branch - Add zero_filesize_segment.patch to fix testcase on s390x - Fixes bnc#919680 - Patches already included mainline and now deleted: D libhugetlbfs-2.18-restrict-is-a-reserved-word.patch D fix_plt_extrasz_always_returning_0_on_ppc64le.patch - Update to 2.20 - Bug Fixes: * Fix keyword collisions and warnings from GCC 5 * hugeadm output is parsed for default size in huge_page_setup_helper * Testsuite: fallocate tests - Update summary and descriptions a bit - Move development manpages (*.3) to development subpackage - Avoid ||/&& in %install because it can leave $? at non-zero (unlike if..fi), and %install is run with sh -x. - Run `make install-perlmod` to install/satisfy Perl modules required by /usr/bin/cpupcstat, itself installed by just `make install` [boo#1057963] - Hardening: Link as PIE (bsc#1184123). - Add libhugetlbfs-increase-mount-buffer.patch for upstream issue gh#43 (boo#1216576, bsc#1213639) - Add libhugetlbfs-noexecstack.patch (bsc#1213639) - Increase buffer size in libhugetlbfs-increase-mount-buffer.patch as in the provided fix (bsc#1213639) - Added "Obsoletes: libica2" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1046435, bsc#1104638) - Added "Obsoletes: libica-2_3_0" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1112655) - Upgraded to version 3.3.3 (Fate#325690) * v3.3.3 [PATCH] Various bug fixes * v3.3.2 [PATCH] Skip ECC tests if required HW is not available [PATCH] Update spec file * v3.3.1 [PATCH] Fix configure.ac to honour CFLAGS * v3.3.0 [FEATURE] Add CEX supported elliptic-curve crypto interfaces [FEATURE] Add SIMD supported multiple-precision arithmetic interfaces [FEATURE] Add interface to enable/disable SW fallbacks [FEATURE] Add 'make check' target, test-suite rework * v3.2.1 [FEATURE] Use z14 PRNO-TRNG to seed SHA512-DRBG. [PATCH] Various bug fixes. - Dropped obsolete patch increment-icastats-counter-for-aes-gcm.patch - Removed COPYING from %files, since it is no longer in the tarball. - Added Add-non-executable-gnu-stack-markings-in-the-assembl.patch (bsc#1103493). - Made multiple changes to the spec file based on the output of spec-cleaner - Upgraded to version 3.4.0 (Fate#325690) * v3.4.0 [FEATURE] Add SHA-512/224 and SHA-512/256 support - Dropped obsolete patch Add-non-executable-gnu-stack-markings-in-the-assembl.patch - Made numerous updates to spec file based on spec-cleanup run. - Run testsuite during build - Upgraded to version 3.5.0 (Fate#327840) - [FEATURE] Add MSA9 CPACF support for ECDSA sign/verify - Reworked how libica-tools loads and unloads kernel modules to avoid spurious error messages (bsc#1134004): * Converted the boot.z90crypt sysV init script to a systemd unit file. * Removed any references to insserv in the spec file. * Updated the z90crypt script itself to properly load and unload the kernel modules as they exist today. * Eliminated the obsolete libica-SuSE.tar.bz2 archive. - Updated the README.SUSE file to reflect the change from sysV init style script to systemd. - Made numerous changes to the spec file, based on the output from the spec-cleaner command. - Upgraded to version 3.6.0 (jsc#SLE-7584) * [FEATURE] Add MSA9 CPACF support for Ed25519, Ed448, X25519 and X448 - Added libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch (bsc#1156768) - Added the following patches for FIPS certification. * libica-sles15sp2-Fix-DES-and-TDES-key-length.patch (bsc#1166071) Although a DES key has only 56 effective bits, all 64 bits must be considered, because the parity bits are spread over all 8 bytes of the key. * libica-sles15sp2-FIPS-provide-output-iv-as-required-by-FIPS-tests.patch (bsc#1166210) FIPS tests require the output iv to be the iv resulting from decrypting the last block with a zero iv as input. * libica-sles15sp2-icainfo-bugfix-for-RSA-and-EC-related-info-for-softw.patch (bsc#1166224) The output from icainfo never shows 'yes' for RSA ME, RSA CRT, ECDH, ECDSA sign, ECDSA verify, and ECKGEN, due to the missing ICA_FLAG_SW flag in the icaList. - Added the following patches for FIPS certification (bsc#1162533) * libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch * libica-sles15sp2-FIPS-hmac-key.patch - Added a BuildRequires for the fipscheck package. - Made a couple of changes to the spec file based upon recommendations by spec-cleaner. - Fix lack of SHA3 KATs in "make check" processing (bsc#1175277) * Added libica-sles15sp2-FIPS-add-SHA3-KATs-to-fips_powerup_tests.patch * Added libica-sles15sp2-FIPS-skip-SHA3-tests-if-running-on-hardware-without-.patch - Fix FIPS hmac check (bsc#1175356). * Update FIPS support to upstream - Refresh libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch from upstream. - Add libica-sles15sp2-Build-with-pthread-flag.patch - Add libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-addon.patch - Add libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-rename-variables.patch - Add libica-sles15sp2-FIPS-use-full-library-version-for-hmac-filename.patch * FIPS check should fail when hmac is missing - Add libica-sles15sp2-FIPS-fix-inconsistent-error-handling.patch - Create an hmac for the selftest - Check that selftest fails without a hmac - Hash libica.so.3 rather than libica.so.3.6.0 * Fix hmac key format. It should be hexadecimal, not ASCII - Refresh libica-sles15sp2-FIPS-hmac-key.patch - Fix Some internal variables used to store sensitive information (keys) were not zeroized before returning to the calling application. (bsc#1175357) * Added libica-sles15sp2-Zeroize-local-variables.patch - Updated libica-rpmlintrc to eliminate the warning about the HMAC file being a hidden file. It is supposed to be hidden. - Upgraded to version 3.7.0 (jsc#SLE-13708) * Version 3.7.0 - [FEATURE] FIPS: Add HMAC based library integrity check - [PATCH] icainfo: bugfix for RSA and EC related info for software column. - [PATCH] FIPS: provide output iv in cbc-cs decrypt as required by FIPS tests - [PATCH] FIPS: Fix DES and TDES key length - [PATCH] icastats: Fix stats counter format * Version 3.6.1 - [PATCH] Fix x25519 and x448 handling of non-canonical values - Removed the following obsolete patches * libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch * libica-sles15sp2-Fix-DES-and-TDES-key-length.patch * libica-sles15sp2-FIPS-provide-output-iv-as-required-by-FIPS-tests.patch * libica-sles15sp2-icainfo-bugfix-for-RSA-and-EC-related-info-for-softw.patch * libica-sles15sp2-Build-with-pthread-flag.patch * libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch * libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-addon.patch * libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-rename-variables.patch - Update to version 3.8.0 (jsc#SLE-18334) - [FEATURE] provide libica-cex module to satisfy special security requirements - [FEATURE] FIPS: enforce the HMAC check - Remove upstreamed patches: - libica-sles15sp2-FIPS-add-SHA3-KATs-to-fips_powerup_tests.patch - libica-sles15sp2-FIPS-skip-SHA3-tests-if-running-on-hardware-without-.patch - libica-sles15sp2-Zeroize-local-variables.patch - Remove patches obsoleted by upstrea developent: * FIPS: Find libica from phdrs. - libica-sles15sp2-FIPS-use-full-library-version-for-hmac-filename.patch * FIPS: enforce the hmac check - libica-sles15sp2-FIPS-fix-inconsistent-error-handling.patch - Fix up tests and hmac generation + libica-FIPS-make-it-possible-to-specify-fipshmac-binary.patch - Remove obsolete attributes from filelists - Upgrade to version 3.9.0 (jsc#SLE-18454, jsc#SLE-18564) - [FEATURE] Add support for OpenSSL 3.0 - [FEATURE] icainfo: new parm -c to display available EC curves - Replaced the obsolete PreReq: %fillup_prereq with Requires(post): %fillup_prereq in the spec file. - Upgraded to version 4.0.3 (jsc#PED-581, jsc#PED-621, jsc#PED-629) v4.0.3 - [PATCH] Reduce the number of open file descriptors - [PATCH] Various bug fixes v4.0.2 - [PATCH] Various bug fixes v4.0.1 - [PATCH] Various bug fixes - [PATCH] Compute HMAC from installed library v4.0.0 - [UPDATE] NO_SW_FALLBACKS is now the default for libica.so [UPDATE] Removed deprecated API functions including tests [UPDATE] Introduced 'const' for some API function parameters [FEATURE] icastats: new parm -k to display detailed counters - Replaced libica-sles15sp2-FIPS-hmac-key.patch with an updated version named libica-sles15sp5-FIPS-hmac-key.patch. - Updated the libica-rpmlintrc file to suppress warnings about the libica-cex hmac files being hidden. - Updated the spec file to properly both obsolete and provide two older versions of the package. - Upgrade to version 4.1.1 (jsc#PED-581, bsc#1202365). v4.1.1 - [PATCH] Fix aes-xts multi-part operations [PATCH] Fix make dist v4.1.0 - [FEATURE] FIPS: make libica FIPS 140-3 compliant [FEATURE] New API function ica_ecdsa_sign_ex() [FEATURE] New icainfo output option -r - [PATCH] Various bug fixes - Removed the following obsolete files: baselibs.conf icaioctl.h - Upgrade to version 4.2.0 (jsc#PED-581, bsc#1202365). - [FEATURE] Display build info via icainfo -v - [FEATURE] New API function ica_get_build_version() - [FEATURE] Display fips indication via icainfo -f - [FEATURE] New API function ica_get_fips_indicator() - [FEATURE] New API function ica_aes_gcm_initialize_fips() - [FEATURE] New API function ica_aes_gcm_kma_get_iv() - [FEATURE] New API function ica_get_msa_level() - [PATCH] icainfo: check for malloc error when getting functionlist - Upgrade to version 4.2.1 (jsc#PED-2872) - [PATCH] fix regression opening shared memory - Add multibuild flavor to provide library compiled against openssl-3 [bsc#1207472] - Rename the hmac files for the openssl3 flavor [bsc#1207472] * Add libica-openssl3.patch * Rebase libica-sles15sp5-FIPS-hmac-key.patch - Added "Obsoletes: libica2" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1046435, bsc#1104638) - Added "Obsoletes: libica-2_3_0" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1112655) - Upgraded to version 3.3.3 (Fate#325690) * v3.3.3 [PATCH] Various bug fixes * v3.3.2 [PATCH] Skip ECC tests if required HW is not available [PATCH] Update spec file * v3.3.1 [PATCH] Fix configure.ac to honour CFLAGS * v3.3.0 [FEATURE] Add CEX supported elliptic-curve crypto interfaces [FEATURE] Add SIMD supported multiple-precision arithmetic interfaces [FEATURE] Add interface to enable/disable SW fallbacks [FEATURE] Add 'make check' target, test-suite rework * v3.2.1 [FEATURE] Use z14 PRNO-TRNG to seed SHA512-DRBG. [PATCH] Various bug fixes. - Dropped obsolete patch increment-icastats-counter-for-aes-gcm.patch - Removed COPYING from %files, since it is no longer in the tarball. - Added Add-non-executable-gnu-stack-markings-in-the-assembl.patch (bsc#1103493). - Made multiple changes to the spec file based on the output of spec-cleaner - Upgraded to version 3.4.0 (Fate#325690) * v3.4.0 [FEATURE] Add SHA-512/224 and SHA-512/256 support - Dropped obsolete patch Add-non-executable-gnu-stack-markings-in-the-assembl.patch - Made numerous updates to spec file based on spec-cleanup run. - Run testsuite during build - Upgraded to version 3.5.0 (Fate#327840) - [FEATURE] Add MSA9 CPACF support for ECDSA sign/verify - Reworked how libica-tools loads and unloads kernel modules to avoid spurious error messages (bsc#1134004): * Converted the boot.z90crypt sysV init script to a systemd unit file. * Removed any references to insserv in the spec file. * Updated the z90crypt script itself to properly load and unload the kernel modules as they exist today. * Eliminated the obsolete libica-SuSE.tar.bz2 archive. - Updated the README.SUSE file to reflect the change from sysV init style script to systemd. - Made numerous changes to the spec file, based on the output from the spec-cleaner command. - Upgraded to version 3.6.0 (jsc#SLE-7584) * [FEATURE] Add MSA9 CPACF support for Ed25519, Ed448, X25519 and X448 - Added libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch (bsc#1156768) - Added the following patches for FIPS certification. * libica-sles15sp2-Fix-DES-and-TDES-key-length.patch (bsc#1166071) Although a DES key has only 56 effective bits, all 64 bits must be considered, because the parity bits are spread over all 8 bytes of the key. * libica-sles15sp2-FIPS-provide-output-iv-as-required-by-FIPS-tests.patch (bsc#1166210) FIPS tests require the output iv to be the iv resulting from decrypting the last block with a zero iv as input. * libica-sles15sp2-icainfo-bugfix-for-RSA-and-EC-related-info-for-softw.patch (bsc#1166224) The output from icainfo never shows 'yes' for RSA ME, RSA CRT, ECDH, ECDSA sign, ECDSA verify, and ECKGEN, due to the missing ICA_FLAG_SW flag in the icaList. - Added the following patches for FIPS certification (bsc#1162533) * libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch * libica-sles15sp2-FIPS-hmac-key.patch - Added a BuildRequires for the fipscheck package. - Made a couple of changes to the spec file based upon recommendations by spec-cleaner. - Fix lack of SHA3 KATs in "make check" processing (bsc#1175277) * Added libica-sles15sp2-FIPS-add-SHA3-KATs-to-fips_powerup_tests.patch * Added libica-sles15sp2-FIPS-skip-SHA3-tests-if-running-on-hardware-without-.patch - Fix FIPS hmac check (bsc#1175356). * Update FIPS support to upstream - Refresh libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch from upstream. - Add libica-sles15sp2-Build-with-pthread-flag.patch - Add libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-addon.patch - Add libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-rename-variables.patch - Add libica-sles15sp2-FIPS-use-full-library-version-for-hmac-filename.patch * FIPS check should fail when hmac is missing - Add libica-sles15sp2-FIPS-fix-inconsistent-error-handling.patch - Create an hmac for the selftest - Check that selftest fails without a hmac - Hash libica.so.3 rather than libica.so.3.6.0 * Fix hmac key format. It should be hexadecimal, not ASCII - Refresh libica-sles15sp2-FIPS-hmac-key.patch - Fix Some internal variables used to store sensitive information (keys) were not zeroized before returning to the calling application. (bsc#1175357) * Added libica-sles15sp2-Zeroize-local-variables.patch - Updated libica-rpmlintrc to eliminate the warning about the HMAC file being a hidden file. It is supposed to be hidden. - Upgraded to version 3.7.0 (jsc#SLE-13708) * Version 3.7.0 - [FEATURE] FIPS: Add HMAC based library integrity check - [PATCH] icainfo: bugfix for RSA and EC related info for software column. - [PATCH] FIPS: provide output iv in cbc-cs decrypt as required by FIPS tests - [PATCH] FIPS: Fix DES and TDES key length - [PATCH] icastats: Fix stats counter format * Version 3.6.1 - [PATCH] Fix x25519 and x448 handling of non-canonical values - Removed the following obsolete patches * libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch * libica-sles15sp2-Fix-DES-and-TDES-key-length.patch * libica-sles15sp2-FIPS-provide-output-iv-as-required-by-FIPS-tests.patch * libica-sles15sp2-icainfo-bugfix-for-RSA-and-EC-related-info-for-softw.patch * libica-sles15sp2-Build-with-pthread-flag.patch * libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch * libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-addon.patch * libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-rename-variables.patch - Update to version 3.8.0 (jsc#SLE-18334) - [FEATURE] provide libica-cex module to satisfy special security requirements - [FEATURE] FIPS: enforce the HMAC check - Remove upstreamed patches: - libica-sles15sp2-FIPS-add-SHA3-KATs-to-fips_powerup_tests.patch - libica-sles15sp2-FIPS-skip-SHA3-tests-if-running-on-hardware-without-.patch - libica-sles15sp2-Zeroize-local-variables.patch - Remove patches obsoleted by upstrea developent: * FIPS: Find libica from phdrs. - libica-sles15sp2-FIPS-use-full-library-version-for-hmac-filename.patch * FIPS: enforce the hmac check - libica-sles15sp2-FIPS-fix-inconsistent-error-handling.patch - Fix up tests and hmac generation + libica-FIPS-make-it-possible-to-specify-fipshmac-binary.patch - Remove obsolete attributes from filelists - Upgrade to version 3.9.0 (jsc#SLE-18454, jsc#SLE-18564) - [FEATURE] Add support for OpenSSL 3.0 - [FEATURE] icainfo: new parm -c to display available EC curves - Replaced the obsolete PreReq: %fillup_prereq with Requires(post): %fillup_prereq in the spec file. - Upgraded to version 4.0.3 (jsc#PED-581, jsc#PED-621, jsc#PED-629) v4.0.3 - [PATCH] Reduce the number of open file descriptors - [PATCH] Various bug fixes v4.0.2 - [PATCH] Various bug fixes v4.0.1 - [PATCH] Various bug fixes - [PATCH] Compute HMAC from installed library v4.0.0 - [UPDATE] NO_SW_FALLBACKS is now the default for libica.so [UPDATE] Removed deprecated API functions including tests [UPDATE] Introduced 'const' for some API function parameters [FEATURE] icastats: new parm -k to display detailed counters - Replaced libica-sles15sp2-FIPS-hmac-key.patch with an updated version named libica-sles15sp5-FIPS-hmac-key.patch. - Updated the libica-rpmlintrc file to suppress warnings about the libica-cex hmac files being hidden. - Updated the spec file to properly both obsolete and provide two older versions of the package. - Upgrade to version 4.1.1 (jsc#PED-581, bsc#1202365). v4.1.1 - [PATCH] Fix aes-xts multi-part operations [PATCH] Fix make dist v4.1.0 - [FEATURE] FIPS: make libica FIPS 140-3 compliant [FEATURE] New API function ica_ecdsa_sign_ex() [FEATURE] New icainfo output option -r - [PATCH] Various bug fixes - Removed the following obsolete files: baselibs.conf icaioctl.h - Upgrade to version 4.2.0 (jsc#PED-581, bsc#1202365). - [FEATURE] Display build info via icainfo -v - [FEATURE] New API function ica_get_build_version() - [FEATURE] Display fips indication via icainfo -f - [FEATURE] New API function ica_get_fips_indicator() - [FEATURE] New API function ica_aes_gcm_initialize_fips() - [FEATURE] New API function ica_aes_gcm_kma_get_iv() - [FEATURE] New API function ica_get_msa_level() - [PATCH] icainfo: check for malloc error when getting functionlist - Upgrade to version 4.2.1 (jsc#PED-2872) - [PATCH] fix regression opening shared memory - Add multibuild flavor to provide library compiled against openssl-3 [bsc#1207472] - Rename the hmac files for the openssl3 flavor [bsc#1207472] * Add libica-openssl3.patch * Rebase libica-sles15sp5-FIPS-hmac-key.patch - Added "Obsoletes: libica2" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1046435, bsc#1104638) - Added "Obsoletes: libica-2_3_0" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1112655) - Upgraded to version 3.3.3 (Fate#325690) * v3.3.3 [PATCH] Various bug fixes * v3.3.2 [PATCH] Skip ECC tests if required HW is not available [PATCH] Update spec file * v3.3.1 [PATCH] Fix configure.ac to honour CFLAGS * v3.3.0 [FEATURE] Add CEX supported elliptic-curve crypto interfaces [FEATURE] Add SIMD supported multiple-precision arithmetic interfaces [FEATURE] Add interface to enable/disable SW fallbacks [FEATURE] Add 'make check' target, test-suite rework * v3.2.1 [FEATURE] Use z14 PRNO-TRNG to seed SHA512-DRBG. [PATCH] Various bug fixes. - Dropped obsolete patch increment-icastats-counter-for-aes-gcm.patch - Removed COPYING from %files, since it is no longer in the tarball. - Added Add-non-executable-gnu-stack-markings-in-the-assembl.patch (bsc#1103493). - Made multiple changes to the spec file based on the output of spec-cleaner - Upgraded to version 3.4.0 (Fate#325690) * v3.4.0 [FEATURE] Add SHA-512/224 and SHA-512/256 support - Dropped obsolete patch Add-non-executable-gnu-stack-markings-in-the-assembl.patch - Made numerous updates to spec file based on spec-cleanup run. - Run testsuite during build - Upgraded to version 3.5.0 (Fate#327840) - [FEATURE] Add MSA9 CPACF support for ECDSA sign/verify - Reworked how libica-tools loads and unloads kernel modules to avoid spurious error messages (bsc#1134004): * Converted the boot.z90crypt sysV init script to a systemd unit file. * Removed any references to insserv in the spec file. * Updated the z90crypt script itself to properly load and unload the kernel modules as they exist today. * Eliminated the obsolete libica-SuSE.tar.bz2 archive. - Updated the README.SUSE file to reflect the change from sysV init style script to systemd. - Made numerous changes to the spec file, based on the output from the spec-cleaner command. - Upgraded to version 3.6.0 (jsc#SLE-7584) * [FEATURE] Add MSA9 CPACF support for Ed25519, Ed448, X25519 and X448 - Added libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch (bsc#1156768) - Added the following patches for FIPS certification. * libica-sles15sp2-Fix-DES-and-TDES-key-length.patch (bsc#1166071) Although a DES key has only 56 effective bits, all 64 bits must be considered, because the parity bits are spread over all 8 bytes of the key. * libica-sles15sp2-FIPS-provide-output-iv-as-required-by-FIPS-tests.patch (bsc#1166210) FIPS tests require the output iv to be the iv resulting from decrypting the last block with a zero iv as input. * libica-sles15sp2-icainfo-bugfix-for-RSA-and-EC-related-info-for-softw.patch (bsc#1166224) The output from icainfo never shows 'yes' for RSA ME, RSA CRT, ECDH, ECDSA sign, ECDSA verify, and ECKGEN, due to the missing ICA_FLAG_SW flag in the icaList. - Added the following patches for FIPS certification (bsc#1162533) * libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch * libica-sles15sp2-FIPS-hmac-key.patch - Added a BuildRequires for the fipscheck package. - Made a couple of changes to the spec file based upon recommendations by spec-cleaner. - Fix lack of SHA3 KATs in "make check" processing (bsc#1175277) * Added libica-sles15sp2-FIPS-add-SHA3-KATs-to-fips_powerup_tests.patch * Added libica-sles15sp2-FIPS-skip-SHA3-tests-if-running-on-hardware-without-.patch - Fix FIPS hmac check (bsc#1175356). * Update FIPS support to upstream - Refresh libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch from upstream. - Add libica-sles15sp2-Build-with-pthread-flag.patch - Add libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-addon.patch - Add libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-rename-variables.patch - Add libica-sles15sp2-FIPS-use-full-library-version-for-hmac-filename.patch * FIPS check should fail when hmac is missing - Add libica-sles15sp2-FIPS-fix-inconsistent-error-handling.patch - Create an hmac for the selftest - Check that selftest fails without a hmac - Hash libica.so.3 rather than libica.so.3.6.0 * Fix hmac key format. It should be hexadecimal, not ASCII - Refresh libica-sles15sp2-FIPS-hmac-key.patch - Fix Some internal variables used to store sensitive information (keys) were not zeroized before returning to the calling application. (bsc#1175357) * Added libica-sles15sp2-Zeroize-local-variables.patch - Updated libica-rpmlintrc to eliminate the warning about the HMAC file being a hidden file. It is supposed to be hidden. - Upgraded to version 3.7.0 (jsc#SLE-13708) * Version 3.7.0 - [FEATURE] FIPS: Add HMAC based library integrity check - [PATCH] icainfo: bugfix for RSA and EC related info for software column. - [PATCH] FIPS: provide output iv in cbc-cs decrypt as required by FIPS tests - [PATCH] FIPS: Fix DES and TDES key length - [PATCH] icastats: Fix stats counter format * Version 3.6.1 - [PATCH] Fix x25519 and x448 handling of non-canonical values - Removed the following obsolete patches * libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch * libica-sles15sp2-Fix-DES-and-TDES-key-length.patch * libica-sles15sp2-FIPS-provide-output-iv-as-required-by-FIPS-tests.patch * libica-sles15sp2-icainfo-bugfix-for-RSA-and-EC-related-info-for-softw.patch * libica-sles15sp2-Build-with-pthread-flag.patch * libica-sles15sp2-FIPS-introduce-HMAC-based-library-integrity-check.patch * libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-addon.patch * libica-sles15sp2-FIPS-HMAC-based-library-integrity-check-rename-variables.patch - Update to version 3.8.0 (jsc#SLE-18334) - [FEATURE] provide libica-cex module to satisfy special security requirements - [FEATURE] FIPS: enforce the HMAC check - Remove upstreamed patches: - libica-sles15sp2-FIPS-add-SHA3-KATs-to-fips_powerup_tests.patch - libica-sles15sp2-FIPS-skip-SHA3-tests-if-running-on-hardware-without-.patch - libica-sles15sp2-Zeroize-local-variables.patch - Remove patches obsoleted by upstrea developent: * FIPS: Find libica from phdrs. - libica-sles15sp2-FIPS-use-full-library-version-for-hmac-filename.patch * FIPS: enforce the hmac check - libica-sles15sp2-FIPS-fix-inconsistent-error-handling.patch - Fix up tests and hmac generation + libica-FIPS-make-it-possible-to-specify-fipshmac-binary.patch - Remove obsolete attributes from filelists - Upgrade to version 3.9.0 (jsc#SLE-18454, jsc#SLE-18564) - [FEATURE] Add support for OpenSSL 3.0 - [FEATURE] icainfo: new parm -c to display available EC curves - Replaced the obsolete PreReq: %fillup_prereq with Requires(post): %fillup_prereq in the spec file. - Upgraded to version 4.0.3 (jsc#PED-581, jsc#PED-621, jsc#PED-629) v4.0.3 - [PATCH] Reduce the number of open file descriptors - [PATCH] Various bug fixes v4.0.2 - [PATCH] Various bug fixes v4.0.1 - [PATCH] Various bug fixes - [PATCH] Compute HMAC from installed library v4.0.0 - [UPDATE] NO_SW_FALLBACKS is now the default for libica.so [UPDATE] Removed deprecated API functions including tests [UPDATE] Introduced 'const' for some API function parameters [FEATURE] icastats: new parm -k to display detailed counters - Replaced libica-sles15sp2-FIPS-hmac-key.patch with an updated version named libica-sles15sp5-FIPS-hmac-key.patch. - Updated the libica-rpmlintrc file to suppress warnings about the libica-cex hmac files being hidden. - Updated the spec file to properly both obsolete and provide two older versions of the package. - Upgrade to version 4.1.1 (jsc#PED-581, bsc#1202365). v4.1.1 - [PATCH] Fix aes-xts multi-part operations [PATCH] Fix make dist v4.1.0 - [FEATURE] FIPS: make libica FIPS 140-3 compliant [FEATURE] New API function ica_ecdsa_sign_ex() [FEATURE] New icainfo output option -r - [PATCH] Various bug fixes - Removed the following obsolete files: baselibs.conf icaioctl.h - Upgrade to version 4.2.0 (jsc#PED-581, bsc#1202365). - [FEATURE] Display build info via icainfo -v - [FEATURE] New API function ica_get_build_version() - [FEATURE] Display fips indication via icainfo -f - [FEATURE] New API function ica_get_fips_indicator() - [FEATURE] New API function ica_aes_gcm_initialize_fips() - [FEATURE] New API function ica_aes_gcm_kma_get_iv() - [FEATURE] New API function ica_get_msa_level() - [PATCH] icainfo: check for malloc error when getting functionlist - Upgrade to version 4.2.1 (jsc#PED-2872) - [PATCH] fix regression opening shared memory - Add multibuild flavor to provide library compiled against openssl-3 [bsc#1207472] - Rename the hmac files for the openssl3 flavor [bsc#1207472] * Add libica-openssl3.patch * Rebase libica-sles15sp5-FIPS-hmac-key.patch - Initial release - Fix System/Libraries group for lib - Update to 12.10.2+14.04.20140304 * Latest release available in Ubuntu archives - no changelog provided - Enable build of GTK-3.0 subpackage - Added dont-build-debug-tools.patch, tools are used only for tests & developing indicators. Also, it pulls libido requirement, which does not exists on openSUSE - Update to version 12.10.2+14.04.20141007.1 + No changelog available - Use download Url as source - Update to 12.10.2+bzr20140922: + No changes. - Spec cleanup. - fix-compilation.patch: fix "cannot find -lglib-2.0-lm" compilation error. - Update to 12.10.2+bzr20140922: * Add -lm via LDADD to resolve FTBFS in Ubuntu 16.04. - Remove fix-compilation.patch: fixed upstream. - Update to version 16.10.0+bzr20171205: + Fix build with GNOME 3.28. - Rebase dont-build-debug-tools.patch. - Add pkgconfig(libido3-0.1) BuildRequires: new dependency. - Replace dont-build-debug-tools.patch with libindicator-disable-werror.patch: no need to avoid Ido. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - A shared systemd target for user session is shipped with the source, pack it up properly. https://bazaar.launchpad.net/~indicator-applet-developers/libindicator/trunk.16.10/revision/534 - Fix System/Libraries group for lib - Update to 12.10.2+14.04.20140304 * Latest release available in Ubuntu archives - no changelog provided - Enable build of GTK-3.0 subpackage - Added dont-build-debug-tools.patch, tools are used only for tests & developing indicators. Also, it pulls libido requirement, which does not exists on openSUSE - Update to version 12.10.2+14.04.20141007.1 + No changelog available - Use download Url as source - Update to 12.10.2+bzr20140922: + No changes. - Spec cleanup. - fix-compilation.patch: fix "cannot find -lglib-2.0-lm" compilation error. - Update to 12.10.2+bzr20140922: * Add -lm via LDADD to resolve FTBFS in Ubuntu 16.04. - Remove fix-compilation.patch: fixed upstream. - Update to version 16.10.0+bzr20171205: + Fix build with GNOME 3.28. - Rebase dont-build-debug-tools.patch. - Add pkgconfig(libido3-0.1) BuildRequires: new dependency. - Replace dont-build-debug-tools.patch with libindicator-disable-werror.patch: no need to avoid Ido. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - A shared systemd target for user session is shipped with the source, pack it up properly. https://bazaar.launchpad.net/~indicator-applet-developers/libindicator/trunk.16.10/revision/534 - Fix System/Libraries group for lib - Update to 12.10.2+14.04.20140304 * Latest release available in Ubuntu archives - no changelog provided - Enable build of GTK-3.0 subpackage - Added dont-build-debug-tools.patch, tools are used only for tests & developing indicators. Also, it pulls libido requirement, which does not exists on openSUSE - Update to version 12.10.2+14.04.20141007.1 + No changelog available - Use download Url as source - Update to 12.10.2+bzr20140922: + No changes. - Spec cleanup. - fix-compilation.patch: fix "cannot find -lglib-2.0-lm" compilation error. - Update to 12.10.2+bzr20140922: * Add -lm via LDADD to resolve FTBFS in Ubuntu 16.04. - Remove fix-compilation.patch: fixed upstream. - Update to version 16.10.0+bzr20171205: + Fix build with GNOME 3.28. - Rebase dont-build-debug-tools.patch. - Add pkgconfig(libido3-0.1) BuildRequires: new dependency. - Replace dont-build-debug-tools.patch with libindicator-disable-werror.patch: no need to avoid Ido. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - A shared systemd target for user session is shipped with the source, pack it up properly. https://bazaar.launchpad.net/~indicator-applet-developers/libindicator/trunk.16.10/revision/534 - Fix System/Libraries group for lib - Update to 12.10.2+14.04.20140304 * Latest release available in Ubuntu archives - no changelog provided - Enable build of GTK-3.0 subpackage - Added dont-build-debug-tools.patch, tools are used only for tests & developing indicators. Also, it pulls libido requirement, which does not exists on openSUSE - Update to version 12.10.2+14.04.20141007.1 + No changelog available - Use download Url as source - Update to 12.10.2+bzr20140922: + No changes. - Spec cleanup. - fix-compilation.patch: fix "cannot find -lglib-2.0-lm" compilation error. - Update to 12.10.2+bzr20140922: * Add -lm via LDADD to resolve FTBFS in Ubuntu 16.04. - Remove fix-compilation.patch: fixed upstream. - Update to version 16.10.0+bzr20171205: + Fix build with GNOME 3.28. - Rebase dont-build-debug-tools.patch. - Add pkgconfig(libido3-0.1) BuildRequires: new dependency. - Replace dont-build-debug-tools.patch with libindicator-disable-werror.patch: no need to avoid Ido. - Inject -Wno-error into CFLAGS. It's kinda ridiculous for code that is not maintained upstream to pass -Werror by default and then not catching up. So for now we accept warnings. - A shared systemd target for user session is shipped with the source, pack it up properly. https://bazaar.launchpad.net/~indicator-applet-developers/libindicator/trunk.16.10/revision/534 - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Update to new upstream release 6.34 * Reset state after a command failed, when multiple ones are issued. * Handle padding attribute properly in userspace. * Test to check the fix to add an IPv4 range containing more than 2^31 addresses. - Remove ipset-6.33-export-func.diff (merged) - Update to new upstream release 6.35 * Userspace revision handling is reworked * Backport patch: netfilter: ipset: use nfnl_mutex_is_locked * Missing nfnl_lock()/nfnl_unlock() is added to ip_set_net_exit() * netfilter: ipset: add resched points during set listing * Fix "don't update counters" mode when counters used at the matching * netfilter: ipset: Fix race between dump and swap - Add 0001-build-do-install-libipset-args.h.patch [boo#1077037]. - Update to new upstream release 6.36 * Adding a IPv4 range x.x.x.x–255.255.255.255 could lead to memory exhaustion, which has been fixed. - Drop 0001-build-do-install-libipset-args.h.patch (merged) - Update to new upstream release 6.38 * Fix parsing service names for ports. - Update to new upstream release 7.0 * A new internal protocol version between the kernel and userspace is used. This is required in order to support two new functions and the extendend LIST operation, which makes possible to run ipset in every case entirely over netlink, without the need to use getsockopt(). * The userspace library was reworked so it can be embedded without calling the binary. - Add ipset-file.diff [boo#1116432]. - Update to new upstream release 7.1 * Correct the manpage about the sort option * Implement sorting for hash types in the ipset tool * Fix to list/save into file specified by option - Remove ipset-file.diff (merged) - Update to new upstream release 7.2 * ipset: Fix memory accounting for hash types on resize - Update to new upstream release 7.3 * Fix rename concurrency with listing, which can result broken list/save results. * ipset: Copy the right MAC address in bitmap:ip,mac and hash:ip,mac sets. * ipset: Actually allow destination MAC address for hash:ip,mac sets too. - Update to release 7.4 * Wildcard support for the "hash:net,iface" type. - Update to release 7.5 * netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present. * netfilter: xt_set: Do not restrict --map-set to the mangle table. - Update to release 7.6 * Add checking system_power_efficient_wq in the source tree. - Update to release 7.9 * Enable memory accounting for ipset allocations * Expose the initval hash parameter to userspace * Add bucketsize parameter to all hash types * Support the -exist flag with the destroy command - Update to release 7.10 * Fix shift-out-of-bounds in htable_bits() - Update to release 7.11 * Argument parsing buffer overflow in ipset_parse_argv fixed - Update to release 7.14 * Allow specifying protocols by number * Limit the maximum range of consecutive elements to add/delete - Update to release 7.15 * netfilter: ipset: Fix maximal range check in hash_ipportnet4_uadt() - Tumbleweed is not affected by the following SLE issues: bsc#1122853 - Fix build with latest kernel, bsc#1223370 * bsc1223370.patch - Create initial package (v2.2.1) - Remove redundant tags/sections (cf. specfile guidelines) - Centralize the shlib package name - Provide pkgconfig symbols - Update to new upstream release 2.3.1 * Add support for optional object keys with the "{s?o}" syntax in json_unpack and the like * Add json_object_update_existing() and json_object_update_missing() for updating only existing keys or only adding missing keys to an object. * Add json_object_foreach() for more convenient iteration over objects. * When decoding JSON, write the number of bytes that were read from input to "error.position" also on success. This is handy with JSON_DISABLE_EOF_CHECK. * Add support for decoding any JSON value, not just arrays or objects. The support is enabled with the new "JSON_DECODE_ANY" flag. * Avoid problems with object's serial number growing too big. * Remove "+" and leading zeros from exponents in the encoder. * Decoding functions now return NULL if the first argument is NULL. - Verify GPG signature. - Update to new upstream release 2.6 * Fixed CVE-2013-6401: avoid bad performance in large JSON objects * The json_pack et al functions recognize the specifiers "s#", "+" and "+#" * Add the "JSON_DECODE_INT_AS_REAL" flag * Add "json_array_foreach()" function * Add the "json_boolean()" macro that returns the JSON true or false value based on its argument * Add "json_load_callback()" that calls a callback function repeatedly to read the JSON input. * Add JSON_ESCAPE_SLASH encoding flag to escape all occurences of '/' with '\/'. - Drop defunct gpg-offline and use local source_validator instead - Add baselibs.conf - Update to new upstream release 2.7 * The json_pack et al functions recognize the specifiers "s%", "+%" and "+#" * Add length-aware string constructors "json_stringn()" and "json_stringn_nocheck()", length-aware string mutators "json_string_setn()" and "json_string_setn_nocheck()", and a function for getting string's length "json_string_length()" * Support ""\u0000"" escapes in the decoder. The support can be enabled by using the ""JSON_ALLOW_NUL"" decoding flag * Add "json_boolean_value()" as an alias for "json_is_true()" * Add JSON_REAL_PRECISION encoding flag/macro for controlling real number precision * Define the maximum indentation as JSON_MAX_INDENT. * Fix cases when some malformed ""\uNNNN"" escapes could crash the decoder with an assertion failure * Avoid integer overflows with very long strings in UTF-8 decoder and hashtable * Check for *NULL* key in "json_object_get()" and "json_object_del()" * "json_unpack()": Allow mixing JSON_STRICT with optional keys. * Fix int/int32 mismatch * Parse subnormal numbers correctly - update to new upstream release 2.9 * New features: Add json_auto_t to automatically decref a value that goes out of scope. Available only on GCC and Clang. (#301) * Small documentation fixes. - changelog from 2.8 * New features: - Always preserve insertion order of object items. json_object_iter() and friends, json_object_foreach() and json_dumps() and friends now always work in the insertion order of object items (#293). - Add json_object_foreach_safe() macro that allows json_object_del() calls during iteration (#230). - Add json_get_alloc_funcs() to allow reading the allocation functions set by json_set_alloc_funcs() (#262, #264). - Add json_pack() format specifiers s?, o? and O? for values that can be null (#261, #270). * Bug fixes: - Fix a crash when parsing inputs consisting of very deeply nested arrays or objects (#282, #284). - Never convert numbers to integers in the parser when JSON_DECODE_INT_AS_REAL is set. - Fix a use-after-free in json_pack() error handling. - Fix subnormal number parsing on mingw32. - Handle out-of-memory situations gracefully in the hashtable implementation - Update to 2.14 (boo#1201817): * New Features: + Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the corresponding `nocheck` functions. + Add jansson_version_str() and jansson_version_cmp() for runtime version checking + Add json_object_update_new(), json_object_update_existing_new() and json_object_update_missing_new() functions + Add json_object_update_recursive() + Add `json_pack()` format specifiers s*, o* and O* for values that can be omitted if null (#339). + Add `json_error_code()` to retrieve numeric error codes (#365, #380, #381). + Enable thread safety for `json_dump()` on all systems. Enable thread safe `json_decref()` and `json_incref()` for modern compilers (#389). + Add `json_sprintf()` and `json_vsprintf()` (#393). * Fixes: + Handle `sprintf` corner cases. + Add infinite loop check in json_deep_copy() + Enhance JANSSON_ATTRS macro to support earlier C standard(C89) + Update version detection for sphinx-build + Fix error message in `json_pack()` for NULL object (#409). + Avoid invalid memory read in `json_pack()` (#421). + Call va_end after va_copy in `json_vsprintf()` (#427). + Improve handling of formats with '?' and '*' in `json_pack()` (#438). + Remove inappropriate `jsonp_free()` which caused segmentation fault in error handling (#444). + Fix incorrect report of success from `json_dump_file()` when an error is returned by `fclose()` (#359). + Make json_equal() const-correct (#344). + Fix incomplete stealing of references by `json_pack()` (#374) - Use GitHub as source URLs: Release hasn't been uploaded to digip.org. - Add check section. - Create initial package (v2.2.1) - Remove redundant tags/sections (cf. specfile guidelines) - Centralize the shlib package name - Provide pkgconfig symbols - Update to new upstream release 2.3.1 * Add support for optional object keys with the "{s?o}" syntax in json_unpack and the like * Add json_object_update_existing() and json_object_update_missing() for updating only existing keys or only adding missing keys to an object. * Add json_object_foreach() for more convenient iteration over objects. * When decoding JSON, write the number of bytes that were read from input to "error.position" also on success. This is handy with JSON_DISABLE_EOF_CHECK. * Add support for decoding any JSON value, not just arrays or objects. The support is enabled with the new "JSON_DECODE_ANY" flag. * Avoid problems with object's serial number growing too big. * Remove "+" and leading zeros from exponents in the encoder. * Decoding functions now return NULL if the first argument is NULL. - Verify GPG signature. - Update to new upstream release 2.6 * Fixed CVE-2013-6401: avoid bad performance in large JSON objects * The json_pack et al functions recognize the specifiers "s#", "+" and "+#" * Add the "JSON_DECODE_INT_AS_REAL" flag * Add "json_array_foreach()" function * Add the "json_boolean()" macro that returns the JSON true or false value based on its argument * Add "json_load_callback()" that calls a callback function repeatedly to read the JSON input. * Add JSON_ESCAPE_SLASH encoding flag to escape all occurences of '/' with '\/'. - Drop defunct gpg-offline and use local source_validator instead - Add baselibs.conf - Update to new upstream release 2.7 * The json_pack et al functions recognize the specifiers "s%", "+%" and "+#" * Add length-aware string constructors "json_stringn()" and "json_stringn_nocheck()", length-aware string mutators "json_string_setn()" and "json_string_setn_nocheck()", and a function for getting string's length "json_string_length()" * Support ""\u0000"" escapes in the decoder. The support can be enabled by using the ""JSON_ALLOW_NUL"" decoding flag * Add "json_boolean_value()" as an alias for "json_is_true()" * Add JSON_REAL_PRECISION encoding flag/macro for controlling real number precision * Define the maximum indentation as JSON_MAX_INDENT. * Fix cases when some malformed ""\uNNNN"" escapes could crash the decoder with an assertion failure * Avoid integer overflows with very long strings in UTF-8 decoder and hashtable * Check for *NULL* key in "json_object_get()" and "json_object_del()" * "json_unpack()": Allow mixing JSON_STRICT with optional keys. * Fix int/int32 mismatch * Parse subnormal numbers correctly - update to new upstream release 2.9 * New features: Add json_auto_t to automatically decref a value that goes out of scope. Available only on GCC and Clang. (#301) * Small documentation fixes. - changelog from 2.8 * New features: - Always preserve insertion order of object items. json_object_iter() and friends, json_object_foreach() and json_dumps() and friends now always work in the insertion order of object items (#293). - Add json_object_foreach_safe() macro that allows json_object_del() calls during iteration (#230). - Add json_get_alloc_funcs() to allow reading the allocation functions set by json_set_alloc_funcs() (#262, #264). - Add json_pack() format specifiers s?, o? and O? for values that can be null (#261, #270). * Bug fixes: - Fix a crash when parsing inputs consisting of very deeply nested arrays or objects (#282, #284). - Never convert numbers to integers in the parser when JSON_DECODE_INT_AS_REAL is set. - Fix a use-after-free in json_pack() error handling. - Fix subnormal number parsing on mingw32. - Handle out-of-memory situations gracefully in the hashtable implementation - Update to 2.14 (boo#1201817): * New Features: + Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the corresponding `nocheck` functions. + Add jansson_version_str() and jansson_version_cmp() for runtime version checking + Add json_object_update_new(), json_object_update_existing_new() and json_object_update_missing_new() functions + Add json_object_update_recursive() + Add `json_pack()` format specifiers s*, o* and O* for values that can be omitted if null (#339). + Add `json_error_code()` to retrieve numeric error codes (#365, #380, #381). + Enable thread safety for `json_dump()` on all systems. Enable thread safe `json_decref()` and `json_incref()` for modern compilers (#389). + Add `json_sprintf()` and `json_vsprintf()` (#393). * Fixes: + Handle `sprintf` corner cases. + Add infinite loop check in json_deep_copy() + Enhance JANSSON_ATTRS macro to support earlier C standard(C89) + Update version detection for sphinx-build + Fix error message in `json_pack()` for NULL object (#409). + Avoid invalid memory read in `json_pack()` (#421). + Call va_end after va_copy in `json_vsprintf()` (#427). + Improve handling of formats with '?' and '*' in `json_pack()` (#438). + Remove inappropriate `jsonp_free()` which caused segmentation fault in error handling (#444). + Fix incorrect report of success from `json_dump_file()` when an error is returned by `fclose()` (#359). + Make json_equal() const-correct (#344). + Fix incomplete stealing of references by `json_pack()` (#374) - Use GitHub as source URLs: Release hasn't been uploaded to digip.org. - Add check section. - Create initial package (v2.2.1) - Remove redundant tags/sections (cf. specfile guidelines) - Centralize the shlib package name - Provide pkgconfig symbols - Update to new upstream release 2.3.1 * Add support for optional object keys with the "{s?o}" syntax in json_unpack and the like * Add json_object_update_existing() and json_object_update_missing() for updating only existing keys or only adding missing keys to an object. * Add json_object_foreach() for more convenient iteration over objects. * When decoding JSON, write the number of bytes that were read from input to "error.position" also on success. This is handy with JSON_DISABLE_EOF_CHECK. * Add support for decoding any JSON value, not just arrays or objects. The support is enabled with the new "JSON_DECODE_ANY" flag. * Avoid problems with object's serial number growing too big. * Remove "+" and leading zeros from exponents in the encoder. * Decoding functions now return NULL if the first argument is NULL. - Verify GPG signature. - Update to new upstream release 2.6 * Fixed CVE-2013-6401: avoid bad performance in large JSON objects * The json_pack et al functions recognize the specifiers "s#", "+" and "+#" * Add the "JSON_DECODE_INT_AS_REAL" flag * Add "json_array_foreach()" function * Add the "json_boolean()" macro that returns the JSON true or false value based on its argument * Add "json_load_callback()" that calls a callback function repeatedly to read the JSON input. * Add JSON_ESCAPE_SLASH encoding flag to escape all occurences of '/' with '\/'. - Drop defunct gpg-offline and use local source_validator instead - Add baselibs.conf - Update to new upstream release 2.7 * The json_pack et al functions recognize the specifiers "s%", "+%" and "+#" * Add length-aware string constructors "json_stringn()" and "json_stringn_nocheck()", length-aware string mutators "json_string_setn()" and "json_string_setn_nocheck()", and a function for getting string's length "json_string_length()" * Support ""\u0000"" escapes in the decoder. The support can be enabled by using the ""JSON_ALLOW_NUL"" decoding flag * Add "json_boolean_value()" as an alias for "json_is_true()" * Add JSON_REAL_PRECISION encoding flag/macro for controlling real number precision * Define the maximum indentation as JSON_MAX_INDENT. * Fix cases when some malformed ""\uNNNN"" escapes could crash the decoder with an assertion failure * Avoid integer overflows with very long strings in UTF-8 decoder and hashtable * Check for *NULL* key in "json_object_get()" and "json_object_del()" * "json_unpack()": Allow mixing JSON_STRICT with optional keys. * Fix int/int32 mismatch * Parse subnormal numbers correctly - update to new upstream release 2.9 * New features: Add json_auto_t to automatically decref a value that goes out of scope. Available only on GCC and Clang. (#301) * Small documentation fixes. - changelog from 2.8 * New features: - Always preserve insertion order of object items. json_object_iter() and friends, json_object_foreach() and json_dumps() and friends now always work in the insertion order of object items (#293). - Add json_object_foreach_safe() macro that allows json_object_del() calls during iteration (#230). - Add json_get_alloc_funcs() to allow reading the allocation functions set by json_set_alloc_funcs() (#262, #264). - Add json_pack() format specifiers s?, o? and O? for values that can be null (#261, #270). * Bug fixes: - Fix a crash when parsing inputs consisting of very deeply nested arrays or objects (#282, #284). - Never convert numbers to integers in the parser when JSON_DECODE_INT_AS_REAL is set. - Fix a use-after-free in json_pack() error handling. - Fix subnormal number parsing on mingw32. - Handle out-of-memory situations gracefully in the hashtable implementation - Update to 2.14 (boo#1201817): * New Features: + Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the corresponding `nocheck` functions. + Add jansson_version_str() and jansson_version_cmp() for runtime version checking + Add json_object_update_new(), json_object_update_existing_new() and json_object_update_missing_new() functions + Add json_object_update_recursive() + Add `json_pack()` format specifiers s*, o* and O* for values that can be omitted if null (#339). + Add `json_error_code()` to retrieve numeric error codes (#365, #380, #381). + Enable thread safety for `json_dump()` on all systems. Enable thread safe `json_decref()` and `json_incref()` for modern compilers (#389). + Add `json_sprintf()` and `json_vsprintf()` (#393). * Fixes: + Handle `sprintf` corner cases. + Add infinite loop check in json_deep_copy() + Enhance JANSSON_ATTRS macro to support earlier C standard(C89) + Update version detection for sphinx-build + Fix error message in `json_pack()` for NULL object (#409). + Avoid invalid memory read in `json_pack()` (#421). + Call va_end after va_copy in `json_vsprintf()` (#427). + Improve handling of formats with '?' and '*' in `json_pack()` (#438). + Remove inappropriate `jsonp_free()` which caused segmentation fault in error handling (#444). + Fix incorrect report of success from `json_dump_file()` when an error is returned by `fclose()` (#359). + Make json_equal() const-correct (#344). + Fix incomplete stealing of references by `json_pack()` (#374) - Use GitHub as source URLs: Release hasn't been uploaded to digip.org. - Add check section. - Create initial package (v2.2.1) - Remove redundant tags/sections (cf. specfile guidelines) - Centralize the shlib package name - Provide pkgconfig symbols - Update to new upstream release 2.3.1 * Add support for optional object keys with the "{s?o}" syntax in json_unpack and the like * Add json_object_update_existing() and json_object_update_missing() for updating only existing keys or only adding missing keys to an object. * Add json_object_foreach() for more convenient iteration over objects. * When decoding JSON, write the number of bytes that were read from input to "error.position" also on success. This is handy with JSON_DISABLE_EOF_CHECK. * Add support for decoding any JSON value, not just arrays or objects. The support is enabled with the new "JSON_DECODE_ANY" flag. * Avoid problems with object's serial number growing too big. * Remove "+" and leading zeros from exponents in the encoder. * Decoding functions now return NULL if the first argument is NULL. - Verify GPG signature. - Update to new upstream release 2.6 * Fixed CVE-2013-6401: avoid bad performance in large JSON objects * The json_pack et al functions recognize the specifiers "s#", "+" and "+#" * Add the "JSON_DECODE_INT_AS_REAL" flag * Add "json_array_foreach()" function * Add the "json_boolean()" macro that returns the JSON true or false value based on its argument * Add "json_load_callback()" that calls a callback function repeatedly to read the JSON input. * Add JSON_ESCAPE_SLASH encoding flag to escape all occurences of '/' with '\/'. - Drop defunct gpg-offline and use local source_validator instead - Add baselibs.conf - Update to new upstream release 2.7 * The json_pack et al functions recognize the specifiers "s%", "+%" and "+#" * Add length-aware string constructors "json_stringn()" and "json_stringn_nocheck()", length-aware string mutators "json_string_setn()" and "json_string_setn_nocheck()", and a function for getting string's length "json_string_length()" * Support ""\u0000"" escapes in the decoder. The support can be enabled by using the ""JSON_ALLOW_NUL"" decoding flag * Add "json_boolean_value()" as an alias for "json_is_true()" * Add JSON_REAL_PRECISION encoding flag/macro for controlling real number precision * Define the maximum indentation as JSON_MAX_INDENT. * Fix cases when some malformed ""\uNNNN"" escapes could crash the decoder with an assertion failure * Avoid integer overflows with very long strings in UTF-8 decoder and hashtable * Check for *NULL* key in "json_object_get()" and "json_object_del()" * "json_unpack()": Allow mixing JSON_STRICT with optional keys. * Fix int/int32 mismatch * Parse subnormal numbers correctly - update to new upstream release 2.9 * New features: Add json_auto_t to automatically decref a value that goes out of scope. Available only on GCC and Clang. (#301) * Small documentation fixes. - changelog from 2.8 * New features: - Always preserve insertion order of object items. json_object_iter() and friends, json_object_foreach() and json_dumps() and friends now always work in the insertion order of object items (#293). - Add json_object_foreach_safe() macro that allows json_object_del() calls during iteration (#230). - Add json_get_alloc_funcs() to allow reading the allocation functions set by json_set_alloc_funcs() (#262, #264). - Add json_pack() format specifiers s?, o? and O? for values that can be null (#261, #270). * Bug fixes: - Fix a crash when parsing inputs consisting of very deeply nested arrays or objects (#282, #284). - Never convert numbers to integers in the parser when JSON_DECODE_INT_AS_REAL is set. - Fix a use-after-free in json_pack() error handling. - Fix subnormal number parsing on mingw32. - Handle out-of-memory situations gracefully in the hashtable implementation - Update to 2.14 (boo#1201817): * New Features: + Add `json_object_getn`, `json_object_setn`, `json_object_deln`, and the corresponding `nocheck` functions. + Add jansson_version_str() and jansson_version_cmp() for runtime version checking + Add json_object_update_new(), json_object_update_existing_new() and json_object_update_missing_new() functions + Add json_object_update_recursive() + Add `json_pack()` format specifiers s*, o* and O* for values that can be omitted if null (#339). + Add `json_error_code()` to retrieve numeric error codes (#365, #380, #381). + Enable thread safety for `json_dump()` on all systems. Enable thread safe `json_decref()` and `json_incref()` for modern compilers (#389). + Add `json_sprintf()` and `json_vsprintf()` (#393). * Fixes: + Handle `sprintf` corner cases. + Add infinite loop check in json_deep_copy() + Enhance JANSSON_ATTRS macro to support earlier C standard(C89) + Update version detection for sphinx-build + Fix error message in `json_pack()` for NULL object (#409). + Avoid invalid memory read in `json_pack()` (#421). + Call va_end after va_copy in `json_vsprintf()` (#427). + Improve handling of formats with '?' and '*' in `json_pack()` (#438). + Remove inappropriate `jsonp_free()` which caused segmentation fault in error handling (#444). + Fix incorrect report of success from `json_dump_file()` when an error is returned by `fclose()` (#359). + Make json_equal() const-correct (#344). + Fix incomplete stealing of references by `json_pack()` (#374) - Use GitHub as source URLs: Release hasn't been uploaded to digip.org. - Add check section. - Initial SUSE package. - build -32bit packages to make libtiff5-32bit installable - fix baselibs.conf - Added url as source. Please see http://en.opensuse.org/SourceUrls - Don't strip binaries - v2.1 -Fixes bnc#870855 -Fixes CVE-2013-6369 - security update - added patches fix CVE-2022-1210 [bsc#1198146], Malicious file leads to a denial of service in TIFF File Handler + jbigkit-CVE-2022-1210.patch - Initial SUSE package. - build -32bit packages to make libtiff5-32bit installable - fix baselibs.conf - Added url as source. Please see http://en.opensuse.org/SourceUrls - Don't strip binaries - v2.1 -Fixes bnc#870855 -Fixes CVE-2013-6369 - security update - added patches fix CVE-2022-1210 [bsc#1198146], Malicious file leads to a denial of service in TIFF File Handler + jbigkit-CVE-2022-1210.patch - Initial SUSE package. - build -32bit packages to make libtiff5-32bit installable - fix baselibs.conf - Added url as source. Please see http://en.opensuse.org/SourceUrls - Don't strip binaries - v2.1 -Fixes bnc#870855 -Fixes CVE-2013-6369 - security update - added patches fix CVE-2022-1210 [bsc#1198146], Malicious file leads to a denial of service in TIFF File Handler + jbigkit-CVE-2022-1210.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - add a userspace jitter entropy generator library - Trim conjecture from descriptions. - updated to 3.4.0 * enhancement: add API call jent_set_fips_failure_callback as requested by Daniel Ojalvo * fix: Change the SHA-3 integration: The entropy pool is now a SHA-3 state. It is filled with the time delta containing entropy and auxiliary data that does not contain entropy using a SHA update operation. The auxiliary data is calculated by a SHA-3 hashing of some varying state data. The time delta that contains entropy is measured about the SHA-3 hasing of the auxiliary data. This satisfies FIPS 140-3 IG D.K resolutions 4, 6, and 8. * enhancement: add CMake support by Andrew Hopkins - updated to 3.3.1 * fix: bug fix in initialization logic by Vladis Dronov <vdronov@redhat.com> * fix: use __asm__ instead of asm to suit the C11 standard - added a -devel-static package to be able to link it static. - updated to 3.4.1 * add FIPS 140 hints to man page * simplify the test tool to search for optimal configurations * fix: jent_loop_shuffle: re-add setting the time that was lost with 3.4.0 * enhancement: add ARM64 assembler code to read high-res timer - jitterentropy-split-internal-header.patch: Hide the non-GNUC constructs that are library internal from the exported header. (bsc#1202870) - jitterentropy-with-debug.patch: build with debuginfo (bsc#1207789) - Fix a stack corruption on s390x: [bsc#1209627] * Output size of the STCKE command on s390x is 16 bytes, compared to 8 bytes of the STCK command. Fix a stack corruption in the s390x version of jent_get_nstime(). Add some more detailed information on the STCKE command. * github.com/smuellerDD/jitterentropy-library/commit/7bf9f85 * Add jitterentropy-fix-a-stack-corruption-on-s390x.patch - Updated read_values.c for z16 machine type (bsc#1206832) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied a patch (bsc#1231003) * ziomon/ziorep_config: fix warning when multipath device is not there * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-warning-when-multipath-devi.patch - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Drop patch config-guess-sub-update.patch for libltdl/config as the folder no longer exists. - Drop patch libtool-ppc64le.patch for ppc handling as it is already part of v2.4.3 - Update to libtool 2.4.3 * * New features: - Moved to gnulib release infrastructure. - M4 is now used for scanning the M4 macros in your configure.ac that 'libtoolize' looks at to determine what files you want, and where you would like them installed. This means that you can compose your version number or any other argument that Libtoolize needs to know at M4 time using git-version-gen from gnulib, for example. - Invoking 'libtoolize --ltdl' no longer maintains a separate autoconf macro directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever macro directory is declared by the parent project. (Note: if you were already sharing a macro directory with AC_CONFIG_MACRO_DIR(ltdl/m4) or similar, that still works as does any other directory choice). - Invoking 'libtoolize --ltdl' no longer maintains a separate auxiliary scripts directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever auxiliary scripts directory is declared by the parent project. (Note: if you were already sharing an auxiliary directory with subproject libltdl using AC_CONFIG_AUX_DIR(ltdl/config) or similar, that still works as does any other directory choice). - The legacy tests have all been migrated to the Autotest harness. - The Autotest testsuite can be run without the especially time consuming tests with: make check-local TESTSUITEFLAGS='-k "!expensive"' * * Bug fixes: - Fix a long-standing latent bug in autom4te include path for autotests with VPATH builds. - Fix a long-standing latent bug in libtoolize that could delete lines from libltdl/Makefile.am in recursive mode due to underquoting in a sed script. - Fix a long-standing bug in libtoolize, by outputting the 'putting auxiliary files in' header with 'libtoolize --ltdl --subproject'. - Fix a long-standing bug in libtoolize subproject installation, by not installing a set of autoconf macro files into the parent project if there is no configure.ac present to use them. - The libtoolize subproject mode selector is now named '--subproject' and is equivalent to the implied '--subproject' mode when no other mode is selected; '--standalone' never worked, and is no longer accepted. - Libtool and libtoolize no longer choke on paths with a comma in them. - In the case where $SHELL does not have the same enhanced features (e.g. the ability to parse 'var+=append') as $CONFIG_SHELL, libtool will now correctly fallback to using only vanilla shell features instead of failing with a parse at startup. - Correctly recognize import libraries when Microsoft dumpbin is used as the name lister and extend the dumpbin wrapper to find symbols in import libraries using the -headers option of dumpbin. Also fix a bug in the dumpbin wrapper that could lead to broken symbol listings in some corner cases. - Use the improved Microsoft dumpbin support to mend preloading of import libraries for Microsoft Visual C/C++. - No longer mangle module-definition (.def) files when feeding them to the Microsoft Visual C/C++ linker via the -export-symbols argument to the libtool script, thus matching how .def files are handled when using GNU tools. - Recognize more variants (e.g. those starting with a LIBRARY statement) of module-definitions (.def) files when using them instead of a raw list of symbols to export. - Fix a long-standing bug when using libtoolize without automake; we no longer remove install-sh with --force, since it's not a file libtoolize will reinstall without --install.. * * Important incompatible changes: - GNU M4 is required to run libtoolize in a directory with a 'configure.ac' (or 'configure.in') that needs tracing to determine what modes and directories have been specified. - The use of the idiosyncratically named 'Makefile.inc' in nonrecursive libltdl builds is deprecated, although it will be supported for one more year or until the next release, whichever takes longer. Please upgrade to the more standard naming of 'ltdl.mk' in keeping with other GNU projects. - libtoolize now behaves consistenty in respect of multiple directory arguments to ACLOCAL_AMFLAGS and multiple invocations of AC_CONFIG- _MACRO_DIRS, where the first directory is always selected. Previous releases took the first ACLOCAL_AMFLAGS argument, but the last invocation of AC_CONFIG_MACRO_DIRS. - The libtoolize program now advises use of the new Autoconf AC_CONFIG_MACRO_DIRS declaration. If you follow that advice, all your developers will need at least autoconf-2.70 and automake-1.13 to rebootstrap your probject. If you still need to support bootstrap with older Autotools, then you should add the following to your configure.ac file: m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_define([AC_CONFIG_MACRO_DIRS], m4_defn([AC_CONFIG_MACRO_DIR]))]) - Overhead of probing for a non-backslash crippled echo equivalent during initialization of every script has been removed in favor of trusting that "printf %s\n" works out of the box on all non-museum host architectures. Manually setting ECHO appropriately in the build environment will be necessary on some ancient architectures. * * Changes in supported systems or compilers: - Support for bitrig (*-*-bitrig*). - Solaris 7 and earlier requires ECHO=/usr/ucb/echo in the build environment, to build and use libtool. - Add libtool-dont_delete_gnulib_files.patch that prevents deletion of files from gnulib to be deleted by libtoolize. - BuildRequire help2man. - Remove unneeded clean section. - Use rpm macros where possible. - Pass V=1 to make to make compilation verbose. - - Drop patch libtool-dont_delete_gnulib_files.patch which is included in 2.4.4 - Update to libtool 2.4.4 * * New features: - Libltdl maintains its own fork of argz, with macros and files in the LT_ and lt__ namespaces (resp.) where they cannot clash with client projects' use of gnulib argz. * * Bug fixes: - Installation of 'libtoolize' once again obeys '--program-prefix', '--program-suffix' and '--program-transform-name' configure options. - `libtoolize` doesn't remove any files that it can't reinstall, including old versions of the snippet directory, and gnulib's version of the argz module and supporting files. - LT_FUNC_DLYSM_USCORE now works correctly on systems that don't support self dlopen()ing. * * Important incompatible changes: - LT_LIB_DLLOAD no longer prepends -ldl or -ldld to LIBS, causing duplicate occurrences in libltdl link lines. If you need to add a library for dlopen() or shl_load() in your Makefile, then use $(LIBADD_DLOPEN) or $(LIBADD_SHL_LOAD) respectively. If you are using libltdl, this all happens automatically, and the only difference you'll see is no more duplicated library names in the verbose link line. * * Changes in supported systems or compilers: - Preliminary support for tcc on linux*. Although it already worked sometimes in previous releases, making sure to set LD correctly now avoids mis-matching GNU ld with tcc: ./configure CC=tcc LD=tcc - Added -os2dllname option to work around 8 character base name limit on OS/2. The option has no effect on other systems. - Support for DLL versioning, -export-symbols and -export-symbols-regex on OS/2. - Support filename-based shared library versioning on AIX. See manual for details. - Require M4 as libtool's libtoolize requires it since 2.4.3 - Update to libtool 2.4.5 New features: - Libtoolize searches for the best available M4 on the user PATH at runtime, rather than settling for the first one found. - Support munging sys_lib_dlsearch_path_spec with LT_SYS_LIBRARY_PATH environment variable. Bug fixes: - Bail out at configure time if the installed M4 is not sufficient for the purposes of libtoolize. - freebsd-elf library versioning was upgraded incorrectly in 2.4.4, but now works properly again. - Fix a 2.4.4 regression so that libltdl subprojects do not warn about missing libltdl/libltdl directory as in prior releases. - When using Sun C++ on Solaris or GNU/Linux we used to set libtool's postdeps permanently, based on the contents of $CXX and $CXXFLAGS at configure time, which was brittle and error-prone. Now, we no longer check for a SunCC ABI at configure time, but augment the postdeps at libtool time based on the current invocation flags on each call. Changes in supported systems or compilers: - /usr/local prefixed rpaths are now added to the link-line on ia64-hp-hpux*, because the default system runtime loader path does not contain them. - Previously, when using Sun C++ on Solaris or GNU/Linux, `-Cstd -Crun` flags were added to $postdeps unless CXX or CXXFLAGS contained `-library=stlport4`. Newer releases have added other compiler flags that are also incompatible with `-Cstd -Crun`, so now we don't add them if any of `-std=c++[0-9][0-9]`, `-library=stdcxx4` or `-compat=g` were found in CXX or CXXFLAGS when the Sun C++ compiler is detected. - Add libtool-no_host_name.patch to remove the host name from generated scripts (bnc#916268). - Update to 2.4.6: Noteworthy changes in release 2.4.6 (2015-02-15) [stable] * New features: - LT_SYS_LIBRARY_PATH can be set in config.site, or at configure time and persists correctly in the generated libtool script. * Bug fixes: - Fix a race condition in ltdl dryrun test that would cause spurious random failures of that test. - LT_SYS_DLSEARCH_PATH is munged correctly. - Add tarball signature. - Use url for signature - Add keyring file for automatic verification of signature - Cleanup spec file with spec-cleaner - Remove old ppc/ppc64 obsolete/provides - Update info pre/post requires and replace postun with preun - Remove empty entry. - Fix call of install_info. - Remove spurious install_info_delete in postun (bsc#940773). - Fix install_info_{install,delete} usage: install-info does not allow file globbing. - Drop patch config-guess-sub-update.patch for libltdl/config as the folder no longer exists. - Drop patch libtool-ppc64le.patch for ppc handling as it is already part of v2.4.3 - Update to libtool 2.4.3 * * New features: - Moved to gnulib release infrastructure. - M4 is now used for scanning the M4 macros in your configure.ac that 'libtoolize' looks at to determine what files you want, and where you would like them installed. This means that you can compose your version number or any other argument that Libtoolize needs to know at M4 time using git-version-gen from gnulib, for example. - Invoking 'libtoolize --ltdl' no longer maintains a separate autoconf macro directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever macro directory is declared by the parent project. (Note: if you were already sharing a macro directory with AC_CONFIG_MACRO_DIR(ltdl/m4) or similar, that still works as does any other directory choice). - Invoking 'libtoolize --ltdl' no longer maintains a separate auxiliary scripts directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever auxiliary scripts directory is declared by the parent project. (Note: if you were already sharing an auxiliary directory with subproject libltdl using AC_CONFIG_AUX_DIR(ltdl/config) or similar, that still works as does any other directory choice). - The legacy tests have all been migrated to the Autotest harness. - The Autotest testsuite can be run without the especially time consuming tests with: make check-local TESTSUITEFLAGS='-k "!expensive"' * * Bug fixes: - Fix a long-standing latent bug in autom4te include path for autotests with VPATH builds. - Fix a long-standing latent bug in libtoolize that could delete lines from libltdl/Makefile.am in recursive mode due to underquoting in a sed script. - Fix a long-standing bug in libtoolize, by outputting the 'putting auxiliary files in' header with 'libtoolize --ltdl --subproject'. - Fix a long-standing bug in libtoolize subproject installation, by not installing a set of autoconf macro files into the parent project if there is no configure.ac present to use them. - The libtoolize subproject mode selector is now named '--subproject' and is equivalent to the implied '--subproject' mode when no other mode is selected; '--standalone' never worked, and is no longer accepted. - Libtool and libtoolize no longer choke on paths with a comma in them. - In the case where $SHELL does not have the same enhanced features (e.g. the ability to parse 'var+=append') as $CONFIG_SHELL, libtool will now correctly fallback to using only vanilla shell features instead of failing with a parse at startup. - Correctly recognize import libraries when Microsoft dumpbin is used as the name lister and extend the dumpbin wrapper to find symbols in import libraries using the -headers option of dumpbin. Also fix a bug in the dumpbin wrapper that could lead to broken symbol listings in some corner cases. - Use the improved Microsoft dumpbin support to mend preloading of import libraries for Microsoft Visual C/C++. - No longer mangle module-definition (.def) files when feeding them to the Microsoft Visual C/C++ linker via the -export-symbols argument to the libtool script, thus matching how .def files are handled when using GNU tools. - Recognize more variants (e.g. those starting with a LIBRARY statement) of module-definitions (.def) files when using them instead of a raw list of symbols to export. - Fix a long-standing bug when using libtoolize without automake; we no longer remove install-sh with --force, since it's not a file libtoolize will reinstall without --install.. * * Important incompatible changes: - GNU M4 is required to run libtoolize in a directory with a 'configure.ac' (or 'configure.in') that needs tracing to determine what modes and directories have been specified. - The use of the idiosyncratically named 'Makefile.inc' in nonrecursive libltdl builds is deprecated, although it will be supported for one more year or until the next release, whichever takes longer. Please upgrade to the more standard naming of 'ltdl.mk' in keeping with other GNU projects. - libtoolize now behaves consistenty in respect of multiple directory arguments to ACLOCAL_AMFLAGS and multiple invocations of AC_CONFIG- _MACRO_DIRS, where the first directory is always selected. Previous releases took the first ACLOCAL_AMFLAGS argument, but the last invocation of AC_CONFIG_MACRO_DIRS. - The libtoolize program now advises use of the new Autoconf AC_CONFIG_MACRO_DIRS declaration. If you follow that advice, all your developers will need at least autoconf-2.70 and automake-1.13 to rebootstrap your probject. If you still need to support bootstrap with older Autotools, then you should add the following to your configure.ac file: m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_define([AC_CONFIG_MACRO_DIRS], m4_defn([AC_CONFIG_MACRO_DIR]))]) - Overhead of probing for a non-backslash crippled echo equivalent during initialization of every script has been removed in favor of trusting that "printf %s\n" works out of the box on all non-museum host architectures. Manually setting ECHO appropriately in the build environment will be necessary on some ancient architectures. * * Changes in supported systems or compilers: - Support for bitrig (*-*-bitrig*). - Solaris 7 and earlier requires ECHO=/usr/ucb/echo in the build environment, to build and use libtool. - Add libtool-dont_delete_gnulib_files.patch that prevents deletion of files from gnulib to be deleted by libtoolize. - BuildRequire help2man. - Remove unneeded clean section. - Use rpm macros where possible. - Pass V=1 to make to make compilation verbose. - - Drop patch libtool-dont_delete_gnulib_files.patch which is included in 2.4.4 - Update to libtool 2.4.4 * * New features: - Libltdl maintains its own fork of argz, with macros and files in the LT_ and lt__ namespaces (resp.) where they cannot clash with client projects' use of gnulib argz. * * Bug fixes: - Installation of 'libtoolize' once again obeys '--program-prefix', '--program-suffix' and '--program-transform-name' configure options. - `libtoolize` doesn't remove any files that it can't reinstall, including old versions of the snippet directory, and gnulib's version of the argz module and supporting files. - LT_FUNC_DLYSM_USCORE now works correctly on systems that don't support self dlopen()ing. * * Important incompatible changes: - LT_LIB_DLLOAD no longer prepends -ldl or -ldld to LIBS, causing duplicate occurrences in libltdl link lines. If you need to add a library for dlopen() or shl_load() in your Makefile, then use $(LIBADD_DLOPEN) or $(LIBADD_SHL_LOAD) respectively. If you are using libltdl, this all happens automatically, and the only difference you'll see is no more duplicated library names in the verbose link line. * * Changes in supported systems or compilers: - Preliminary support for tcc on linux*. Although it already worked sometimes in previous releases, making sure to set LD correctly now avoids mis-matching GNU ld with tcc: ./configure CC=tcc LD=tcc - Added -os2dllname option to work around 8 character base name limit on OS/2. The option has no effect on other systems. - Support for DLL versioning, -export-symbols and -export-symbols-regex on OS/2. - Support filename-based shared library versioning on AIX. See manual for details. - Require M4 as libtool's libtoolize requires it since 2.4.3 - Update to libtool 2.4.5 New features: - Libtoolize searches for the best available M4 on the user PATH at runtime, rather than settling for the first one found. - Support munging sys_lib_dlsearch_path_spec with LT_SYS_LIBRARY_PATH environment variable. Bug fixes: - Bail out at configure time if the installed M4 is not sufficient for the purposes of libtoolize. - freebsd-elf library versioning was upgraded incorrectly in 2.4.4, but now works properly again. - Fix a 2.4.4 regression so that libltdl subprojects do not warn about missing libltdl/libltdl directory as in prior releases. - When using Sun C++ on Solaris or GNU/Linux we used to set libtool's postdeps permanently, based on the contents of $CXX and $CXXFLAGS at configure time, which was brittle and error-prone. Now, we no longer check for a SunCC ABI at configure time, but augment the postdeps at libtool time based on the current invocation flags on each call. Changes in supported systems or compilers: - /usr/local prefixed rpaths are now added to the link-line on ia64-hp-hpux*, because the default system runtime loader path does not contain them. - Previously, when using Sun C++ on Solaris or GNU/Linux, `-Cstd -Crun` flags were added to $postdeps unless CXX or CXXFLAGS contained `-library=stlport4`. Newer releases have added other compiler flags that are also incompatible with `-Cstd -Crun`, so now we don't add them if any of `-std=c++[0-9][0-9]`, `-library=stdcxx4` or `-compat=g` were found in CXX or CXXFLAGS when the Sun C++ compiler is detected. - Add libtool-no_host_name.patch to remove the host name from generated scripts (bnc#916268). - Update to 2.4.6: Noteworthy changes in release 2.4.6 (2015-02-15) [stable] * New features: - LT_SYS_LIBRARY_PATH can be set in config.site, or at configure time and persists correctly in the generated libtool script. * Bug fixes: - Fix a race condition in ltdl dryrun test that would cause spurious random failures of that test. - LT_SYS_DLSEARCH_PATH is munged correctly. - Add tarball signature. - Use url for signature - Add keyring file for automatic verification of signature - Cleanup spec file with spec-cleaner - Remove old ppc/ppc64 obsolete/provides - Update info pre/post requires and replace postun with preun - Remove empty entry. - Fix call of install_info. - Remove spurious install_info_delete in postun (bsc#940773). - Fix install_info_{install,delete} usage: install-info does not allow file globbing. - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Add Fix-Crash-when-unregistering-UST-apps-during-shutdow.patch: Fix crash when unregistering UST apps during shutdown (bsc#1230128) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Add Fix-Crash-when-unregistering-UST-apps-during-shutdow.patch: Fix crash when unregistering UST apps during shutdown (bsc#1230128) - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - library for neighbour discovery, for later use by NetworkManager - Minor cleanups for inclusion into Factory: + Shared Library packages must only contain libraries (move binary file and man page to main package). + Adjust RPM Groups: Productivity/Networking/Other for the main package and System/Libraries for the shared library package. - Update to version 1.3: + libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf(). - No longer bootstrap: the tarball is complete. - Remove libtool, automake and autoconf BuildRequires: no longer needed. - Update to version 1.4: + libndp: fix buffer overflow in ndp_msg_opt_dnssl_domain(). - Update to version 1.6 (bsc#979645 CVE-2016-3698): * libndp: reject redirect and router advertisements from non-link-local * libndp: validate the IPv6 hop limit - Changes for version 1.5: * ndptool: validate the IPv6 hop limit - Small spec file adjustement: * Used spec-cleaner * Make building more verbose * Update describtion of subpackages * Use correct cathegory for subpackage - Add libndp-CVE-2024-5564.patch: add a check on the route information option length field (bsc#1225771 CVE-2024-5564). - library for neighbour discovery, for later use by NetworkManager - Minor cleanups for inclusion into Factory: + Shared Library packages must only contain libraries (move binary file and man page to main package). + Adjust RPM Groups: Productivity/Networking/Other for the main package and System/Libraries for the shared library package. - Update to version 1.3: + libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf(). - No longer bootstrap: the tarball is complete. - Remove libtool, automake and autoconf BuildRequires: no longer needed. - Update to version 1.4: + libndp: fix buffer overflow in ndp_msg_opt_dnssl_domain(). - Update to version 1.6 (bsc#979645 CVE-2016-3698): * libndp: reject redirect and router advertisements from non-link-local * libndp: validate the IPv6 hop limit - Changes for version 1.5: * ndptool: validate the IPv6 hop limit - Small spec file adjustement: * Used spec-cleaner * Make building more verbose * Update describtion of subpackages * Use correct cathegory for subpackage - Add libndp-CVE-2024-5564.patch: add a check on the route information option length field (bsc#1225771 CVE-2024-5564). - library for neighbour discovery, for later use by NetworkManager - Minor cleanups for inclusion into Factory: + Shared Library packages must only contain libraries (move binary file and man page to main package). + Adjust RPM Groups: Productivity/Networking/Other for the main package and System/Libraries for the shared library package. - Update to version 1.3: + libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf(). - No longer bootstrap: the tarball is complete. - Remove libtool, automake and autoconf BuildRequires: no longer needed. - Update to version 1.4: + libndp: fix buffer overflow in ndp_msg_opt_dnssl_domain(). - Update to version 1.6 (bsc#979645 CVE-2016-3698): * libndp: reject redirect and router advertisements from non-link-local * libndp: validate the IPv6 hop limit - Changes for version 1.5: * ndptool: validate the IPv6 hop limit - Small spec file adjustement: * Used spec-cleaner * Make building more verbose * Update describtion of subpackages * Use correct cathegory for subpackage - Add libndp-CVE-2024-5564.patch: add a check on the route information option length field (bsc#1225771 CVE-2024-5564). - library for neighbour discovery, for later use by NetworkManager - Minor cleanups for inclusion into Factory: + Shared Library packages must only contain libraries (move binary file and man page to main package). + Adjust RPM Groups: Productivity/Networking/Other for the main package and System/Libraries for the shared library package. - Update to version 1.3: + libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf(). - No longer bootstrap: the tarball is complete. - Remove libtool, automake and autoconf BuildRequires: no longer needed. - Update to version 1.4: + libndp: fix buffer overflow in ndp_msg_opt_dnssl_domain(). - Update to version 1.6 (bsc#979645 CVE-2016-3698): * libndp: reject redirect and router advertisements from non-link-local * libndp: validate the IPv6 hop limit - Changes for version 1.5: * ndptool: validate the IPv6 hop limit - Small spec file adjustement: * Used spec-cleaner * Make building more verbose * Update describtion of subpackages * Use correct cathegory for subpackage - Add libndp-CVE-2024-5564.patch: add a check on the route information option length field (bsc#1225771 CVE-2024-5564). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - security update - added patches fix CVE-2024-28182 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-1.patch fix CVE-2024-28182-2 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-2.patch - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - security update - added patches fix CVE-2024-28182 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-1.patch fix CVE-2024-28182-2 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-2.patch - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - security update - added patches fix CVE-2024-28182 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-1.patch fix CVE-2024-28182-2 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-2.patch - Export PYTHON=/usr/bin/python3 before running configure: allow to build without (comnplete) python2 in the buildroot. In any case we only ship python3-bindings already. - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - Export PYTHON=/usr/bin/python3 before running configure: allow to build without (comnplete) python2 in the buildroot. In any case we only ship python3-bindings already. - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - Export PYTHON=/usr/bin/python3 before running configure: allow to build without (comnplete) python2 in the buildroot. In any case we only ship python3-bindings already. - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - Use osc_scm to manage upstream input source. - Remove Provide for python package. - Remove explicit tar file name for setup step. - Update to version 1.0~2: * Add fabrics config option 'tls' * Logging infrastructure reworked (API break) * Changed argument structs layout (API break) * Changed scan API (API break) * Fixed ctrl_loss_tmo handling concerning values of '-1' * Various build fixes - Update to version v1.0-rc3: * Properly create manuals/documentation * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem() * nvme: get log domain id included in Log Specific Identifier * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns * ioctl: Add identify ioctl for CNS 09h, 0Ah * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * tree: do not set dhchap_key to 'none' * tree: restart controller lookup * tree: fixup memory leak in nvme_scan_ctrl() * Rename nvme_path_get_subsystem() * Remove nvme_reset_topology() - Use precompiled documentation instead regenerating it - Update to version 1.0-rc4: * fabrics: add default port number for NVMe/TCP I/O controllers * linux: Update size when telemetry controller initiated data is unavailable * add cdw13 for set_feature_args structure * Add support for TP8010 * Documentation cleanups - Update to version 1.0-rc5: * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121) * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025) * fabrics: Do not swap bytes for system uuid (bsc#1196565) * documentation updates - Update License information. The library is released under LGPL-2.1-or-later and not LGPL-2.1-only. - Update to version 1.0-rc6: * tree: add nvme_ctrl_get_ana_state() (bsc#1195938) * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938) * ioctl.h: ns list bug fix (wrong cns value) * types.h: Key Value Command Set Identifier added (NVME_CSI_KV) * types: fix status code type bug (wrong masking) - Update to version 1.0-rc7: * linux: fixup log page offset in nvme_get_log_page() * tree: Add support for default trsvcid for all controllers (bsc#1195858) * tree: fixup coredump during nvme discover - Update to version 1.0-rc8: * types: Add support for get log - MI Command Supported * types: Add new Identify constant * types: Update persistent event entry struct added new fields * types: Add Host Initiated Data Gen Number to telemetry log struct * tree: always allocate config file in nvme_read_config() * tree: rework nvme_scan_subsystem() * tree: make subsystem name mandatory in nvme_scan_ctrl() * tree: move nvme_init_subsystem() into nvme_lookup_subsystem() * tree: do not return error when filtering out subsystems * tree: add debugging messages during scanning * tree: Handle NULL subsysname in nvme_scan_ctrl() * tree: Fix subsystem initialization in nvme_scan_ctrl() * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace() * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL * tree: Clarify NULL return values from nvme_get_attr() * fabrics: Invoke nvmf_dim() with provided tas argument * fabrics: add 'nvmf_update_config()' * fabrics: Avoid out of bounds string chomping * fabrics: Free old traddr in nvmf_add_ctrl * fabrics: update log level for write failures * fabrics: Streamlining documentation * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry() * fabrics: Add missing break in a switch * ioctl: Remove attribute packed and alignedof for args structs * ioctl: Align arguments indentation with braces * json: fix endless loop scanning for controllers * Remove nvme_init_id_ns * Add lbstm support for create-ns * documentation updates - Update to version 1.0: * tree: Remove default port setting for TCP and RDMA ports * tree: add 'f_args' argument to pass user data to the filter function * tree: remove 'ctrl_get_ana_state()' * tree: add namespace path iterators * tree: filter out namespaces * tree: update nvme_scan_filter_t usage - Reduce log noise and export error codes (bsc#1199994 bsc#1199503) * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * add 0002-fabrics-Remove-double-connection-error-logging.patch * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch - Apply configuration from JSON file (bsc#1199503) * add 0004-libnvme-Export-nvme_ctrl_get_config.patch * add 0005-tree-Factor-lookup-code-for-controller.patch * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch - Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717) * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * add 0008-libnvme-accessors-for-dhchap_key-variables.patch * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * add 0012-Parse-dhchap_host_key-on-controller-level.patch * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch - Subsystem scanning logic fixes * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch - Fix PowerPC build warnings * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch - Fabrics fixes * add 0020-fabrics-sanitize-dump-config-output.patch * add 0021-fabrics-Fix-build_options-return-values.patch - Update to version 1.2 (jsc#PED-553): * 64-bit Reference Tags and TP-4068 changes * Add more details for return code of MI admin cmds * Fix poll.h includes * Parse dhchap_host_key on controller level * Regenerate all documentation * Update json config schema for missing dhchap host key * build: Add support to build against LibreSSL * build: Drop -nostdinc for LibreSSL header checks * fabrics: Add new TP8010 definitions * fabrics: Add nvmf_get_discovery_wargs() * fabrics: Duplicate strings when merging configs * fabrics: Filter out empty strings in add_argument() * fabrics: Fix build_options() return values * fabrics: Use fallthrough statement * fabrics: sanitize dump-config output * ioctl: Honor rae in nvme_get_nsid_log * ioctl: Set log page offset for nvme_get_log_telemetry_host * json-schema: add dhchap_key details to host section * json: Enforce correctly formatted JSON config files * json: Verify JSON config file starts with an array * json: fixup dhchap_ctrl_key definitions * libnvme-mi: Introduce NVMe Managament Interface library * mi-mctp: Add timeout support to MCTP transport * mi: Add Get Log Page helpers * mi: Add Identify function for secondary controller list * mi: Add Identify helper for ns-descs and primary-ctrl-caps * mi: Add endpoint get/set timeout API * mi: Add firmware download and commit commands * mi: Add identify helper for nsid-capable Controller List * mi: Add identify helpers for namespace lists * mi: Add identify helpers for namespaces * mi: Add maximum More Processing Required limit API * mi: Allow Admin-message sized More Processing Required responses * mi: Distinguish MI status from NVMe (CDW3) status * mi: Fix C++ compiler errors * mi: Implement Format NVM command * mi: Implement Get & Set Features Admin commands * mi: Implement NS attach command and helpers * mi: Implement Namespace Management command and create/delete helpers * mi: Implement Sanitize command * mi: Init ctrl_id within xfer * mi: Introduce a helper for response status, unify values with ioctls * mi: Set log page offset for nvme_get_log_telemetry_host * mi: add nvme_mi_status_to_string() * mi: fix a memory leak in nvme_mi_open_mctp() * mi: fix get_log_page chunked offset check * mi: unify MI Get Log Page function with ioctl API * nvme-tree: avoid segfault if auth keys are unavailable * python: Use nvmf_get_discovery_wargs() * python: add missing ctrl attrs to Python bindings * rpmbuild: Enable 'make rpm' to build rpm pkgs #408 * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key' * types: Move enum nvme_data_tfr to types * update/cleanup of documentation * util: Add LINE_MAX define * util: Add get feature length 2 API to support direction parameter * util: Add simple UUID type * util: Do not expose fallthrough defines * various build fixes * various fixes reported by coverity - Drop upstream patches * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch * remove 0002-fabrics-Remove-double-connection-error-logging.patch * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch * remove 0005-tree-Factor-lookup-code-for-controller.patch * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch * remove 0012-Parse-dhchap_host_key-on-controller-level.patch * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch * remove 0020-fabrics-sanitize-dump-config-output.patch * remove 0021-fabrics-Fix-build_options-return-values.patch - Make man page build conditiional. Install man page location has been fixed upstream. - Mark the Python directory own by the libnvme3-python package - Use fixed manpage build date (boo#1047218) - Fix installation of manual pages to make them accessible - Update to version 1.2+1.g41e1016: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Use symbol version LIBNVME_1_2_1 for nbft support options * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch * added %test section in spec file to run unit tests - temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686) - Update to version v1.4 (jsc#PED-553 jsc#PED-3884) - Fix invalid string lenght calculcation for UUID (bsc#1209906) * fabrics: Fix bad UUID size introduced in recent UUID changes - Fix segmentation fault during garbage collection (bsc#1209905) * python: Fix segmentation fault during garbage collection * Python: Fix crash during garbage collection - Always sanitize traddr and trsvcid entries (bsc#1207435) * fabrics: Always sanitize discovery log entries * util: Add ECONNECTREFUSED to enum nvme_connect_err - Allow tracking unique discover controllers (bsc#1186689) * tree: Add unique discovery controller flag - Enabled unit test on s390x again (bsc#1207687, bsc#1207686) * test: mi: Explicitly zero args for test API invocations - Replaced old nbft implementation with the upstream one - Applied nbft symbol patch directly * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch - Don't enable TLS if kernel does not support it (git-fixes) * fabrics: Do not pass unsupported options to kernel - Set version-tag so that version are correctly reported - Update to version 1.4+27.g5ae1c3: * tree: Add getter for subsystem iopolicy (bsc#1124564) * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598) * tree: Scan all subsystems (bsc#bsc#1212598) * tree: Don't open nvme devices until it's absolutely required (bsc#1213527 bsc#1213686) * tree: Use nvme_ipaddrs_eq() to compare IP addresses * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public. * util: Add ipaddrs_eq() to check whether two IP addresses are equal * fabrics: check genctr after getting discovery entries (bsc#1213618) * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618) - Update to version 1.4+29.ga3cf0a: * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993) * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993) - converted neededforbuild to BuildRequires - update to version 2.5.7: many fixes. - update to version 5.9.2: + many fixes - cleanup: + split into liborig2 and oniguruma-devel subpackages + corrected license information + changed summary to conform with policy - update version 5.9.5 * [impl] escape warnings for -Wall. * [impl] remove unused variable. - changes in 5.9.4 * [dist] add oniguruma.pc.in file - changes in 5.9.3 * fix print_tree ENCLOSE_OPTION bug - update version 5.9.6 * [impl] add onigenc_end_unicode(). * [impl] add onig_add_end_call(). - remove ruby build requires. seems unused. - Version 6.5.0 - [new] support Absent clear (Absent functions) - abolish configure option: --enable-combination-explosion-check - [new] support Absent functions (?~...) - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres - [new] support \O (true anychar) - [new] support \K (keep) - add new node type: NODE_GIMMICK - [new] support \N (no newline) - [new] support \R (general newline) - [new] support if-then-else syntax - [new] support backref validity checker - Version 6.4.0 - fix memory leaks - change encoding of doc/XXXX.ja from EUC-JP to UTF-8 - update doc/RE, and doc/RE.ja - fix fatal bug of endless repeat check on Windows - PR #62 : add check for return values - [new] support call zero (\g{0}) - [new] support relative call by positive number - [new] support relative back-reference by positive number - fix #60 : check value type - change output format for ONIG_DEBUG_COMPILE and ONIG_DEBUG_MATCH - Version 6.3.0 - fix #60 : invalid state(CCS_VALUE) in parse_char_class() - fix #59 : access to invalid address by reg->dmax value - fix invalid increment of start position in onig_scan() - fix #58 : access to invalid address by reg->dmin value - fix #57 : DATA_ENSURE() check must be before data access - fix #56 : return invalid result for codepoint 0xFFFFFFFF - [new] add \o{17777777777} syntax. - fix #55 : Byte value expressed in octal must be smaller than 256 - Version 6.2.0 - fix: size in xmemcpy in stack_double (PR #51) - Initialize return value - NEW API: add onig_set_capture_num_limit() - change MemNumType from short int to int - fix: [0-9-a] was not allowed as [0-9\-a] - fix: illegal capture after recursive call - fix: problem with optimization of \z - fix: .* optimization - Set a limit of parser recursion - fix; that warnings are not shown properly - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32 - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is used. - Version 6.1.3 - fix: Syntax error: redirection unexpected (expecting word) #35 - Version 6.1.2 - allow word bound, word begin and word end in look-behind. - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option. - fix use after free node. - fix memory leaks after parsing regexp error. - implement many of is_valid_mbc_string(). - Version 6.1.1 - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer) - fix error unmatched close parenthesis for %{(.*?)} #23 - Version 6.1.0 - add contributed/libfuzzer-onig.cpp (thanks hannob) - update LTVERSION 4:0:0 - NEW API: onigenc_is_valid_mbc_string(). - add is_valid_mbc_string() member into OnigEncodingType. - fix out of bounds read. - disable USE_INVALID_CODE_SCHEME. - doc/RE improved. - add onig_scan() into doc/API. - fix bug: Out of bounds read in onig_strcpy() #17 - fix bug: infinite loop of backreference and group. - fix out of bounds read in mbc_to_code() #16 - doc/RE refinements. - add onig_scan() (NEW API) - reimplement match stack allocation for case too many repeat - and too many captures in regexp. - number of captures <= 32767 for bytecode representation. - don't use int_map_backward for thread-safe. - fix case of enclosed option in look-behind. - fix ignore case in look-behind. - fix memory leak in onig_unicode_define_user_property() - declare variables at the top of scope. (thanks nmaya) - Version 6.0.0 - add NEW API: onig_unicode_define_user_property() - update Unicode data to 8.0.0 - change OnigCodePoint type to unsigned int. - add doc/UNICODE_PROPERTIES. - add error code ONIGERR_FAIL_TO_INITIALIZE. - add make_win64/32.bat. - fix bug of uninitialized regex_t value on error. - reimplement Unicode case folding. - update LTVERSION = 3.0.0 - remove all THREAD_ macro. - add init member into OnigEncoding. (add onig_initialize()) - remove state member of regex. - move source files into src/ - rename configre.in to configure.ac. - fix memory leak. (thanks pigzang) - change mail address. - Version 6.7.0 - add ONIG_SYNTAX_ONIGURUMA (default syntax) - restructure StackType - implement subexp calls (?R), (?&name), (?-n), (?+n) for Perl syntax - use string pool of gperf for Unicode Property lookup function - fix an empty greedy regex and a word boundary (.*\b) fails - remove a stack type STK_POS - add a declaration of onig_end() - fix compilation failure in out-of-source build - [new] hexadecimal codepoint \uHHHH - Version 6.6.1 - fix definition of \X to (?>\O(?:\Y\O)*) - Version 6.6.0 - rename Absent clear to Range clear - [new] Extended Grapheme Cluster \X and boundary \y, \Y - fix: invalid index(ctype) value assigned to Unicode Block properties - --enable-crnl-as-line-terminator to be deprecated - [new] ASCII only mode options (?WDSP) - [new] ONIG_OPTION_XXXX_IS_ASCII options - disable OP_CCLASS_NODE - [spec] Absent clear restore previous range value at backtrack - optimize for simple one char repetition in Absent expression - fix: invalid impl. for reluctant repetition in Absent expression - remove compile switch USE_NAMED_GROUP - Visual Studio 2005 compilation fixed - cleanup with spec-cleaner - Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246) oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c - Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204) oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c - Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203) oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c - Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163) oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c. - Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159) oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS - Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224) oniguruma: use-after-free in onig_new_deluxe() in regext.c - Added oniguruma-6.8.2-CVE-2019-13225-fix.patch (boo#1141157 CVE-2019-13225) oniguruma: null-pointer dereference in match_at() in regexec.c - converted neededforbuild to BuildRequires - update to version 2.5.7: many fixes. - update to version 5.9.2: + many fixes - cleanup: + split into liborig2 and oniguruma-devel subpackages + corrected license information + changed summary to conform with policy - update version 5.9.5 * [impl] escape warnings for -Wall. * [impl] remove unused variable. - changes in 5.9.4 * [dist] add oniguruma.pc.in file - changes in 5.9.3 * fix print_tree ENCLOSE_OPTION bug - update version 5.9.6 * [impl] add onigenc_end_unicode(). * [impl] add onig_add_end_call(). - remove ruby build requires. seems unused. - Version 6.5.0 - [new] support Absent clear (Absent functions) - abolish configure option: --enable-combination-explosion-check - [new] support Absent functions (?~...) - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres - [new] support \O (true anychar) - [new] support \K (keep) - add new node type: NODE_GIMMICK - [new] support \N (no newline) - [new] support \R (general newline) - [new] support if-then-else syntax - [new] support backref validity checker - Version 6.4.0 - fix memory leaks - change encoding of doc/XXXX.ja from EUC-JP to UTF-8 - update doc/RE, and doc/RE.ja - fix fatal bug of endless repeat check on Windows - PR #62 : add check for return values - [new] support call zero (\g{0}) - [new] support relative call by positive number - [new] support relative back-reference by positive number - fix #60 : check value type - change output format for ONIG_DEBUG_COMPILE and ONIG_DEBUG_MATCH - Version 6.3.0 - fix #60 : invalid state(CCS_VALUE) in parse_char_class() - fix #59 : access to invalid address by reg->dmax value - fix invalid increment of start position in onig_scan() - fix #58 : access to invalid address by reg->dmin value - fix #57 : DATA_ENSURE() check must be before data access - fix #56 : return invalid result for codepoint 0xFFFFFFFF - [new] add \o{17777777777} syntax. - fix #55 : Byte value expressed in octal must be smaller than 256 - Version 6.2.0 - fix: size in xmemcpy in stack_double (PR #51) - Initialize return value - NEW API: add onig_set_capture_num_limit() - change MemNumType from short int to int - fix: [0-9-a] was not allowed as [0-9\-a] - fix: illegal capture after recursive call - fix: problem with optimization of \z - fix: .* optimization - Set a limit of parser recursion - fix; that warnings are not shown properly - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32 - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is used. - Version 6.1.3 - fix: Syntax error: redirection unexpected (expecting word) #35 - Version 6.1.2 - allow word bound, word begin and word end in look-behind. - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option. - fix use after free node. - fix memory leaks after parsing regexp error. - implement many of is_valid_mbc_string(). - Version 6.1.1 - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer) - fix error unmatched close parenthesis for %{(.*?)} #23 - Version 6.1.0 - add contributed/libfuzzer-onig.cpp (thanks hannob) - update LTVERSION 4:0:0 - NEW API: onigenc_is_valid_mbc_string(). - add is_valid_mbc_string() member into OnigEncodingType. - fix out of bounds read. - disable USE_INVALID_CODE_SCHEME. - doc/RE improved. - add onig_scan() into doc/API. - fix bug: Out of bounds read in onig_strcpy() #17 - fix bug: infinite loop of backreference and group. - fix out of bounds read in mbc_to_code() #16 - doc/RE refinements. - add onig_scan() (NEW API) - reimplement match stack allocation for case too many repeat - and too many captures in regexp. - number of captures <= 32767 for bytecode representation. - don't use int_map_backward for thread-safe. - fix case of enclosed option in look-behind. - fix ignore case in look-behind. - fix memory leak in onig_unicode_define_user_property() - declare variables at the top of scope. (thanks nmaya) - Version 6.0.0 - add NEW API: onig_unicode_define_user_property() - update Unicode data to 8.0.0 - change OnigCodePoint type to unsigned int. - add doc/UNICODE_PROPERTIES. - add error code ONIGERR_FAIL_TO_INITIALIZE. - add make_win64/32.bat. - fix bug of uninitialized regex_t value on error. - reimplement Unicode case folding. - update LTVERSION = 3.0.0 - remove all THREAD_ macro. - add init member into OnigEncoding. (add onig_initialize()) - remove state member of regex. - move source files into src/ - rename configre.in to configure.ac. - fix memory leak. (thanks pigzang) - change mail address. - Version 6.7.0 - add ONIG_SYNTAX_ONIGURUMA (default syntax) - restructure StackType - implement subexp calls (?R), (?&name), (?-n), (?+n) for Perl syntax - use string pool of gperf for Unicode Property lookup function - fix an empty greedy regex and a word boundary (.*\b) fails - remove a stack type STK_POS - add a declaration of onig_end() - fix compilation failure in out-of-source build - [new] hexadecimal codepoint \uHHHH - Version 6.6.1 - fix definition of \X to (?>\O(?:\Y\O)*) - Version 6.6.0 - rename Absent clear to Range clear - [new] Extended Grapheme Cluster \X and boundary \y, \Y - fix: invalid index(ctype) value assigned to Unicode Block properties - --enable-crnl-as-line-terminator to be deprecated - [new] ASCII only mode options (?WDSP) - [new] ONIG_OPTION_XXXX_IS_ASCII options - disable OP_CCLASS_NODE - [spec] Absent clear restore previous range value at backtrack - optimize for simple one char repetition in Absent expression - fix: invalid impl. for reluctant repetition in Absent expression - remove compile switch USE_NAMED_GROUP - Visual Studio 2005 compilation fixed - cleanup with spec-cleaner - Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246) oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c - Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204) oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c - Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203) oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c - Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163) oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c. - Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159) oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS - Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224) oniguruma: use-after-free in onig_new_deluxe() in regext.c - Added oniguruma-6.8.2-CVE-2019-13225-fix.patch (boo#1141157 CVE-2019-13225) oniguruma: null-pointer dereference in match_at() in regexec.c - converted neededforbuild to BuildRequires - update to version 2.5.7: many fixes. - update to version 5.9.2: + many fixes - cleanup: + split into liborig2 and oniguruma-devel subpackages + corrected license information + changed summary to conform with policy - update version 5.9.5 * [impl] escape warnings for -Wall. * [impl] remove unused variable. - changes in 5.9.4 * [dist] add oniguruma.pc.in file - changes in 5.9.3 * fix print_tree ENCLOSE_OPTION bug - update version 5.9.6 * [impl] add onigenc_end_unicode(). * [impl] add onig_add_end_call(). - remove ruby build requires. seems unused. - Version 6.5.0 - [new] support Absent clear (Absent functions) - abolish configure option: --enable-combination-explosion-check - [new] support Absent functions (?~...) - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres - [new] support \O (true anychar) - [new] support \K (keep) - add new node type: NODE_GIMMICK - [new] support \N (no newline) - [new] support \R (general newline) - [new] support if-then-else syntax - [new] support backref validity checker - Version 6.4.0 - fix memory leaks - change encoding of doc/XXXX.ja from EUC-JP to UTF-8 - update doc/RE, and doc/RE.ja - fix fatal bug of endless repeat check on Windows - PR #62 : add check for return values - [new] support call zero (\g{0}) - [new] support relative call by positive number - [new] support relative back-reference by positive number - fix #60 : check value type - change output format for ONIG_DEBUG_COMPILE and ONIG_DEBUG_MATCH - Version 6.3.0 - fix #60 : invalid state(CCS_VALUE) in parse_char_class() - fix #59 : access to invalid address by reg->dmax value - fix invalid increment of start position in onig_scan() - fix #58 : access to invalid address by reg->dmin value - fix #57 : DATA_ENSURE() check must be before data access - fix #56 : return invalid result for codepoint 0xFFFFFFFF - [new] add \o{17777777777} syntax. - fix #55 : Byte value expressed in octal must be smaller than 256 - Version 6.2.0 - fix: size in xmemcpy in stack_double (PR #51) - Initialize return value - NEW API: add onig_set_capture_num_limit() - change MemNumType from short int to int - fix: [0-9-a] was not allowed as [0-9\-a] - fix: illegal capture after recursive call - fix: problem with optimization of \z - fix: .* optimization - Set a limit of parser recursion - fix; that warnings are not shown properly - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32 - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is used. - Version 6.1.3 - fix: Syntax error: redirection unexpected (expecting word) #35 - Version 6.1.2 - allow word bound, word begin and word end in look-behind. - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option. - fix use after free node. - fix memory leaks after parsing regexp error. - implement many of is_valid_mbc_string(). - Version 6.1.1 - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer) - fix error unmatched close parenthesis for %{(.*?)} #23 - Version 6.1.0 - add contributed/libfuzzer-onig.cpp (thanks hannob) - update LTVERSION 4:0:0 - NEW API: onigenc_is_valid_mbc_string(). - add is_valid_mbc_string() member into OnigEncodingType. - fix out of bounds read. - disable USE_INVALID_CODE_SCHEME. - doc/RE improved. - add onig_scan() into doc/API. - fix bug: Out of bounds read in onig_strcpy() #17 - fix bug: infinite loop of backreference and group. - fix out of bounds read in mbc_to_code() #16 - doc/RE refinements. - add onig_scan() (NEW API) - reimplement match stack allocation for case too many repeat - and too many captures in regexp. - number of captures <= 32767 for bytecode representation. - don't use int_map_backward for thread-safe. - fix case of enclosed option in look-behind. - fix ignore case in look-behind. - fix memory leak in onig_unicode_define_user_property() - declare variables at the top of scope. (thanks nmaya) - Version 6.0.0 - add NEW API: onig_unicode_define_user_property() - update Unicode data to 8.0.0 - change OnigCodePoint type to unsigned int. - add doc/UNICODE_PROPERTIES. - add error code ONIGERR_FAIL_TO_INITIALIZE. - add make_win64/32.bat. - fix bug of uninitialized regex_t value on error. - reimplement Unicode case folding. - update LTVERSION = 3.0.0 - remove all THREAD_ macro. - add init member into OnigEncoding. (add onig_initialize()) - remove state member of regex. - move source files into src/ - rename configre.in to configure.ac. - fix memory leak. (thanks pigzang) - change mail address. - Version 6.7.0 - add ONIG_SYNTAX_ONIGURUMA (default syntax) - restructure StackType - implement subexp calls (?R), (?&name), (?-n), (?+n) for Perl syntax - use string pool of gperf for Unicode Property lookup function - fix an empty greedy regex and a word boundary (.*\b) fails - remove a stack type STK_POS - add a declaration of onig_end() - fix compilation failure in out-of-source build - [new] hexadecimal codepoint \uHHHH - Version 6.6.1 - fix definition of \X to (?>\O(?:\Y\O)*) - Version 6.6.0 - rename Absent clear to Range clear - [new] Extended Grapheme Cluster \X and boundary \y, \Y - fix: invalid index(ctype) value assigned to Unicode Block properties - --enable-crnl-as-line-terminator to be deprecated - [new] ASCII only mode options (?WDSP) - [new] ONIG_OPTION_XXXX_IS_ASCII options - disable OP_CCLASS_NODE - [spec] Absent clear restore previous range value at backtrack - optimize for simple one char repetition in Absent expression - fix: invalid impl. for reluctant repetition in Absent expression - remove compile switch USE_NAMED_GROUP - Visual Studio 2005 compilation fixed - cleanup with spec-cleaner - Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246) oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c - Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204) oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c - Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203) oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c - Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163) oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c. - Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159) oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS - Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224) oniguruma: use-after-free in onig_new_deluxe() in regext.c - Added oniguruma-6.8.2-CVE-2019-13225-fix.patch (boo#1141157 CVE-2019-13225) oniguruma: null-pointer dereference in match_at() in regexec.c - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Update to version 0.4.23: + Various improvements to the NEON backend to bring it closer to the SSE backend. + Add support for setting a custom backup function. + Preserve NEON/VFP registers across subroutines. + Fix 64 bit parameter loading on big-endian systems. + Improved implementations for various opcodes. + Various improvements and fixes to constants handling. + Avoid some undefined operations on signed integers. + Prefer user specific directories over global ones for intermediate files to prevent name collisions. - disable make check for ppc64le archi would need changes in orcprogram-altivec.c and define of HAVE_POWERPC - Update to version 0.4.24: + Only reuse constants of the same size and value. + Fix reading of .orc files with Windows line endings on Windows. + Fix out of bounds array access in the tests. + Remove duplicate code path in orcc. + Put a limit to the memcpy test. + Fix mmap leak on error path. - disable testsuite on aarch64 - Update to version 0.4.25: + compiler: also prefer the backup function when no target, instead of trying to use emulation which is usually slower. + executor: fix load of parameters smaller than 64 bits, fixing crashes on ldresnearb and friends in emulated code. + test-limits: improve test without target. + Only check for Android's liblog on Android targets, so we don't accidentally pick up another liblog that may exist elsewhere. + Don't require libtool for uninstalled setups (-uninstalled pkg-config file). + Make -Bsymbolic check in configure work with clang. + Coverity code analyser fixes. + docs: update generated opcode tables. + Add orc_version_string() function and make orcc check the liborc that is being picked up to make sure the right lib is being used. - Update to version 0.4.26: + Use 64 bit arithmetic to increment the stride if needed. + Fix generation of ModR/M / SIB bytes for the EBP, R12, R13 registers on X86/X86-64. + Fix test_parse unit test if no executable backend is available. + Add orc-test path to the -uninstalled .pc file. + Fix compiler warnings in the tests on OS X. - Add pkgconfig(glib-2.0) BuildRequires, the build looks for it. - Remove obsolete bconds, they were only there for now obsolete versions of openSUSE. - Drop explicit xz BuildRequires: No longer needed. - Enable testsuite for all arches again. - Disable make check for all arches except x86_64 again. - Update to version 0.4.27: + sse: preserve non volatile sse registers, needed for MSVC. + x86: don't hard-code register size to 0 in orc_x86_emit_*() funcs. + Fix incorrect asm generation on 64-bit Windows with MSVC. + Add support for building using the Meson build system. - Switch to the meson build system, which knows how to cope with GTK 1.26+: + Use the tarball published on github (the automake bootstrapped one does not contain the meson build system). + Add meson BuildRequires and switch configure/make/make_install macros to the relevant meson/meson_build/meson_install variants. - Update to version 0.4.28: + Numerous undefined behaviour fixes. + Ability to disable tests. + Fix meson dist behaviour. - Add relax-tests.patch to increase test timeouts to 2 minutes, also limit the max value for memcpy_speed.c test bsc#1130085 - Backport patch from upstream to fix a stack-based buffer overflow in the Orc compiler when formatting error messages (bsc#1228184, CVE-2024-40897): * 0001-Use-vasprintf-if-available-for-error-messages-and.patch * 0002-Fix-build.patch - Update to version 0.4.23: + Various improvements to the NEON backend to bring it closer to the SSE backend. + Add support for setting a custom backup function. + Preserve NEON/VFP registers across subroutines. + Fix 64 bit parameter loading on big-endian systems. + Improved implementations for various opcodes. + Various improvements and fixes to constants handling. + Avoid some undefined operations on signed integers. + Prefer user specific directories over global ones for intermediate files to prevent name collisions. - disable make check for ppc64le archi would need changes in orcprogram-altivec.c and define of HAVE_POWERPC - Update to version 0.4.24: + Only reuse constants of the same size and value. + Fix reading of .orc files with Windows line endings on Windows. + Fix out of bounds array access in the tests. + Remove duplicate code path in orcc. + Put a limit to the memcpy test. + Fix mmap leak on error path. - disable testsuite on aarch64 - Update to version 0.4.25: + compiler: also prefer the backup function when no target, instead of trying to use emulation which is usually slower. + executor: fix load of parameters smaller than 64 bits, fixing crashes on ldresnearb and friends in emulated code. + test-limits: improve test without target. + Only check for Android's liblog on Android targets, so we don't accidentally pick up another liblog that may exist elsewhere. + Don't require libtool for uninstalled setups (-uninstalled pkg-config file). + Make -Bsymbolic check in configure work with clang. + Coverity code analyser fixes. + docs: update generated opcode tables. + Add orc_version_string() function and make orcc check the liborc that is being picked up to make sure the right lib is being used. - Update to version 0.4.26: + Use 64 bit arithmetic to increment the stride if needed. + Fix generation of ModR/M / SIB bytes for the EBP, R12, R13 registers on X86/X86-64. + Fix test_parse unit test if no executable backend is available. + Add orc-test path to the -uninstalled .pc file. + Fix compiler warnings in the tests on OS X. - Add pkgconfig(glib-2.0) BuildRequires, the build looks for it. - Remove obsolete bconds, they were only there for now obsolete versions of openSUSE. - Drop explicit xz BuildRequires: No longer needed. - Enable testsuite for all arches again. - Disable make check for all arches except x86_64 again. - Update to version 0.4.27: + sse: preserve non volatile sse registers, needed for MSVC. + x86: don't hard-code register size to 0 in orc_x86_emit_*() funcs. + Fix incorrect asm generation on 64-bit Windows with MSVC. + Add support for building using the Meson build system. - Switch to the meson build system, which knows how to cope with GTK 1.26+: + Use the tarball published on github (the automake bootstrapped one does not contain the meson build system). + Add meson BuildRequires and switch configure/make/make_install macros to the relevant meson/meson_build/meson_install variants. - Update to version 0.4.28: + Numerous undefined behaviour fixes. + Ability to disable tests. + Fix meson dist behaviour. - Add relax-tests.patch to increase test timeouts to 2 minutes, also limit the max value for memcpy_speed.c test bsc#1130085 - Backport patch from upstream to fix a stack-based buffer overflow in the Orc compiler when formatting error messages (bsc#1228184, CVE-2024-40897): * 0001-Use-vasprintf-if-available-for-error-messages-and.patch * 0002-Fix-build.patch - Update to version 0.4.23: + Various improvements to the NEON backend to bring it closer to the SSE backend. + Add support for setting a custom backup function. + Preserve NEON/VFP registers across subroutines. + Fix 64 bit parameter loading on big-endian systems. + Improved implementations for various opcodes. + Various improvements and fixes to constants handling. + Avoid some undefined operations on signed integers. + Prefer user specific directories over global ones for intermediate files to prevent name collisions. - disable make check for ppc64le archi would need changes in orcprogram-altivec.c and define of HAVE_POWERPC - Update to version 0.4.24: + Only reuse constants of the same size and value. + Fix reading of .orc files with Windows line endings on Windows. + Fix out of bounds array access in the tests. + Remove duplicate code path in orcc. + Put a limit to the memcpy test. + Fix mmap leak on error path. - disable testsuite on aarch64 - Update to version 0.4.25: + compiler: also prefer the backup function when no target, instead of trying to use emulation which is usually slower. + executor: fix load of parameters smaller than 64 bits, fixing crashes on ldresnearb and friends in emulated code. + test-limits: improve test without target. + Only check for Android's liblog on Android targets, so we don't accidentally pick up another liblog that may exist elsewhere. + Don't require libtool for uninstalled setups (-uninstalled pkg-config file). + Make -Bsymbolic check in configure work with clang. + Coverity code analyser fixes. + docs: update generated opcode tables. + Add orc_version_string() function and make orcc check the liborc that is being picked up to make sure the right lib is being used. - Update to version 0.4.26: + Use 64 bit arithmetic to increment the stride if needed. + Fix generation of ModR/M / SIB bytes for the EBP, R12, R13 registers on X86/X86-64. + Fix test_parse unit test if no executable backend is available. + Add orc-test path to the -uninstalled .pc file. + Fix compiler warnings in the tests on OS X. - Add pkgconfig(glib-2.0) BuildRequires, the build looks for it. - Remove obsolete bconds, they were only there for now obsolete versions of openSUSE. - Drop explicit xz BuildRequires: No longer needed. - Enable testsuite for all arches again. - Disable make check for all arches except x86_64 again. - Update to version 0.4.27: + sse: preserve non volatile sse registers, needed for MSVC. + x86: don't hard-code register size to 0 in orc_x86_emit_*() funcs. + Fix incorrect asm generation on 64-bit Windows with MSVC. + Add support for building using the Meson build system. - Switch to the meson build system, which knows how to cope with GTK 1.26+: + Use the tarball published on github (the automake bootstrapped one does not contain the meson build system). + Add meson BuildRequires and switch configure/make/make_install macros to the relevant meson/meson_build/meson_install variants. - Update to version 0.4.28: + Numerous undefined behaviour fixes. + Ability to disable tests. + Fix meson dist behaviour. - Add relax-tests.patch to increase test timeouts to 2 minutes, also limit the max value for memcpy_speed.c test bsc#1130085 - Backport patch from upstream to fix a stack-based buffer overflow in the Orc compiler when formatting error messages (bsc#1228184, CVE-2024-40897): * 0001-Use-vasprintf-if-available-for-error-messages-and.patch * 0002-Fix-build.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - No longer perform gpg validation; osc source_validator does it implicit: + Drop gpg-offline BuildRequires. + No longer execute gpg_verify. - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - enable rdma support (bsc#1230894) - No longer perform gpg validation; osc source_validator does it implicit: + Drop gpg-offline BuildRequires. + No longer execute gpg_verify. - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - No longer perform gpg validation; osc source_validator does it implicit: + Drop gpg-offline BuildRequires. + No longer execute gpg_verify. - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - No longer perform gpg validation; osc source_validator does it implicit: + Drop gpg-offline BuildRequires. + No longer execute gpg_verify. - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - enable rdma support (bsc#1230894) - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - enable rdma support (bsc#1230894) - update to 1.7.2 * Support for filtering Geneve encapsulated packets. * Fix handling of zones for BPF on Solaris * new DLT for ZWAVE * clarifications for read timeouts. * added bpf_filter1() with extensions * some fixes to compilation without stdint.h * EBUSY can now be returned by SNFv3 code. - refreshed libpcap-ocloexec.patch - libpcap 1.7.3: * work around a Linux bonding driver bug. - remove dependency on libusb-devel, only libusb-1.0 is used for build. - split a -devel-static subpackage that contains the static libraries and all the extra dependencies which are not needed for dynamic linking. - libpcap-no-old-socket.patch: never fallback to the obsolete SOCK_PACKET (kernel < 2.2) interface, this still happens for example, when you update the kernel, run iftop and the old kernel af_packet module wasn't loaded, program fails and the kernel prints "iftop uses obsolete (PF_INET,SOCK_PACKET)" - update to 1.8.1 * Clean up the name-to-DLT mapping table. * Add some newer DLT_ values: IPMI_HPM_2,ZWAVE_R1_R2,ZWAVE_R3,WATTSTOPPER_DLM,ISO_14443,RDS * Fix handling of packet count in the TPACKET_V3 inner loop: GitHub issue [#493]. * Filter out duplicate looped back CAN frames. * Fix the handling of loopback filters for IPv6 packets. * Add a link-layer header type for RDS (IEC 62106) groups. * On Linux, handle all CAN captures with pcap-linux.c, in cooked mode. * Removes the need for the "host-endian" link-layer header type. * Compile with '-Wused-but-marked-unused' in devel mode if supported * Have separate DLTs for big-endian and host-endian SocketCAN headers. * Require that version.h be generated: all build procedures we support generate version.h (autoconf, CMake, MSVC)! * Properly check for sock_recv() errors. * Re-impose some of Winsock's limitations on sock_recv(). * Replace sprintf() with pcap_snprintf(). * Fix signature of pcap_stats_ex_remote(). * Have rpcap_remoteact_getsock() return a SOCKET and supply an "is active" flag. * Clean up {DAG, Septel, Myricom SNF}-only builds. * pcap_create_interface() needs the interface name on Linux. * Clean up hardware time stamp support: the "any" device does not support any time stamp types. * Recognize 802.1ad nested VLAN tag in vlan filter. - dropped libpcap-ocloexec.patch, never upstreamed. - refreshed libpcap-1.0.0-ppp.patch - Allow bluetooth monitoring support unconditionally. - Formatted the specs file using spec-cleaner. - Dropped patches not required after review * libpcap-1.0.0-pcap-bpf.patch * libpcap-1.5.2-filter-fix.patch - Reference of the pull request for the rest of the patches * https://github.com/the-tcpdump-group/libpcap/issues/196 - Changed libpcap-1.0.0-s390.patch to the git formatted one - Do not put conditions about the provides for < 11.0 - Restore section setting $pic - Added a patch (disable-remote.diff) to fix applications to FTBFS if they define HAVE_REMOTE (deb#843384). Patch taken from Debian. - Fix SRPM group - update to 1.9.0 * add testing system to libpcap, independent of tcpdump * changes to how pcap_t is activated * update included copies of BSD 4-clause license to 3-clause * additions to TCP header parsing, per RFC3168 * support setting non-blocking mode before activating * fixes so that non-AF_INET addresses, are not ==AF_INET6 addresses * pcap_compile() in 1.8.0 and later is newly thread-safe * bound snaplen for linux tpacket_v2 to ~64k * make VLAN filter handle both metadata and inline tags (bsc#874131 bsc#993691 fate#321405) * D-Bus captures can now be up to 128MB in size * add DLT_LORATAP and DLT_VSOCK * allow specifying a specific capture protocol * RDMA sniffing support for pcap * increase minimum autoconf version requirement to 2.64 * rpcapd: support for xinetd.conf and systemd units * provide pkgconfig file - add BuildRequires for autoconf >= 2.64 - package (newly added) pkgconfig file - Check-only-VID-in-VLAN-test-issue-461.patch: fix "vlan <id>" test to check only VID, not complete TCI - drop disable-remote.diff (superseded by upstream changes) - Use FAT LTO objects in order to provide proper static library. - Update to 1.9.1 [bsc#1153332] * Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165 * Fixes for CVE-2018-16301, errors in pcapng reading. * Mention pcap_get_required_select_timeout() in the main pcap man page * Fix pcap-usb-linux.c build on systems with musl * Fix assorted man page and other documentation issues * Plug assorted memory leaks * Documentation changes to use https: * Changes to how time stamp calculations are done * Lots of tweaks to make newer compilers happier and warning-free and to fix instances of C undefined behavior * Warn if AC_PROG_CC_C99 can't enable C99 support * Rename pcap_set_protocol() to pcap_set_protocol_linux(). * Align pcap_t private data on an 8-byte boundary. * Fix various error messages * Use 64-bit clean API in dag_findalldevs() * Fix cleaning up after some errors * Work around some ethtool ioctl bugs in newer Linux kernels * Add backwards compatibility sections to some man pages * Fix autotool configuration on AIX and macOS * Don't export bpf_filter_with_aux_data() or struct bpf_aux_data; they're internal-only and subject to change * Fix pcapng block size checking * Fix reading of capture statistics for Linux USB * Fix packet size values for Linux USB packets * Check only VID in VLAN test in filterss * Fix pcap_list_datalinks on 802.11 devices on macOS * Fix overflows with very large snapshot length in pcap file * Improve parsing of rpcapd configuration file * Handle systems without strlcpy() or strlcat() better * Fix crashes and other errors with invalid filter expressions * Fix use of uninitialized file descriptor in remote capture * Fix some CMake issues * Fix some divide-by-zero issues with the filter compiler * Work around a GNU libc bug in pcap_nametonetaddr() * Add support for DLT_LINUX_SLL2 * Fix handling of the packet-count argument for Myricom SNF devices * Fix --disable-rdma in configure script * Fix compilation of TurboCap support * Constify first argument to pcap_findalldevs_ex() * Fix a number of issues when running rpcapd as an inetd-style daemon * Fix CMake issues with D-Bus libraries * In rpcapd, clean up termination of a capture session * Redo remote capture protocol negotiation * In rpcapd, report the same error for "invalid user name" and "invalid password", to make brute-forcing harder * For remote captures, add an error code for "the server requires TLS" * Fix building as part of Npcap * Allow rpcapd to rebind more rapidly * Fix building shared libpcap library on midipix (midipix.org) * Fix hack to detect UTF-16LE adapter names on Windows not to go past the end of the string * Have pcap_dump_open_append() create the dump file if it doesn't exists * Fix the maxmum snapshot length for DLT_USBPCAP * Use -fPIC when building for 64-bit SPARC on Linux * Fix CMake 64-bit library installation directory on some Linux distributions * Boost the TPACKET_V3 timeout to the maximum if a timeout of 0 was specified * PCAPNG reader applies some sanity checks before doing malloc(). - Drop patch fixed upstream: * Check-only-VID-in-VLAN-test-issue-461.patch - Rebase patch: * libpcap-1.0.0-ppp.patch - Update to 1.10.0 * Require, and assume, some level of C99 support in the C compiler * Add support for capturing on DPDK devices * rpcap: support rpcap-over-TLS * Fix some memory leaks, including in pcap_compile() * Linux: handle systems without AF_INET or AF_UNIX socket support * Catch invalid IPv4 addresses in filters * Show special Linux BPF offsets symbolically in bpf_image() and bpf_dump() * Linux: get rid of Wireless Extensions for turning monitor mode on * Linux: proper memory sync for PACKET_MMAP * Linux: drop support for libnl 1 and 2. * Linux: Require PF_PACKET support, and kernel 2.6.27 or later * Add DLT_LINUX_SLL2 * Add a new filter "ifindex" for DLT_LINUX_SLL2 files and live Linux captures * optimizer: add a hack to try to catch certain optimizer loops * Probe CONFIGURATION descriptor of connected USB devices * Linux: return error on interface going away, but not if it just went down * Linux: set socket protocol only after packet ring configured, reducing bogus packet drop reports * Linux: get ifdrop stats from sysfs. * Fix various security issues reported by Charles Smith at Tangible Security * Fix various security issues reported by Include Security * rpcapd: on UN*X, don't tell the client why authentication failed * Linux: when adjusting BPF programs, do not subtract the SLL[2]_HDR_LEN if the location is negative (special metadata offset) * Linux: with a timeout of zero, wait indefinitely * Linux: clean up support for some non-GNU libc C libraries * Increase the maximum snaplen for LINKTYPE_USBPCAP/DLT_USBPCAP * Fix handling of some ioctls that fail with "permission denied" even when the ioctl isn't supported at all * Added support for ICMPv6 types 1-4 as tokens in filters * Report the DLT description in error messages * Linux: Add support for DSA data link types * Linux USB: use the snapshot length to set the buffer size, and set the len field to reflect the length in the URB * rpcapd: allow rpcapd to rebind more rapidly * Add Haiku pcap implementation * rpcap: redo protocol version negotiation to avoid problems with old servers (it still works with servers using the old negotiation, as well as servers not supporting negotiation) * Remove (unused) SITA support here. * Correctly handle pcapng captures with more than one IDB with a snspshot length greater than the supported maximum - Remove libpcap-no-old-socket.patch - Rebase libpcap-1.0.0-s390.patch - Update to 1.10.1 * Fix "type XXX subtype YYY" giving a parse error * Add PCAP_AVAILABLE_1_11. * Rename struct bpf_aux_data to avoid NetBSD compile errors * Fix cross-builds with older kernels lacking BPF_MOD and BPF_XOR * Fix Bison detection for minor version 0. * Fix parallel build with FreeBSD make. * Get DLT_MATCHING_MAX right in gencode.c on NetBSD. * Define timeradd() and timersub() if necessary. * Fix Cygwin/MSYS target directories. * Fix symlinking with DESTDIR. * Fix generation of libpcap.pc with CMake when not building a shared library. * Support reading version 1.2, which some writers produce, and which is the same as 1.0 * Drop support for text-mode USB captures, as we require a 2.6.27 or later kernel * Bluetooth: fix non-blocking mode. Don't assume that all compilers used to build for Linux support the __atomic builtins - Security fix: [bsc#1230020, CVE-2023-7256] * libpcap: double free via addrinfo in sock_initaddress() * Add libpcap-CVE-2023-7256.patch - Security fix: [bsc#1230034, CVE-2024-8006] * libpcap: NULL pointer derefence in pcap_findalldevs_ex() * Add libpcap-CVE-2024-8006.patch - enable rdma support (bsc#1230894) - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Conditionalize python2 and python3 in order to be able to build without python2 present in distribution * Use singlespec macros to simplify the logic - Run fdupes on python modules to avoid duplicates - Remove shebangs from import-only code - Add adding-Release_CompareAndSwap-64-bit-variant.patch * Fix compile error undefined reference to `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)' on s390x https://github.com/google/protobuf/issues/3937 update to version v3.5.2: * Update release date * Disable pip cache when testing uploaded packages * Replace private timelib_update_ts with public date_timestamp_get * Remove py2.6 support. * Cherrypick for csharp, including: * Update changelog * Update changelog for 3.5.1 * Fix uploading binary wheel. * Fix memory leak when creating map field via array. * Update rake file to build of 2.1.6. * Avoid using php_date_get_date_ce() in case date extension is not * Update protoc-artfacts * Fix string::back() usage in googletest.cc * Fix memory leak in php7 * Support ruby2.5 * io_win32: support non-ASCII paths * Explicitly propagate the status of Flush(). * Add discard unknown API in ruby. (#3990) * Update version for 3.5.0.post1 * remove nullptr * Fix more memory leak for php c extension (#4211) * Bumping number to fix ruby 2.1 on mac * io_win32_unittest: remove incorrect error check * Fix memory leak when creating repeated field via array. * Update version number for php c extension (#3896) * Fix file permission for python package. * Create containing directory before generating well_known_types_embed.cc * Replace C++11 only method std::map::at * Recursively clear unknown fields in submessages. (#3982) * Update version number to 3.5.1 * io_win32_unittest: fix condition in GetCwdAsUtf8 * Add release log * io_win32_unittest: use CWD as last tempdir * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util * Add support for Windows ARM64 build * Add protobuf-all in post release * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886) * Add _file_desc_by_toplevel_extension back * Fix setup.py for windows build. * io_win32_unittest: make //:win32_test run again * Provide discardUnknonwnFields API in php (#3976) * Update php c extension version number to 3.5.0.1 * Fix ruby gc_test in ruby 2.4 (#4011) * Remove duplicate typedef. (#3975) * Accept DatetimeInterface in fromDatetime * io_win32: add more encoding-related tests * Bump version number to 3.5.2 * Bump protoc-artifact version for a patch rebuild * Call php method via function name instead of calling directly. * Well known types are not initialized properly. (#4139) * Use matching enum type for IsPOD. * Fix several more memory leak * Fix for php5.5 * Add backslach to make class explict in global namespace - update to version v3.6.1: * PHP namespaces for nested messages and enums (#4536) * Allows the json marshaller to be passed json marshal options (#4252) * Make sure to delete temporary maps used by FileDescriptorTables * fix python cpp kokoro build * Change C# reflection to avoid using expression trees * Updated checked-in generated code * Removed unused variables in repeated_scalar_container.cc * Removed unused code pertaining to shared_ptr * Include no_package.proto in Python test * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262) * Convert descriptortype to type for upb_msgval_sizeof (#4357) * Removed duplicate using statement from ReflectionUtil.cs * Add support for power ppc64le * Cat the test-suite.log on errors for presubits * Address review comments * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword. * Delete javanano kokoro build configs. * Updated Ruby conformance test failure list * Removed use of some type traits * Adopt php_metadata_namespace in php code generator (#4622) * Move to Xcode 9.3 which also means a High Sierra image. * Add protoc release script for Linux build. * protoc-artifacts: Avoid storing temporary files and use fewer layers * Rewrite go_benchmark * Add files to build ruby artifact for mac on kokoro (#4814) * Remove javanano. * Comment out unused command from release script. * Avoid direct check of class name (#4601) * The JsonParseOptions::ignore_unknown_fields option behavior treats * Fix php memory leak test (#4692) * Fix benchmark build * Add VS2017 optional component dependency details to the C# readme (#4128) * Fix initialization with Visual Studio * For windows, all python version should use /MT (#4468) * use brew install instead of easy_install in OSX (#4537) * Sync upb change (#4373) * Always add -std=c++11 for mac (#4684) * Add kokoro build status badges. * Removed unrecognized option from no_package.proto * Fixed up proto3_lite_unittest.cc * Update Xcode settings * Cleanup LICENSE file. * Remove js_embed binary. (#4709) * Fixed JS parsing of unspecified map keys * Update version number to 3.6.0 * Deliberately call simple code to avoid Unity linker pruning * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources." * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1 * MinGW build failed * Support using MSVC intrinsics in Log2FloorNonZero * Fix array constructor in c extension for compatibility (#4667) * Add space between class name and concat message (#4577) * fix python * Add performance.md and add instruction for linking tcmalloc * Add script for run and upload the benchmark result to bq * Add test for failing write of raw pointer to output stream * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556) * Remove stray indent on normal imports. * Fix python ext build on kokoro (#4527) * Add compile test sources for to test include order. * Fixed a Visual Studio 2017 build error. (#4488) * fix linux kokoro build in docker * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350) * Updated Docker setup to use GCC 4.8 * Remove broken build status icons. * Run autogen.sh in release script. * Output *_pb2_grpc.py when use_grpc_plugin=True * Adopt ruby_package in ruby generated code. (#4627) * Cygwin build failed * Work around an "old runtime" issue with reflection * Added Kokoro protoc release build for OS X (#4770) * Updated change log for 3.6.1 release * Move methods out of class (#4697) * Fix to allow AOT compilers to play nicely with reflection * Update Makefile.am for Java lite files. * Added map_lite_test.proto to fix LiteTest * Introduce a compatiblity shim to support .NET 3.5 delegate creation * Revert "Removed mention of Buffer in byteSourceToUint8Array" * Add gogo benchmark * Set ext.no_native = true for non mac platform * Removed atomicops.h since it is no longer used * Rename a shadowed variable. * Add kokoro bazel configs for 3.6.x branch. * Deleted scoped_ptr.h * Check the message to be encoded is the wrong type. (#4885) (#4949) * protoc-artifacts: Avoid checking out protobuf code * Add conformance test for null value in list JSON * Build ruby gem on kokoro (#4819) * Try using a new version of Visual Studio on AppVeyor * Make ruby release configs consistent with protoc. * fix for API change in PHP 7.3 (#4898) * Add .proto files to extract_includes.bat * Update protoc build scripts. * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation. * Additional support for building and deploying ppcle_64 artifacts * Fix php tests * Cleanup + documentation for Java Lite runtime. * Added Kokoro Windows release build config for protoc (#4766) * typo * fix golang kokoro linux build * Fix spelling error of __GNUC_MINOR__ * Update code to work for Xcode 10b1 (#4729) * Added pyext/thread_unsafe_shared_ptr.h * Added missing .inc files to BUILD * js message support for jstype string on integers (#4332) * Improve error message when googletest is missing. * Make assertEquals pass for message (#4947) * Sync internal benchmark changes * Removed some unused C++ source files * Fix missing LIBPROTOC_EXPORT. * Added new test source files to Makefile.am * Update php version to 3.6.0 (#4736) * Fix RepeatedField#delete_if (#4292) * Merge branch (#4466) * Implement array constructor in php c extension. * protoc-artifacts: Update centos base from 6.6 to 6.9 * PHP array constructors for protobuf messages (#4530) * Fix problem: cmake build failed in c++11 by clang * Don't assume Windows builds use MSVC. * Use legacy name in php runtime (#4741) * Add file option php_metadata_namespace and ruby_package (#4609) * Fix cpp benchmark dependency on mac * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault * Check return value on write of raw pointer * Delete unused directories. * Replace //:protoc and similar default macro arguments with * Add extra C# file to Makefile.am * includes the expected class in the exception, otherwise the error is harder to track down (#3371) * Update instructions about getting protobuf source. * Add cpp tests under release docker image. * fix java benchmark, fix dashboard build * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang. * Rename build_artifacts.cfg to release.cfg (#4818) * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings * source code info for interpreted options; fix source code info for extension range options (#4342) * Updated version numbers to 3.6.1 * Trim imports for bundled generated protos. * Require C++11 and pass -std=c++11 * Remove the iOS Test App. * fix duplicate mkdir in update_file_lists.sh * Updated csharp/README.md to reflect testing changes * Fix bazel build of examples. * Add missing ruby/tests/test_ruby_package.proto * Fix cpp_distcheck * Updated the change log with changes for 3.6.0 * some fix * CMake: Update CXX Standard management * Add the files added in #4485. * Change to deal all messages in one loop * Fix php conformance test. * Add __init__.py files to compiler and util subpackages (#4117) * Updated .gitignore to exclude downloaded gmock/ directory * Fix error in Clang UndefinedBehaviorSanitizer * Work around MSVC issue with std::atomic initialization (#4777) * Updated conformance failure lists * Add back GeneratedClassName to public (#4686) * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829) * Throw error if user want to access message properties (#4603) * fix json_decode call parameters (#4381) * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources. * PHP: fixed typo in message.c * Add go benchmark * Allow list values to be null when parsing * Added instruction for existing ZLIB configuration * Fix 32bit php tests * Removed javanano from post_process_dist.sh * Don't generate imports for the WKTs unless generating the WKTs. * For encoding upb needs descriptor type instead of type. (#4354) * Include googletest as a submodule (#3993) * Write messages to backing field in generated C# cloning code (#4440) * Integrated internal changes from Google - Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied upstream. - bump soname version - Add maven pom files to the protobuf-java package - Add protobuf-source package - some programs using gRPC and protobuf need protobuf definitions which are included inside the source code, but are not included in the devel package. - Add upstream patch which fixes build with Bazel 0.22.0. * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch - Disable LTO (boo#1133277). - Update to new upstream release 3.8.0 * Introduced new MOMI (maybe-outside-memory-interval) parser. * Added use of C++ override keyword where appropriate. * Always declare enums to be int-sized. * Append '_' to C++ reserved keywords for message, enum, extension. - Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch (upstreamed) - Specify java source and target levels in order to build compatible protobuf-java binaries - Update to new upstream release 3.9.1 * Optimized the implementation of RepeatedPtrFieldBase. * Added delimited parse and serialize util. * Added FieldDescriptor::PrintableNameForExtension() and DescriptorPool::FindExtensionByPrintableName(). The latter will replace Reflection::FindKnownExtensionByName(). * Created a new Add method in repeated field that allows adding a range of elements all at once. * Drop building wheel for Python 3.4. - Package also the protobuf-bom pom file - Updated to version 3.9.2 (bsc#1162343) (Objective-C) * Remove OSReadLittle* due to alignment requirements. (#6678) * Don't use unions and instead use memcpy for the type swaps. (#6672) - Use tarball provided by upstream - Small package cleanup - Add missing dependency of python subpackages on python-six (bsc#1177127). - Fix Requires for python3 to python3-six. - Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570, bsc#1195258 * Add protobuf-CVE-2021-22570.patch - Fix potential Denial of Service in protobuf-java in the parsing procedure for binary data, CVE-2021-22569, bsc#1194530 * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch - Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941, bsc#1203681 * Add protobuf-CVE-2022-1941.patch - Fix a potential DoS issue when parsing with binary data in protobuf-java, CVE-2022-3171, bsc#1204256 * Add protobuf-CVE-2022-3171.patch - Refresh protobuf-CVE-2021-22570.patch - Backport changes from 3.16.x tree for apply recent CVE patches * Add protobuf-51026d922970e06475f005b39287963594134b96.patch * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch - Reorganize patch set ordering - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - Conditionalize python2 and python3 in order to be able to build without python2 present in distribution * Use singlespec macros to simplify the logic - Run fdupes on python modules to avoid duplicates - Remove shebangs from import-only code - Add adding-Release_CompareAndSwap-64-bit-variant.patch * Fix compile error undefined reference to `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)' on s390x https://github.com/google/protobuf/issues/3937 update to version v3.5.2: * Update release date * Disable pip cache when testing uploaded packages * Replace private timelib_update_ts with public date_timestamp_get * Remove py2.6 support. * Cherrypick for csharp, including: * Update changelog * Update changelog for 3.5.1 * Fix uploading binary wheel. * Fix memory leak when creating map field via array. * Update rake file to build of 2.1.6. * Avoid using php_date_get_date_ce() in case date extension is not * Update protoc-artfacts * Fix string::back() usage in googletest.cc * Fix memory leak in php7 * Support ruby2.5 * io_win32: support non-ASCII paths * Explicitly propagate the status of Flush(). * Add discard unknown API in ruby. (#3990) * Update version for 3.5.0.post1 * remove nullptr * Fix more memory leak for php c extension (#4211) * Bumping number to fix ruby 2.1 on mac * io_win32_unittest: remove incorrect error check * Fix memory leak when creating repeated field via array. * Update version number for php c extension (#3896) * Fix file permission for python package. * Create containing directory before generating well_known_types_embed.cc * Replace C++11 only method std::map::at * Recursively clear unknown fields in submessages. (#3982) * Update version number to 3.5.1 * io_win32_unittest: fix condition in GetCwdAsUtf8 * Add release log * io_win32_unittest: use CWD as last tempdir * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util * Add support for Windows ARM64 build * Add protobuf-all in post release * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886) * Add _file_desc_by_toplevel_extension back * Fix setup.py for windows build. * io_win32_unittest: make //:win32_test run again * Provide discardUnknonwnFields API in php (#3976) * Update php c extension version number to 3.5.0.1 * Fix ruby gc_test in ruby 2.4 (#4011) * Remove duplicate typedef. (#3975) * Accept DatetimeInterface in fromDatetime * io_win32: add more encoding-related tests * Bump version number to 3.5.2 * Bump protoc-artifact version for a patch rebuild * Call php method via function name instead of calling directly. * Well known types are not initialized properly. (#4139) * Use matching enum type for IsPOD. * Fix several more memory leak * Fix for php5.5 * Add backslach to make class explict in global namespace - update to version v3.6.1: * PHP namespaces for nested messages and enums (#4536) * Allows the json marshaller to be passed json marshal options (#4252) * Make sure to delete temporary maps used by FileDescriptorTables * fix python cpp kokoro build * Change C# reflection to avoid using expression trees * Updated checked-in generated code * Removed unused variables in repeated_scalar_container.cc * Removed unused code pertaining to shared_ptr * Include no_package.proto in Python test * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262) * Convert descriptortype to type for upb_msgval_sizeof (#4357) * Removed duplicate using statement from ReflectionUtil.cs * Add support for power ppc64le * Cat the test-suite.log on errors for presubits * Address review comments * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword. * Delete javanano kokoro build configs. * Updated Ruby conformance test failure list * Removed use of some type traits * Adopt php_metadata_namespace in php code generator (#4622) * Move to Xcode 9.3 which also means a High Sierra image. * Add protoc release script for Linux build. * protoc-artifacts: Avoid storing temporary files and use fewer layers * Rewrite go_benchmark * Add files to build ruby artifact for mac on kokoro (#4814) * Remove javanano. * Comment out unused command from release script. * Avoid direct check of class name (#4601) * The JsonParseOptions::ignore_unknown_fields option behavior treats * Fix php memory leak test (#4692) * Fix benchmark build * Add VS2017 optional component dependency details to the C# readme (#4128) * Fix initialization with Visual Studio * For windows, all python version should use /MT (#4468) * use brew install instead of easy_install in OSX (#4537) * Sync upb change (#4373) * Always add -std=c++11 for mac (#4684) * Add kokoro build status badges. * Removed unrecognized option from no_package.proto * Fixed up proto3_lite_unittest.cc * Update Xcode settings * Cleanup LICENSE file. * Remove js_embed binary. (#4709) * Fixed JS parsing of unspecified map keys * Update version number to 3.6.0 * Deliberately call simple code to avoid Unity linker pruning * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources." * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1 * MinGW build failed * Support using MSVC intrinsics in Log2FloorNonZero * Fix array constructor in c extension for compatibility (#4667) * Add space between class name and concat message (#4577) * fix python * Add performance.md and add instruction for linking tcmalloc * Add script for run and upload the benchmark result to bq * Add test for failing write of raw pointer to output stream * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556) * Remove stray indent on normal imports. * Fix python ext build on kokoro (#4527) * Add compile test sources for to test include order. * Fixed a Visual Studio 2017 build error. (#4488) * fix linux kokoro build in docker * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350) * Updated Docker setup to use GCC 4.8 * Remove broken build status icons. * Run autogen.sh in release script. * Output *_pb2_grpc.py when use_grpc_plugin=True * Adopt ruby_package in ruby generated code. (#4627) * Cygwin build failed * Work around an "old runtime" issue with reflection * Added Kokoro protoc release build for OS X (#4770) * Updated change log for 3.6.1 release * Move methods out of class (#4697) * Fix to allow AOT compilers to play nicely with reflection * Update Makefile.am for Java lite files. * Added map_lite_test.proto to fix LiteTest * Introduce a compatiblity shim to support .NET 3.5 delegate creation * Revert "Removed mention of Buffer in byteSourceToUint8Array" * Add gogo benchmark * Set ext.no_native = true for non mac platform * Removed atomicops.h since it is no longer used * Rename a shadowed variable. * Add kokoro bazel configs for 3.6.x branch. * Deleted scoped_ptr.h * Check the message to be encoded is the wrong type. (#4885) (#4949) * protoc-artifacts: Avoid checking out protobuf code * Add conformance test for null value in list JSON * Build ruby gem on kokoro (#4819) * Try using a new version of Visual Studio on AppVeyor * Make ruby release configs consistent with protoc. * fix for API change in PHP 7.3 (#4898) * Add .proto files to extract_includes.bat * Update protoc build scripts. * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation. * Additional support for building and deploying ppcle_64 artifacts * Fix php tests * Cleanup + documentation for Java Lite runtime. * Added Kokoro Windows release build config for protoc (#4766) * typo * fix golang kokoro linux build * Fix spelling error of __GNUC_MINOR__ * Update code to work for Xcode 10b1 (#4729) * Added pyext/thread_unsafe_shared_ptr.h * Added missing .inc files to BUILD * js message support for jstype string on integers (#4332) * Improve error message when googletest is missing. * Make assertEquals pass for message (#4947) * Sync internal benchmark changes * Removed some unused C++ source files * Fix missing LIBPROTOC_EXPORT. * Added new test source files to Makefile.am * Update php version to 3.6.0 (#4736) * Fix RepeatedField#delete_if (#4292) * Merge branch (#4466) * Implement array constructor in php c extension. * protoc-artifacts: Update centos base from 6.6 to 6.9 * PHP array constructors for protobuf messages (#4530) * Fix problem: cmake build failed in c++11 by clang * Don't assume Windows builds use MSVC. * Use legacy name in php runtime (#4741) * Add file option php_metadata_namespace and ruby_package (#4609) * Fix cpp benchmark dependency on mac * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault * Check return value on write of raw pointer * Delete unused directories. * Replace //:protoc and similar default macro arguments with * Add extra C# file to Makefile.am * includes the expected class in the exception, otherwise the error is harder to track down (#3371) * Update instructions about getting protobuf source. * Add cpp tests under release docker image. * fix java benchmark, fix dashboard build * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang. * Rename build_artifacts.cfg to release.cfg (#4818) * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings * source code info for interpreted options; fix source code info for extension range options (#4342) * Updated version numbers to 3.6.1 * Trim imports for bundled generated protos. * Require C++11 and pass -std=c++11 * Remove the iOS Test App. * fix duplicate mkdir in update_file_lists.sh * Updated csharp/README.md to reflect testing changes * Fix bazel build of examples. * Add missing ruby/tests/test_ruby_package.proto * Fix cpp_distcheck * Updated the change log with changes for 3.6.0 * some fix * CMake: Update CXX Standard management * Add the files added in #4485. * Change to deal all messages in one loop * Fix php conformance test. * Add __init__.py files to compiler and util subpackages (#4117) * Updated .gitignore to exclude downloaded gmock/ directory * Fix error in Clang UndefinedBehaviorSanitizer * Work around MSVC issue with std::atomic initialization (#4777) * Updated conformance failure lists * Add back GeneratedClassName to public (#4686) * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829) * Throw error if user want to access message properties (#4603) * fix json_decode call parameters (#4381) * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources. * PHP: fixed typo in message.c * Add go benchmark * Allow list values to be null when parsing * Added instruction for existing ZLIB configuration * Fix 32bit php tests * Removed javanano from post_process_dist.sh * Don't generate imports for the WKTs unless generating the WKTs. * For encoding upb needs descriptor type instead of type. (#4354) * Include googletest as a submodule (#3993) * Write messages to backing field in generated C# cloning code (#4440) * Integrated internal changes from Google - Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied upstream. - bump soname version - Add maven pom files to the protobuf-java package - Add protobuf-source package - some programs using gRPC and protobuf need protobuf definitions which are included inside the source code, but are not included in the devel package. - Add upstream patch which fixes build with Bazel 0.22.0. * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch - Disable LTO (boo#1133277). - Update to new upstream release 3.8.0 * Introduced new MOMI (maybe-outside-memory-interval) parser. * Added use of C++ override keyword where appropriate. * Always declare enums to be int-sized. * Append '_' to C++ reserved keywords for message, enum, extension. - Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch (upstreamed) - Specify java source and target levels in order to build compatible protobuf-java binaries - Update to new upstream release 3.9.1 * Optimized the implementation of RepeatedPtrFieldBase. * Added delimited parse and serialize util. * Added FieldDescriptor::PrintableNameForExtension() and DescriptorPool::FindExtensionByPrintableName(). The latter will replace Reflection::FindKnownExtensionByName(). * Created a new Add method in repeated field that allows adding a range of elements all at once. * Drop building wheel for Python 3.4. - Package also the protobuf-bom pom file - Updated to version 3.9.2 (bsc#1162343) (Objective-C) * Remove OSReadLittle* due to alignment requirements. (#6678) * Don't use unions and instead use memcpy for the type swaps. (#6672) - Use tarball provided by upstream - Small package cleanup - Add missing dependency of python subpackages on python-six (bsc#1177127). - Fix Requires for python3 to python3-six. - Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570, bsc#1195258 * Add protobuf-CVE-2021-22570.patch - Fix potential Denial of Service in protobuf-java in the parsing procedure for binary data, CVE-2021-22569, bsc#1194530 * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch - Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941, bsc#1203681 * Add protobuf-CVE-2022-1941.patch - Fix a potential DoS issue when parsing with binary data in protobuf-java, CVE-2022-3171, bsc#1204256 * Add protobuf-CVE-2022-3171.patch - Refresh protobuf-CVE-2021-22570.patch - Backport changes from 3.16.x tree for apply recent CVE patches * Add protobuf-51026d922970e06475f005b39287963594134b96.patch * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch - Reorganize patch set ordering - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - Conditionalize python2 and python3 in order to be able to build without python2 present in distribution * Use singlespec macros to simplify the logic - Run fdupes on python modules to avoid duplicates - Remove shebangs from import-only code - Add adding-Release_CompareAndSwap-64-bit-variant.patch * Fix compile error undefined reference to `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)' on s390x https://github.com/google/protobuf/issues/3937 update to version v3.5.2: * Update release date * Disable pip cache when testing uploaded packages * Replace private timelib_update_ts with public date_timestamp_get * Remove py2.6 support. * Cherrypick for csharp, including: * Update changelog * Update changelog for 3.5.1 * Fix uploading binary wheel. * Fix memory leak when creating map field via array. * Update rake file to build of 2.1.6. * Avoid using php_date_get_date_ce() in case date extension is not * Update protoc-artfacts * Fix string::back() usage in googletest.cc * Fix memory leak in php7 * Support ruby2.5 * io_win32: support non-ASCII paths * Explicitly propagate the status of Flush(). * Add discard unknown API in ruby. (#3990) * Update version for 3.5.0.post1 * remove nullptr * Fix more memory leak for php c extension (#4211) * Bumping number to fix ruby 2.1 on mac * io_win32_unittest: remove incorrect error check * Fix memory leak when creating repeated field via array. * Update version number for php c extension (#3896) * Fix file permission for python package. * Create containing directory before generating well_known_types_embed.cc * Replace C++11 only method std::map::at * Recursively clear unknown fields in submessages. (#3982) * Update version number to 3.5.1 * io_win32_unittest: fix condition in GetCwdAsUtf8 * Add release log * io_win32_unittest: use CWD as last tempdir * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util * Add support for Windows ARM64 build * Add protobuf-all in post release * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886) * Add _file_desc_by_toplevel_extension back * Fix setup.py for windows build. * io_win32_unittest: make //:win32_test run again * Provide discardUnknonwnFields API in php (#3976) * Update php c extension version number to 3.5.0.1 * Fix ruby gc_test in ruby 2.4 (#4011) * Remove duplicate typedef. (#3975) * Accept DatetimeInterface in fromDatetime * io_win32: add more encoding-related tests * Bump version number to 3.5.2 * Bump protoc-artifact version for a patch rebuild * Call php method via function name instead of calling directly. * Well known types are not initialized properly. (#4139) * Use matching enum type for IsPOD. * Fix several more memory leak * Fix for php5.5 * Add backslach to make class explict in global namespace - update to version v3.6.1: * PHP namespaces for nested messages and enums (#4536) * Allows the json marshaller to be passed json marshal options (#4252) * Make sure to delete temporary maps used by FileDescriptorTables * fix python cpp kokoro build * Change C# reflection to avoid using expression trees * Updated checked-in generated code * Removed unused variables in repeated_scalar_container.cc * Removed unused code pertaining to shared_ptr * Include no_package.proto in Python test * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262) * Convert descriptortype to type for upb_msgval_sizeof (#4357) * Removed duplicate using statement from ReflectionUtil.cs * Add support for power ppc64le * Cat the test-suite.log on errors for presubits * Address review comments * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword. * Delete javanano kokoro build configs. * Updated Ruby conformance test failure list * Removed use of some type traits * Adopt php_metadata_namespace in php code generator (#4622) * Move to Xcode 9.3 which also means a High Sierra image. * Add protoc release script for Linux build. * protoc-artifacts: Avoid storing temporary files and use fewer layers * Rewrite go_benchmark * Add files to build ruby artifact for mac on kokoro (#4814) * Remove javanano. * Comment out unused command from release script. * Avoid direct check of class name (#4601) * The JsonParseOptions::ignore_unknown_fields option behavior treats * Fix php memory leak test (#4692) * Fix benchmark build * Add VS2017 optional component dependency details to the C# readme (#4128) * Fix initialization with Visual Studio * For windows, all python version should use /MT (#4468) * use brew install instead of easy_install in OSX (#4537) * Sync upb change (#4373) * Always add -std=c++11 for mac (#4684) * Add kokoro build status badges. * Removed unrecognized option from no_package.proto * Fixed up proto3_lite_unittest.cc * Update Xcode settings * Cleanup LICENSE file. * Remove js_embed binary. (#4709) * Fixed JS parsing of unspecified map keys * Update version number to 3.6.0 * Deliberately call simple code to avoid Unity linker pruning * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources." * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1 * MinGW build failed * Support using MSVC intrinsics in Log2FloorNonZero * Fix array constructor in c extension for compatibility (#4667) * Add space between class name and concat message (#4577) * fix python * Add performance.md and add instruction for linking tcmalloc * Add script for run and upload the benchmark result to bq * Add test for failing write of raw pointer to output stream * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556) * Remove stray indent on normal imports. * Fix python ext build on kokoro (#4527) * Add compile test sources for to test include order. * Fixed a Visual Studio 2017 build error. (#4488) * fix linux kokoro build in docker * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350) * Updated Docker setup to use GCC 4.8 * Remove broken build status icons. * Run autogen.sh in release script. * Output *_pb2_grpc.py when use_grpc_plugin=True * Adopt ruby_package in ruby generated code. (#4627) * Cygwin build failed * Work around an "old runtime" issue with reflection * Added Kokoro protoc release build for OS X (#4770) * Updated change log for 3.6.1 release * Move methods out of class (#4697) * Fix to allow AOT compilers to play nicely with reflection * Update Makefile.am for Java lite files. * Added map_lite_test.proto to fix LiteTest * Introduce a compatiblity shim to support .NET 3.5 delegate creation * Revert "Removed mention of Buffer in byteSourceToUint8Array" * Add gogo benchmark * Set ext.no_native = true for non mac platform * Removed atomicops.h since it is no longer used * Rename a shadowed variable. * Add kokoro bazel configs for 3.6.x branch. * Deleted scoped_ptr.h * Check the message to be encoded is the wrong type. (#4885) (#4949) * protoc-artifacts: Avoid checking out protobuf code * Add conformance test for null value in list JSON * Build ruby gem on kokoro (#4819) * Try using a new version of Visual Studio on AppVeyor * Make ruby release configs consistent with protoc. * fix for API change in PHP 7.3 (#4898) * Add .proto files to extract_includes.bat * Update protoc build scripts. * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation. * Additional support for building and deploying ppcle_64 artifacts * Fix php tests * Cleanup + documentation for Java Lite runtime. * Added Kokoro Windows release build config for protoc (#4766) * typo * fix golang kokoro linux build * Fix spelling error of __GNUC_MINOR__ * Update code to work for Xcode 10b1 (#4729) * Added pyext/thread_unsafe_shared_ptr.h * Added missing .inc files to BUILD * js message support for jstype string on integers (#4332) * Improve error message when googletest is missing. * Make assertEquals pass for message (#4947) * Sync internal benchmark changes * Removed some unused C++ source files * Fix missing LIBPROTOC_EXPORT. * Added new test source files to Makefile.am * Update php version to 3.6.0 (#4736) * Fix RepeatedField#delete_if (#4292) * Merge branch (#4466) * Implement array constructor in php c extension. * protoc-artifacts: Update centos base from 6.6 to 6.9 * PHP array constructors for protobuf messages (#4530) * Fix problem: cmake build failed in c++11 by clang * Don't assume Windows builds use MSVC. * Use legacy name in php runtime (#4741) * Add file option php_metadata_namespace and ruby_package (#4609) * Fix cpp benchmark dependency on mac * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault * Check return value on write of raw pointer * Delete unused directories. * Replace //:protoc and similar default macro arguments with * Add extra C# file to Makefile.am * includes the expected class in the exception, otherwise the error is harder to track down (#3371) * Update instructions about getting protobuf source. * Add cpp tests under release docker image. * fix java benchmark, fix dashboard build * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang. * Rename build_artifacts.cfg to release.cfg (#4818) * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings * source code info for interpreted options; fix source code info for extension range options (#4342) * Updated version numbers to 3.6.1 * Trim imports for bundled generated protos. * Require C++11 and pass -std=c++11 * Remove the iOS Test App. * fix duplicate mkdir in update_file_lists.sh * Updated csharp/README.md to reflect testing changes * Fix bazel build of examples. * Add missing ruby/tests/test_ruby_package.proto * Fix cpp_distcheck * Updated the change log with changes for 3.6.0 * some fix * CMake: Update CXX Standard management * Add the files added in #4485. * Change to deal all messages in one loop * Fix php conformance test. * Add __init__.py files to compiler and util subpackages (#4117) * Updated .gitignore to exclude downloaded gmock/ directory * Fix error in Clang UndefinedBehaviorSanitizer * Work around MSVC issue with std::atomic initialization (#4777) * Updated conformance failure lists * Add back GeneratedClassName to public (#4686) * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829) * Throw error if user want to access message properties (#4603) * fix json_decode call parameters (#4381) * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources. * PHP: fixed typo in message.c * Add go benchmark * Allow list values to be null when parsing * Added instruction for existing ZLIB configuration * Fix 32bit php tests * Removed javanano from post_process_dist.sh * Don't generate imports for the WKTs unless generating the WKTs. * For encoding upb needs descriptor type instead of type. (#4354) * Include googletest as a submodule (#3993) * Write messages to backing field in generated C# cloning code (#4440) * Integrated internal changes from Google - Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied upstream. - bump soname version - Add maven pom files to the protobuf-java package - Add protobuf-source package - some programs using gRPC and protobuf need protobuf definitions which are included inside the source code, but are not included in the devel package. - Add upstream patch which fixes build with Bazel 0.22.0. * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch - Disable LTO (boo#1133277). - Update to new upstream release 3.8.0 * Introduced new MOMI (maybe-outside-memory-interval) parser. * Added use of C++ override keyword where appropriate. * Always declare enums to be int-sized. * Append '_' to C++ reserved keywords for message, enum, extension. - Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch (upstreamed) - Specify java source and target levels in order to build compatible protobuf-java binaries - Update to new upstream release 3.9.1 * Optimized the implementation of RepeatedPtrFieldBase. * Added delimited parse and serialize util. * Added FieldDescriptor::PrintableNameForExtension() and DescriptorPool::FindExtensionByPrintableName(). The latter will replace Reflection::FindKnownExtensionByName(). * Created a new Add method in repeated field that allows adding a range of elements all at once. * Drop building wheel for Python 3.4. - Package also the protobuf-bom pom file - Updated to version 3.9.2 (bsc#1162343) (Objective-C) * Remove OSReadLittle* due to alignment requirements. (#6678) * Don't use unions and instead use memcpy for the type swaps. (#6672) - Use tarball provided by upstream - Small package cleanup - Add missing dependency of python subpackages on python-six (bsc#1177127). - Fix Requires for python3 to python3-six. - Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570, bsc#1195258 * Add protobuf-CVE-2021-22570.patch - Fix potential Denial of Service in protobuf-java in the parsing procedure for binary data, CVE-2021-22569, bsc#1194530 * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch - Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941, bsc#1203681 * Add protobuf-CVE-2022-1941.patch - Fix a potential DoS issue when parsing with binary data in protobuf-java, CVE-2022-3171, bsc#1204256 * Add protobuf-CVE-2022-3171.patch - Refresh protobuf-CVE-2021-22570.patch - Backport changes from 3.16.x tree for apply recent CVE patches * Add protobuf-51026d922970e06475f005b39287963594134b96.patch * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch - Reorganize patch set ordering - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Update to 16.2.7-640-gceb23c7491b + (bsc#1194875) common: fix FTBFS due to dout & need_dynamic on GCC-12 + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade - Update to 16.2.7-650-gd083eaa3886 + (pr#469) cephadm: update image paths to registry.suse.com + (pr#468) cephadm: use snmp-notifier image from registry.suse.de + (pr#467) cephadm: infer the default container image during pull + (pr#465) mgr/cephadm: try to get FQDN for inventory address + Sync _constaints file for IBS and OBS - Update to v16.2.7-652-gf5dc462fdb5 + (bsc#1194875) [SES7P] include/buffer: include <memory> - Update to v16.2.7-654-gd5a90ff46f0 + (bsc#1196733) remove build directory during %clean - Update to 16.2.7-969-g6195a460d89 + (jsc#SES-2515) High-availability NFS export - Update to 16.2.9.50-g7d9f12156fb: + (jsc#SES-2515) High-availability NFS export + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit + (bsc#1187748) When an RBD is mapped, it is attempted to be deployed as an OSD. - Update to ceph-16.2.9-58-ge2e5cb80063: + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths - Update to 16.2.9-158-gd93952c7eea: + cmake: check for python(\d)\.(\d+) when building boost + make-dist: patch boost source to support python 3.10 - Update to 16.2.9-536-g41a9f9a5573: + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979) + (bsc#1196046) mgr/cephadm: try to get FQDN for configuration files - Update to 16.2.9-538-g9de83fa4064: + (bsc#1201604) cephfs-shell: move source to separate subdirectory - Update to 16.2.9-539-gea74dd900cd: + (bsc#1202292) ceph.spec.in: Add -DFMT_DEPRECATED_OSTREAM to CXXFLAGS - Update to 16.2.11-56-gc067055f8f5: + (bsc#1199183) osd, tools, kv: non-aggressive, on-line trimming of accumulated dups + (bsc#1200262) ceph-volume: fix fast device alloc size on mulitple device + (bsc#1200501) cephadm: update monitoring container images + (bsc#1200978) mgr/dashboard: prevent alert redirect + (bsc#1201797) mgr/volumes: Add subvolumegroup resize cmd + (bsc#1201837) mgr/volumes: Fix subvolume discover during upgrade (CVE-2022-0670) + (bsc#1201976) monitoring/ceph-mixin: add RGW host to label info + (bsc#1202077) mgr/dashboard: enable addition of custom Prometheus alerts + (bsc#1203375) python-common: Add 'KB' to supported suffixes in SizeMatcher + (bsc#1204430) ceph-crash: drop privleges to run as "ceph" user, rather than root (CVE-2022-3650) + (bsc#1205025) rgw: Guard against malformed bucket URLs (CVE-2022-3854) + (bsc#1205436) mgr/dashboard: fix rgw connect when using ssl - Update to 16.2.11-57-g9be7fb44a33: + ceph.spec.in: Replace %usrmerged macro with regular version check - checkin.sh: default to ses7p branch - Update to 16.2.11-58-g38d6afd3b78: + test/CMakeLists.txt: move 'APPEND rgw_libs Boost::filesystem' to top level - Update to 16.2.11-62-gce6291a3463: + (bsc#1201088) fix FTBFS on gcc 13 - Update to 16.2.11-65-g8b7e6fc0182: + (bsc#1201088) test/librados: fix FTBFS on gcc 13 + (bsc#1208820) mgr/dashboard: allow to pass controls on iscsi disk create - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 16.2.13-66-g54799ee0666: + (bsc#1199880) mgr: don't dump global config holding gil + (bsc#1209621) cephadm: fix NFS haproxy failover if active node disappears + (bsc#1210153) mgr/cephadm: fix handling of mgr upgrades with 3 or more mgrs + (bsc#1210243, bsc#1210314) ceph-volume: fix regression in activate + (bsc#1210719) cephadm: mount host /etc/hosts for daemon containers in podman deployments + (bsc#1210784) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' + (bsc#1210944) cmake: patch boost source to support python 3.11 + (bsc#1211090) fix FTBFS on s390x - Add "#!BuildConstraint" to spec files for compatibility with _multibuild - Remove _constraints file, add README-constraints.txt and pre_checkin.env - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Add patches 13-18 to bash-4.4-patches.tar.bz2 * 13: If a here-document contains a command substitution, the command substitution can get access to the file descriptor used to write the here-document. * 14: Under some circumstances, functions that return via the `return' builtin do not clean up memory they allocated to keep track of FIFOs. * 15: Process substitution can leak internal quoting to the parser in the invoked subshell. * 16: Bash can perform trap processing while reading command substitution output instead of waiting until the command completes. * 17: There is a memory leak when `read -e' is used to read a line using readline. * 18: Under certain circumstances (e.g., reading from /dev/zero), read(2) will not return -1 even when interrupted by a signal. The read builtin needs to check for signals in this case. - partial cleanup with spec-cleaner - Add patch 19 to bash-4.4-patches.tar.bz2 * With certain values for PS1, especially those that wrap onto three or more lines, readline will miscalculate the number of invisible characters, leading to crashes and core dumps. - Use %license (boo#1082318) - Create readline-devel-static package to re-enable static libraries again (boo#1082913) - Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247 that is repeating self inserting trap due external command in the trap. - Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2 * 20: In circumstances involving long-running scripts that create and reap many processes, it is possible for the hash table bash uses to store exit statuses from asynchronous processes to develop loops. This patch fixes the loop causes and adds code to detect any future loops. * 21: A SIGINT received inside a SIGINT trap handler can possibly cause the shell to loop. * 22: There are cases where a failing readline command (e.g., delete-char at the end of a line) can cause a multi-character key sequence to `back up' and attempt to re-read some of the characters in the sequence. * 23: When sourcing a file from an interactive shell, setting the SIGINT handler to the default and typing ^C will cause the shell to exit. - remove bash-4.4-wait-sigint-handler.patch (upstreamed) - In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670) - Add patch readline-7.0-screen.patch to be able to parse settings in inputrc for all screen TERM variables starting with "screen." to fix boo#1095661 - Add bash-memmove.patch to make bash.html build reproducible (boo#1100488) - Rework patch readline-7.0-screen.patch - Add patch bash-4.4-bgpoverflow.patch which is a backport from bash 5.0 to perform better with large numbers of sub processes (bsc#1133773) - Rework patch readline-7.0-screen.patch again for bug boo#1143055 * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm" - Move /bin/bash to /usr/bin/bash and provide old location as symbolic link of new location (jsc#SLE-15652) - Remove minimal sh build option as not used - Add patch bsc1183064.patch * Fix bug bsc#1183064: Segfault from reading a history file not starting with # with HISTTIMEFORMAT set and history_multiline_entries nonzero and with the history cleared and read on the same input line. - Add patch bash-4.4-jobctrl.patch to allow process group asignment even for modern kernels (bsc#1057452, bsc#1188287) - Post update-alternatives approach back from factory for /bin/sh (SLE-19670) - Using package bash-sh instead of the update-alternative mechanism. - Port bash-sh package approach back to SLE-15-SP4 (jsc#SLE-18234) - Do use old legacy PreReq to get bash installed before bash-sh but do not require bash-sh by bash (bsc#1197448) - Add patch boo1227807.patch * Load completion file eveh if a brace expansion is in the command line included (boo#1227807) - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - Now that gcc 5.2 is available on TW, remove the ARMv7 workaround. - Update to 1.0.6 * Optimized implementations of Blake2 have been added for modern Intel platforms. crypto_generichash() is now faster than MD5 and SHA1 implementations while being far more secure. * The crypto_sign_edwards25519sha512batch_*() functions have been tagged as deprecated. * sodium_compare() now works as documented, and compares numbers in little-endian format instead of behaving like memcmp(). * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have been added. - Follow upstream's lead and compile with -flto for > 13.2 on x86 and x86-64. - Update to version 1.0.7 * Sandy2x, the fastest Curve25519 implementation ever, has been merged in, and is automatically used on CPUs supporting the AVX instructions set. * An SSE2 optimized implementation of Poly1305 was added, and is twice as fast as the portable one. * An SSSE3 optimized implementation of ChaCha20 was added, and is twice as fast as the portable one. * Faster sodium_increment() for common nonce sizes. * New helper functions have been added: sodium_is_zero() and sodium_add(). - Update to version 1.0.8 * Handle the case where the CPU supports AVX, but we are running on an hypervisor with AVX disabled/not supported. * Faster (2x) scalarmult_base() when using the ref10 implementation. - Update to version 1.0.9 * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM implementations. * The Argon2i password hashing function was added, and is accessible directly and through a new, high-level crypto_pwhash API. The scrypt function remains available as well. * A speed-record AVX2 implementation of BLAKE2b was added. * Countermeasures for Ed25519 signatures malleability have been added to match the irtf-cfrg-eddsa draft. * The HChaCha20 core function was implemented (crypto_core_hchacha20()). * No-op stubs were added for all AES256-GCM public functions even when compiled on non-Intel platforms. * crypt_generichash_blake2b_statebytes() was added. * New macros were added for the IETF variant of the ChaCha20-Poly1305 construction. - Update to version 1.0.10 * Compile fix update for older GCCs - update version 1.0.11 * sodium_init() is now thread-safe, and can be safely called multiple times. * Better support for old gcc versions. * AVX2 detection was fixed, resulting in faster BLAKE2b hashing on platforms where it was not properly detected. * The Sandy2x Curve25519 implementation was not as fast as expected on some platforms. This has been fixed. * The NativeClient target was improved. Most notably, it now supports optimized implementations, and uses pepper_49 by default. * The library can be compiled with recent Emscripten versions. Changes have been made to produce smaller code, and the default heap size was reduced in the standard version. * Decryption functions can now accept a NULL pointer for the output. This checks the MAC without writing the decrypted message. * crypto_generichash_final() now returns -1 if called twice. - Update to version 1.0.12 * Ed25519ph was implemented, adding a multi-part signature API (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()). * New constants and related accessors have been added for Scrypt and Argon2. * XChaCha20 has been implemented. Like XSalsa20, this construction extends the ChaCha20 cipher to accept a 192-bit nonce. This makes it safe to use ChaCha20 with random nonces. * crypto_secretbox, crypto_box and crypto_aead now offer variants leveraging XChaCha20. * SHA-2 is about 20% faster, which also gives a speed boost to signature and signature verification. * AVX2 implementations of Salsa20 and ChaCha20 have been added. They are twice as fast as the SSE2 implementations. The speed gain is even more significant on Windows, that previously didn't use vectorized implementations. * New high-level API: crypto_kdf, to easily derive one or more subkeys from a master key. * Siphash with a 128-bit output has been implemented, and is available as crypto_shorthash_siphashx_*. * New *_keygen() helpers functions have been added to create secret keys for all constructions. This improves code clarity and can prevent keys from being partially initialized. * A new randombytes_buf_deterministic() function was added to deterministically fill a memory region with pseudorandom data. This function can especially be useful to write reproducible tests. * A preliminary crypto_kx_*() API was added to compute shared session keys. * AVX2 detection is more reliable. - Update to version 1.0.14 * Internal consistency checks failing and primitives used with dangerous/out-of-bounds/invalid parameters used to call abort(3). Now, a custom handler that doesn't return can be set with the set_sodium_misuse() function. It still aborts by default or if the handler ever returns. This is not a replacement for non-fatal, expected runtime errors. This handler will be only called in unexpected situations due to potential bugs in the library or in language bindings. * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max() symbols) have been added to represent the maximum message size that can be safely handled by a primitive. Language bindings are encouraged to check user inputs against these maximum lengths. * The test suite has been extended to cover more edge cases. * crypto_sign_ed25519_pk_to_curve25519() now rejects points that are not on the curve, or not in the main subgroup. * Further changes have been made to ensure that smart compilers will not optimize out code that we don't want to be optimized. * The sodium_runtime_has_* symbols for CPU features detection are now defined as weak symbols, i.e. they can be replaced with an application-defined implementation. This can be useful to disable AVX* when temperature/power consumption is a concern. * crypto_kx_*() now aborts if called with no non-NULL pointers to store keys to. * SSE2 implementations of crypto_verify_*() have been added. * Passwords can be hashed using a specific algorithm with the new crypto_pwhash_str_alg() function. * Due to popular demand, base64 encoding (sodium_bin2base64()) and decoding (sodium_base642bin()) have been implemented. * A new crypto_secretstream_*() API was added to safely encrypt files and multi-part messages. * The sodium_pad() and sodium_unpad() helper functions have been added in order to add & remove padding. * An AVX512 optimized implementation of Argon2 has been added. * The crypto_pwhash_str_needs_rehash() function was added to check if a password hash string matches the given parameters, or if it needs an update. Updates from 1.0.13 * An AVX2 optimized implementation of the Argon2 round function was added. * The Argon2id variant of Argon2 has been implemented. The high-level crypto_pwhash_str_verify() function automatically detects the algorithm and can verify both Argon2i and Argon2id hashed passwords. The default algorithm for newly hashed passwords remains Argon2i in this version to avoid breaking compatibility with verifiers running libsodium <= 1.0.12. * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented. - Refresh spec-file. - Update to 1.0.15. * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15 * The default password hashing algorithm is now Argon2id. * The pwhash_str_verify() function can still verify Argon2i hashes without any changes, and pwhash() can still compute Argon2i hashes as well. * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated, and didn't seem to be used by any opensource project. * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1 as defined by the OPSLIMIT_MIN constant. This has been fixed. * The secretstream construction was slightly changed to be consistent with forthcoming variants. * The Javascript and Webassembly versions have been merged, and the module now returns a .ready promise that will resolve after the Webassembly code is loaded and compiled. * Note that due to these incompatible changes, the library version major was bumped up. - Update to 1.0.16 * Signatures computations and verifications are now way faster on 64-bit platforms with compilers supporting 128-bit arithmetic (gcc, clang, icc). This includes the WebAssembly target. * New low-level APIs for computations over edwards25519: crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(), crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(), crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform() (elligator representative to point). * crypto_sign_open(), crypto_sign_verify_detached() and crypto_sign_edwards25519sha512batch_open` now reject public keys in non-canonical form in addition to low-order points. * The library can be built with ED25519_NONDETERMINISTIC defined in order to use synthetic nonces for EdDSA. This is disabled by default. * sodium_stackzero() was added to wipe content off the stack. * The Salsa20-based PRNG example is now thread-safe on platforms with support for thread-local storage, optionally mixes bits from RDRAND. * Argon2 and scrypt are slightly faster on Linux. - Enable verbose make output when building tests - Add gpg signature - Modernise spec file with spec-cleaner - Add baselibs.conf: build libsodium23-32bit, which is required by zeromq's -32bit packages. - Update to 1.0.17 - Bug fix: sodium_pad() didn't properly support block sizes >= 256 bytes. - JS/WebAssembly: some old iOS versions can't instantiate the WebAssembly module; fall back to Javascript on these. - JS/WebAssembly: compatibility with newer Emscripten versions. - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't returnEINVAL` on input strings with a short length, unlike their high-level counterpart. - Added a workaround for Visual Studio 2010 bug causing CPU features not to be detected. - Portability improvements. - Test vectors from Project Wycheproof have been added. - New low-level APIs for arithmetic mod the order of the prime order group: - crypto_core_ed25519_scalar_random(), crypto_core_ed25519_scalar_reduce(), - crypto_core_ed25519_scalar_invert(), crypto_core_ed25519_scalar_negate(), - crypto_core_ed25519_scalar_complement(), crypto_core_ed25519_scalar_add() and crypto_core_ed25519_scalar_sub(). - New low-level APIs for scalar multiplication without clamping: crypto_scalarmult_ed25519_base_noclamp() and crypto_scalarmult_ed25519_noclamp(). These new APIs are especially useful for blinding. - sodium_sub() has been implemented. - Support for WatchOS has been added. - getrandom(2) is now used on FreeBSD 12+. - The nonnull attribute has been added to all relevant prototypes. - More reliable AVX512 detection. - Javascript/Webassembly builds now use dynamic memory growth. - Update to 1.0.18 - Enterprise versions of Visual Studio are now supported. - Visual Studio 2019 is now supported. - 32-bit binaries for Visual Studio 2010 are now provided. - A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been removed in order to fix Ansible builds. - Emscripten: print and printErr functions are overridden to send errors to the console, if there is one. - Emscripten: UTF8ToString() is now exported since Pointer_stringify() has been deprecated. - Libsodium version detection has been fixed in the CMake recipe. - Generic hashing got a 10% speedup on AVX2. - New target: WebAssembly/WASI (compile with dist-builds/wasm32-wasi.sh). - New functions to map a hash to an edwards25519 point or get a random point: core_ed25519_from_hash() and core_ed25519_random(). - crypto_core_ed25519_scalar_mul() has been implemented for scalar*scalar (mod L) multiplication. - Support for the Ristretto group has been implemented for interoperability with wasm-crypto. - Improvements have been made to the test suite. - Portability improvements have been made. - getentropy() is now used on systems providing this system call. - randombytes_salsa20 has been renamed to randombytes_internal. - Support for NativeClient has been removed. - Most ((nonnull)) attributes have been relaxed to allow 0-length inputs to be NULL. - The -ftree-vectorize and -ftree-slp-vectorize compiler switches are now used, if available, for optimized builds. - Add libsodium_configure_cpuid_chg.patch and call autoconf to regenerate configure script with proper CPUID checking. Required at least for PowerPC and ARM now that LTO enabled. - Revert previous change about cpuid as previous change rejected in https://build.opensuse.org/request/show/724809 - Disable LTO as bypass boo#1148184 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Now that gcc 5.2 is available on TW, remove the ARMv7 workaround. - Update to 1.0.6 * Optimized implementations of Blake2 have been added for modern Intel platforms. crypto_generichash() is now faster than MD5 and SHA1 implementations while being far more secure. * The crypto_sign_edwards25519sha512batch_*() functions have been tagged as deprecated. * sodium_compare() now works as documented, and compares numbers in little-endian format instead of behaving like memcmp(). * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have been added. - Follow upstream's lead and compile with -flto for > 13.2 on x86 and x86-64. - Update to version 1.0.7 * Sandy2x, the fastest Curve25519 implementation ever, has been merged in, and is automatically used on CPUs supporting the AVX instructions set. * An SSE2 optimized implementation of Poly1305 was added, and is twice as fast as the portable one. * An SSSE3 optimized implementation of ChaCha20 was added, and is twice as fast as the portable one. * Faster sodium_increment() for common nonce sizes. * New helper functions have been added: sodium_is_zero() and sodium_add(). - Update to version 1.0.8 * Handle the case where the CPU supports AVX, but we are running on an hypervisor with AVX disabled/not supported. * Faster (2x) scalarmult_base() when using the ref10 implementation. - Update to version 1.0.9 * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM implementations. * The Argon2i password hashing function was added, and is accessible directly and through a new, high-level crypto_pwhash API. The scrypt function remains available as well. * A speed-record AVX2 implementation of BLAKE2b was added. * Countermeasures for Ed25519 signatures malleability have been added to match the irtf-cfrg-eddsa draft. * The HChaCha20 core function was implemented (crypto_core_hchacha20()). * No-op stubs were added for all AES256-GCM public functions even when compiled on non-Intel platforms. * crypt_generichash_blake2b_statebytes() was added. * New macros were added for the IETF variant of the ChaCha20-Poly1305 construction. - Update to version 1.0.10 * Compile fix update for older GCCs - update version 1.0.11 * sodium_init() is now thread-safe, and can be safely called multiple times. * Better support for old gcc versions. * AVX2 detection was fixed, resulting in faster BLAKE2b hashing on platforms where it was not properly detected. * The Sandy2x Curve25519 implementation was not as fast as expected on some platforms. This has been fixed. * The NativeClient target was improved. Most notably, it now supports optimized implementations, and uses pepper_49 by default. * The library can be compiled with recent Emscripten versions. Changes have been made to produce smaller code, and the default heap size was reduced in the standard version. * Decryption functions can now accept a NULL pointer for the output. This checks the MAC without writing the decrypted message. * crypto_generichash_final() now returns -1 if called twice. - Update to version 1.0.12 * Ed25519ph was implemented, adding a multi-part signature API (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()). * New constants and related accessors have been added for Scrypt and Argon2. * XChaCha20 has been implemented. Like XSalsa20, this construction extends the ChaCha20 cipher to accept a 192-bit nonce. This makes it safe to use ChaCha20 with random nonces. * crypto_secretbox, crypto_box and crypto_aead now offer variants leveraging XChaCha20. * SHA-2 is about 20% faster, which also gives a speed boost to signature and signature verification. * AVX2 implementations of Salsa20 and ChaCha20 have been added. They are twice as fast as the SSE2 implementations. The speed gain is even more significant on Windows, that previously didn't use vectorized implementations. * New high-level API: crypto_kdf, to easily derive one or more subkeys from a master key. * Siphash with a 128-bit output has been implemented, and is available as crypto_shorthash_siphashx_*. * New *_keygen() helpers functions have been added to create secret keys for all constructions. This improves code clarity and can prevent keys from being partially initialized. * A new randombytes_buf_deterministic() function was added to deterministically fill a memory region with pseudorandom data. This function can especially be useful to write reproducible tests. * A preliminary crypto_kx_*() API was added to compute shared session keys. * AVX2 detection is more reliable. - Update to version 1.0.14 * Internal consistency checks failing and primitives used with dangerous/out-of-bounds/invalid parameters used to call abort(3). Now, a custom handler that doesn't return can be set with the set_sodium_misuse() function. It still aborts by default or if the handler ever returns. This is not a replacement for non-fatal, expected runtime errors. This handler will be only called in unexpected situations due to potential bugs in the library or in language bindings. * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max() symbols) have been added to represent the maximum message size that can be safely handled by a primitive. Language bindings are encouraged to check user inputs against these maximum lengths. * The test suite has been extended to cover more edge cases. * crypto_sign_ed25519_pk_to_curve25519() now rejects points that are not on the curve, or not in the main subgroup. * Further changes have been made to ensure that smart compilers will not optimize out code that we don't want to be optimized. * The sodium_runtime_has_* symbols for CPU features detection are now defined as weak symbols, i.e. they can be replaced with an application-defined implementation. This can be useful to disable AVX* when temperature/power consumption is a concern. * crypto_kx_*() now aborts if called with no non-NULL pointers to store keys to. * SSE2 implementations of crypto_verify_*() have been added. * Passwords can be hashed using a specific algorithm with the new crypto_pwhash_str_alg() function. * Due to popular demand, base64 encoding (sodium_bin2base64()) and decoding (sodium_base642bin()) have been implemented. * A new crypto_secretstream_*() API was added to safely encrypt files and multi-part messages. * The sodium_pad() and sodium_unpad() helper functions have been added in order to add & remove padding. * An AVX512 optimized implementation of Argon2 has been added. * The crypto_pwhash_str_needs_rehash() function was added to check if a password hash string matches the given parameters, or if it needs an update. Updates from 1.0.13 * An AVX2 optimized implementation of the Argon2 round function was added. * The Argon2id variant of Argon2 has been implemented. The high-level crypto_pwhash_str_verify() function automatically detects the algorithm and can verify both Argon2i and Argon2id hashed passwords. The default algorithm for newly hashed passwords remains Argon2i in this version to avoid breaking compatibility with verifiers running libsodium <= 1.0.12. * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented. - Refresh spec-file. - Update to 1.0.15. * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15 * The default password hashing algorithm is now Argon2id. * The pwhash_str_verify() function can still verify Argon2i hashes without any changes, and pwhash() can still compute Argon2i hashes as well. * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated, and didn't seem to be used by any opensource project. * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1 as defined by the OPSLIMIT_MIN constant. This has been fixed. * The secretstream construction was slightly changed to be consistent with forthcoming variants. * The Javascript and Webassembly versions have been merged, and the module now returns a .ready promise that will resolve after the Webassembly code is loaded and compiled. * Note that due to these incompatible changes, the library version major was bumped up. - Update to 1.0.16 * Signatures computations and verifications are now way faster on 64-bit platforms with compilers supporting 128-bit arithmetic (gcc, clang, icc). This includes the WebAssembly target. * New low-level APIs for computations over edwards25519: crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(), crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(), crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform() (elligator representative to point). * crypto_sign_open(), crypto_sign_verify_detached() and crypto_sign_edwards25519sha512batch_open` now reject public keys in non-canonical form in addition to low-order points. * The library can be built with ED25519_NONDETERMINISTIC defined in order to use synthetic nonces for EdDSA. This is disabled by default. * sodium_stackzero() was added to wipe content off the stack. * The Salsa20-based PRNG example is now thread-safe on platforms with support for thread-local storage, optionally mixes bits from RDRAND. * Argon2 and scrypt are slightly faster on Linux. - Enable verbose make output when building tests - Add gpg signature - Modernise spec file with spec-cleaner - Add baselibs.conf: build libsodium23-32bit, which is required by zeromq's -32bit packages. - Update to 1.0.17 - Bug fix: sodium_pad() didn't properly support block sizes >= 256 bytes. - JS/WebAssembly: some old iOS versions can't instantiate the WebAssembly module; fall back to Javascript on these. - JS/WebAssembly: compatibility with newer Emscripten versions. - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't returnEINVAL` on input strings with a short length, unlike their high-level counterpart. - Added a workaround for Visual Studio 2010 bug causing CPU features not to be detected. - Portability improvements. - Test vectors from Project Wycheproof have been added. - New low-level APIs for arithmetic mod the order of the prime order group: - crypto_core_ed25519_scalar_random(), crypto_core_ed25519_scalar_reduce(), - crypto_core_ed25519_scalar_invert(), crypto_core_ed25519_scalar_negate(), - crypto_core_ed25519_scalar_complement(), crypto_core_ed25519_scalar_add() and crypto_core_ed25519_scalar_sub(). - New low-level APIs for scalar multiplication without clamping: crypto_scalarmult_ed25519_base_noclamp() and crypto_scalarmult_ed25519_noclamp(). These new APIs are especially useful for blinding. - sodium_sub() has been implemented. - Support for WatchOS has been added. - getrandom(2) is now used on FreeBSD 12+. - The nonnull attribute has been added to all relevant prototypes. - More reliable AVX512 detection. - Javascript/Webassembly builds now use dynamic memory growth. - Update to 1.0.18 - Enterprise versions of Visual Studio are now supported. - Visual Studio 2019 is now supported. - 32-bit binaries for Visual Studio 2010 are now provided. - A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been removed in order to fix Ansible builds. - Emscripten: print and printErr functions are overridden to send errors to the console, if there is one. - Emscripten: UTF8ToString() is now exported since Pointer_stringify() has been deprecated. - Libsodium version detection has been fixed in the CMake recipe. - Generic hashing got a 10% speedup on AVX2. - New target: WebAssembly/WASI (compile with dist-builds/wasm32-wasi.sh). - New functions to map a hash to an edwards25519 point or get a random point: core_ed25519_from_hash() and core_ed25519_random(). - crypto_core_ed25519_scalar_mul() has been implemented for scalar*scalar (mod L) multiplication. - Support for the Ristretto group has been implemented for interoperability with wasm-crypto. - Improvements have been made to the test suite. - Portability improvements have been made. - getentropy() is now used on systems providing this system call. - randombytes_salsa20 has been renamed to randombytes_internal. - Support for NativeClient has been removed. - Most ((nonnull)) attributes have been relaxed to allow 0-length inputs to be NULL. - The -ftree-vectorize and -ftree-slp-vectorize compiler switches are now used, if available, for optimized builds. - Add libsodium_configure_cpuid_chg.patch and call autoconf to regenerate configure script with proper CPUID checking. Required at least for PowerPC and ARM now that LTO enabled. - Revert previous change about cpuid as previous change rejected in https://build.opensuse.org/request/show/724809 - Disable LTO as bypass boo#1148184 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Now that gcc 5.2 is available on TW, remove the ARMv7 workaround. - Update to 1.0.6 * Optimized implementations of Blake2 have been added for modern Intel platforms. crypto_generichash() is now faster than MD5 and SHA1 implementations while being far more secure. * The crypto_sign_edwards25519sha512batch_*() functions have been tagged as deprecated. * sodium_compare() now works as documented, and compares numbers in little-endian format instead of behaving like memcmp(). * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have been added. - Follow upstream's lead and compile with -flto for > 13.2 on x86 and x86-64. - Update to version 1.0.7 * Sandy2x, the fastest Curve25519 implementation ever, has been merged in, and is automatically used on CPUs supporting the AVX instructions set. * An SSE2 optimized implementation of Poly1305 was added, and is twice as fast as the portable one. * An SSSE3 optimized implementation of ChaCha20 was added, and is twice as fast as the portable one. * Faster sodium_increment() for common nonce sizes. * New helper functions have been added: sodium_is_zero() and sodium_add(). - Update to version 1.0.8 * Handle the case where the CPU supports AVX, but we are running on an hypervisor with AVX disabled/not supported. * Faster (2x) scalarmult_base() when using the ref10 implementation. - Update to version 1.0.9 * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM implementations. * The Argon2i password hashing function was added, and is accessible directly and through a new, high-level crypto_pwhash API. The scrypt function remains available as well. * A speed-record AVX2 implementation of BLAKE2b was added. * Countermeasures for Ed25519 signatures malleability have been added to match the irtf-cfrg-eddsa draft. * The HChaCha20 core function was implemented (crypto_core_hchacha20()). * No-op stubs were added for all AES256-GCM public functions even when compiled on non-Intel platforms. * crypt_generichash_blake2b_statebytes() was added. * New macros were added for the IETF variant of the ChaCha20-Poly1305 construction. - Update to version 1.0.10 * Compile fix update for older GCCs - update version 1.0.11 * sodium_init() is now thread-safe, and can be safely called multiple times. * Better support for old gcc versions. * AVX2 detection was fixed, resulting in faster BLAKE2b hashing on platforms where it was not properly detected. * The Sandy2x Curve25519 implementation was not as fast as expected on some platforms. This has been fixed. * The NativeClient target was improved. Most notably, it now supports optimized implementations, and uses pepper_49 by default. * The library can be compiled with recent Emscripten versions. Changes have been made to produce smaller code, and the default heap size was reduced in the standard version. * Decryption functions can now accept a NULL pointer for the output. This checks the MAC without writing the decrypted message. * crypto_generichash_final() now returns -1 if called twice. - Update to version 1.0.12 * Ed25519ph was implemented, adding a multi-part signature API (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()). * New constants and related accessors have been added for Scrypt and Argon2. * XChaCha20 has been implemented. Like XSalsa20, this construction extends the ChaCha20 cipher to accept a 192-bit nonce. This makes it safe to use ChaCha20 with random nonces. * crypto_secretbox, crypto_box and crypto_aead now offer variants leveraging XChaCha20. * SHA-2 is about 20% faster, which also gives a speed boost to signature and signature verification. * AVX2 implementations of Salsa20 and ChaCha20 have been added. They are twice as fast as the SSE2 implementations. The speed gain is even more significant on Windows, that previously didn't use vectorized implementations. * New high-level API: crypto_kdf, to easily derive one or more subkeys from a master key. * Siphash with a 128-bit output has been implemented, and is available as crypto_shorthash_siphashx_*. * New *_keygen() helpers functions have been added to create secret keys for all constructions. This improves code clarity and can prevent keys from being partially initialized. * A new randombytes_buf_deterministic() function was added to deterministically fill a memory region with pseudorandom data. This function can especially be useful to write reproducible tests. * A preliminary crypto_kx_*() API was added to compute shared session keys. * AVX2 detection is more reliable. - Update to version 1.0.14 * Internal consistency checks failing and primitives used with dangerous/out-of-bounds/invalid parameters used to call abort(3). Now, a custom handler that doesn't return can be set with the set_sodium_misuse() function. It still aborts by default or if the handler ever returns. This is not a replacement for non-fatal, expected runtime errors. This handler will be only called in unexpected situations due to potential bugs in the library or in language bindings. * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max() symbols) have been added to represent the maximum message size that can be safely handled by a primitive. Language bindings are encouraged to check user inputs against these maximum lengths. * The test suite has been extended to cover more edge cases. * crypto_sign_ed25519_pk_to_curve25519() now rejects points that are not on the curve, or not in the main subgroup. * Further changes have been made to ensure that smart compilers will not optimize out code that we don't want to be optimized. * The sodium_runtime_has_* symbols for CPU features detection are now defined as weak symbols, i.e. they can be replaced with an application-defined implementation. This can be useful to disable AVX* when temperature/power consumption is a concern. * crypto_kx_*() now aborts if called with no non-NULL pointers to store keys to. * SSE2 implementations of crypto_verify_*() have been added. * Passwords can be hashed using a specific algorithm with the new crypto_pwhash_str_alg() function. * Due to popular demand, base64 encoding (sodium_bin2base64()) and decoding (sodium_base642bin()) have been implemented. * A new crypto_secretstream_*() API was added to safely encrypt files and multi-part messages. * The sodium_pad() and sodium_unpad() helper functions have been added in order to add & remove padding. * An AVX512 optimized implementation of Argon2 has been added. * The crypto_pwhash_str_needs_rehash() function was added to check if a password hash string matches the given parameters, or if it needs an update. Updates from 1.0.13 * An AVX2 optimized implementation of the Argon2 round function was added. * The Argon2id variant of Argon2 has been implemented. The high-level crypto_pwhash_str_verify() function automatically detects the algorithm and can verify both Argon2i and Argon2id hashed passwords. The default algorithm for newly hashed passwords remains Argon2i in this version to avoid breaking compatibility with verifiers running libsodium <= 1.0.12. * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented. - Refresh spec-file. - Update to 1.0.15. * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15 * The default password hashing algorithm is now Argon2id. * The pwhash_str_verify() function can still verify Argon2i hashes without any changes, and pwhash() can still compute Argon2i hashes as well. * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated, and didn't seem to be used by any opensource project. * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1 as defined by the OPSLIMIT_MIN constant. This has been fixed. * The secretstream construction was slightly changed to be consistent with forthcoming variants. * The Javascript and Webassembly versions have been merged, and the module now returns a .ready promise that will resolve after the Webassembly code is loaded and compiled. * Note that due to these incompatible changes, the library version major was bumped up. - Update to 1.0.16 * Signatures computations and verifications are now way faster on 64-bit platforms with compilers supporting 128-bit arithmetic (gcc, clang, icc). This includes the WebAssembly target. * New low-level APIs for computations over edwards25519: crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(), crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(), crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform() (elligator representative to point). * crypto_sign_open(), crypto_sign_verify_detached() and crypto_sign_edwards25519sha512batch_open` now reject public keys in non-canonical form in addition to low-order points. * The library can be built with ED25519_NONDETERMINISTIC defined in order to use synthetic nonces for EdDSA. This is disabled by default. * sodium_stackzero() was added to wipe content off the stack. * The Salsa20-based PRNG example is now thread-safe on platforms with support for thread-local storage, optionally mixes bits from RDRAND. * Argon2 and scrypt are slightly faster on Linux. - Enable verbose make output when building tests - Add gpg signature - Modernise spec file with spec-cleaner - Add baselibs.conf: build libsodium23-32bit, which is required by zeromq's -32bit packages. - Update to 1.0.17 - Bug fix: sodium_pad() didn't properly support block sizes >= 256 bytes. - JS/WebAssembly: some old iOS versions can't instantiate the WebAssembly module; fall back to Javascript on these. - JS/WebAssembly: compatibility with newer Emscripten versions. - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't returnEINVAL` on input strings with a short length, unlike their high-level counterpart. - Added a workaround for Visual Studio 2010 bug causing CPU features not to be detected. - Portability improvements. - Test vectors from Project Wycheproof have been added. - New low-level APIs for arithmetic mod the order of the prime order group: - crypto_core_ed25519_scalar_random(), crypto_core_ed25519_scalar_reduce(), - crypto_core_ed25519_scalar_invert(), crypto_core_ed25519_scalar_negate(), - crypto_core_ed25519_scalar_complement(), crypto_core_ed25519_scalar_add() and crypto_core_ed25519_scalar_sub(). - New low-level APIs for scalar multiplication without clamping: crypto_scalarmult_ed25519_base_noclamp() and crypto_scalarmult_ed25519_noclamp(). These new APIs are especially useful for blinding. - sodium_sub() has been implemented. - Support for WatchOS has been added. - getrandom(2) is now used on FreeBSD 12+. - The nonnull attribute has been added to all relevant prototypes. - More reliable AVX512 detection. - Javascript/Webassembly builds now use dynamic memory growth. - Update to 1.0.18 - Enterprise versions of Visual Studio are now supported. - Visual Studio 2019 is now supported. - 32-bit binaries for Visual Studio 2010 are now provided. - A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been removed in order to fix Ansible builds. - Emscripten: print and printErr functions are overridden to send errors to the console, if there is one. - Emscripten: UTF8ToString() is now exported since Pointer_stringify() has been deprecated. - Libsodium version detection has been fixed in the CMake recipe. - Generic hashing got a 10% speedup on AVX2. - New target: WebAssembly/WASI (compile with dist-builds/wasm32-wasi.sh). - New functions to map a hash to an edwards25519 point or get a random point: core_ed25519_from_hash() and core_ed25519_random(). - crypto_core_ed25519_scalar_mul() has been implemented for scalar*scalar (mod L) multiplication. - Support for the Ristretto group has been implemented for interoperability with wasm-crypto. - Improvements have been made to the test suite. - Portability improvements have been made. - getentropy() is now used on systems providing this system call. - randombytes_salsa20 has been renamed to randombytes_internal. - Support for NativeClient has been removed. - Most ((nonnull)) attributes have been relaxed to allow 0-length inputs to be NULL. - The -ftree-vectorize and -ftree-slp-vectorize compiler switches are now used, if available, for optimized builds. - Add libsodium_configure_cpuid_chg.patch and call autoconf to regenerate configure script with proper CPUID checking. Required at least for PowerPC and ARM now that LTO enabled. - Revert previous change about cpuid as previous change rejected in https://build.opensuse.org/request/show/724809 - Disable LTO as bypass boo#1148184 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Now that gcc 5.2 is available on TW, remove the ARMv7 workaround. - Update to 1.0.6 * Optimized implementations of Blake2 have been added for modern Intel platforms. crypto_generichash() is now faster than MD5 and SHA1 implementations while being far more secure. * The crypto_sign_edwards25519sha512batch_*() functions have been tagged as deprecated. * sodium_compare() now works as documented, and compares numbers in little-endian format instead of behaving like memcmp(). * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have been added. - Follow upstream's lead and compile with -flto for > 13.2 on x86 and x86-64. - Update to version 1.0.7 * Sandy2x, the fastest Curve25519 implementation ever, has been merged in, and is automatically used on CPUs supporting the AVX instructions set. * An SSE2 optimized implementation of Poly1305 was added, and is twice as fast as the portable one. * An SSSE3 optimized implementation of ChaCha20 was added, and is twice as fast as the portable one. * Faster sodium_increment() for common nonce sizes. * New helper functions have been added: sodium_is_zero() and sodium_add(). - Update to version 1.0.8 * Handle the case where the CPU supports AVX, but we are running on an hypervisor with AVX disabled/not supported. * Faster (2x) scalarmult_base() when using the ref10 implementation. - Update to version 1.0.9 * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM implementations. * The Argon2i password hashing function was added, and is accessible directly and through a new, high-level crypto_pwhash API. The scrypt function remains available as well. * A speed-record AVX2 implementation of BLAKE2b was added. * Countermeasures for Ed25519 signatures malleability have been added to match the irtf-cfrg-eddsa draft. * The HChaCha20 core function was implemented (crypto_core_hchacha20()). * No-op stubs were added for all AES256-GCM public functions even when compiled on non-Intel platforms. * crypt_generichash_blake2b_statebytes() was added. * New macros were added for the IETF variant of the ChaCha20-Poly1305 construction. - Update to version 1.0.10 * Compile fix update for older GCCs - update version 1.0.11 * sodium_init() is now thread-safe, and can be safely called multiple times. * Better support for old gcc versions. * AVX2 detection was fixed, resulting in faster BLAKE2b hashing on platforms where it was not properly detected. * The Sandy2x Curve25519 implementation was not as fast as expected on some platforms. This has been fixed. * The NativeClient target was improved. Most notably, it now supports optimized implementations, and uses pepper_49 by default. * The library can be compiled with recent Emscripten versions. Changes have been made to produce smaller code, and the default heap size was reduced in the standard version. * Decryption functions can now accept a NULL pointer for the output. This checks the MAC without writing the decrypted message. * crypto_generichash_final() now returns -1 if called twice. - Update to version 1.0.12 * Ed25519ph was implemented, adding a multi-part signature API (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()). * New constants and related accessors have been added for Scrypt and Argon2. * XChaCha20 has been implemented. Like XSalsa20, this construction extends the ChaCha20 cipher to accept a 192-bit nonce. This makes it safe to use ChaCha20 with random nonces. * crypto_secretbox, crypto_box and crypto_aead now offer variants leveraging XChaCha20. * SHA-2 is about 20% faster, which also gives a speed boost to signature and signature verification. * AVX2 implementations of Salsa20 and ChaCha20 have been added. They are twice as fast as the SSE2 implementations. The speed gain is even more significant on Windows, that previously didn't use vectorized implementations. * New high-level API: crypto_kdf, to easily derive one or more subkeys from a master key. * Siphash with a 128-bit output has been implemented, and is available as crypto_shorthash_siphashx_*. * New *_keygen() helpers functions have been added to create secret keys for all constructions. This improves code clarity and can prevent keys from being partially initialized. * A new randombytes_buf_deterministic() function was added to deterministically fill a memory region with pseudorandom data. This function can especially be useful to write reproducible tests. * A preliminary crypto_kx_*() API was added to compute shared session keys. * AVX2 detection is more reliable. - Update to version 1.0.14 * Internal consistency checks failing and primitives used with dangerous/out-of-bounds/invalid parameters used to call abort(3). Now, a custom handler that doesn't return can be set with the set_sodium_misuse() function. It still aborts by default or if the handler ever returns. This is not a replacement for non-fatal, expected runtime errors. This handler will be only called in unexpected situations due to potential bugs in the library or in language bindings. * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max() symbols) have been added to represent the maximum message size that can be safely handled by a primitive. Language bindings are encouraged to check user inputs against these maximum lengths. * The test suite has been extended to cover more edge cases. * crypto_sign_ed25519_pk_to_curve25519() now rejects points that are not on the curve, or not in the main subgroup. * Further changes have been made to ensure that smart compilers will not optimize out code that we don't want to be optimized. * The sodium_runtime_has_* symbols for CPU features detection are now defined as weak symbols, i.e. they can be replaced with an application-defined implementation. This can be useful to disable AVX* when temperature/power consumption is a concern. * crypto_kx_*() now aborts if called with no non-NULL pointers to store keys to. * SSE2 implementations of crypto_verify_*() have been added. * Passwords can be hashed using a specific algorithm with the new crypto_pwhash_str_alg() function. * Due to popular demand, base64 encoding (sodium_bin2base64()) and decoding (sodium_base642bin()) have been implemented. * A new crypto_secretstream_*() API was added to safely encrypt files and multi-part messages. * The sodium_pad() and sodium_unpad() helper functions have been added in order to add & remove padding. * An AVX512 optimized implementation of Argon2 has been added. * The crypto_pwhash_str_needs_rehash() function was added to check if a password hash string matches the given parameters, or if it needs an update. Updates from 1.0.13 * An AVX2 optimized implementation of the Argon2 round function was added. * The Argon2id variant of Argon2 has been implemented. The high-level crypto_pwhash_str_verify() function automatically detects the algorithm and can verify both Argon2i and Argon2id hashed passwords. The default algorithm for newly hashed passwords remains Argon2i in this version to avoid breaking compatibility with verifiers running libsodium <= 1.0.12. * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented. - Refresh spec-file. - Update to 1.0.15. * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15 * The default password hashing algorithm is now Argon2id. * The pwhash_str_verify() function can still verify Argon2i hashes without any changes, and pwhash() can still compute Argon2i hashes as well. * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated, and didn't seem to be used by any opensource project. * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1 as defined by the OPSLIMIT_MIN constant. This has been fixed. * The secretstream construction was slightly changed to be consistent with forthcoming variants. * The Javascript and Webassembly versions have been merged, and the module now returns a .ready promise that will resolve after the Webassembly code is loaded and compiled. * Note that due to these incompatible changes, the library version major was bumped up. - Update to 1.0.16 * Signatures computations and verifications are now way faster on 64-bit platforms with compilers supporting 128-bit arithmetic (gcc, clang, icc). This includes the WebAssembly target. * New low-level APIs for computations over edwards25519: crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(), crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(), crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform() (elligator representative to point). * crypto_sign_open(), crypto_sign_verify_detached() and crypto_sign_edwards25519sha512batch_open` now reject public keys in non-canonical form in addition to low-order points. * The library can be built with ED25519_NONDETERMINISTIC defined in order to use synthetic nonces for EdDSA. This is disabled by default. * sodium_stackzero() was added to wipe content off the stack. * The Salsa20-based PRNG example is now thread-safe on platforms with support for thread-local storage, optionally mixes bits from RDRAND. * Argon2 and scrypt are slightly faster on Linux. - Enable verbose make output when building tests - Add gpg signature - Modernise spec file with spec-cleaner - Add baselibs.conf: build libsodium23-32bit, which is required by zeromq's -32bit packages. - Update to 1.0.17 - Bug fix: sodium_pad() didn't properly support block sizes >= 256 bytes. - JS/WebAssembly: some old iOS versions can't instantiate the WebAssembly module; fall back to Javascript on these. - JS/WebAssembly: compatibility with newer Emscripten versions. - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't returnEINVAL` on input strings with a short length, unlike their high-level counterpart. - Added a workaround for Visual Studio 2010 bug causing CPU features not to be detected. - Portability improvements. - Test vectors from Project Wycheproof have been added. - New low-level APIs for arithmetic mod the order of the prime order group: - crypto_core_ed25519_scalar_random(), crypto_core_ed25519_scalar_reduce(), - crypto_core_ed25519_scalar_invert(), crypto_core_ed25519_scalar_negate(), - crypto_core_ed25519_scalar_complement(), crypto_core_ed25519_scalar_add() and crypto_core_ed25519_scalar_sub(). - New low-level APIs for scalar multiplication without clamping: crypto_scalarmult_ed25519_base_noclamp() and crypto_scalarmult_ed25519_noclamp(). These new APIs are especially useful for blinding. - sodium_sub() has been implemented. - Support for WatchOS has been added. - getrandom(2) is now used on FreeBSD 12+. - The nonnull attribute has been added to all relevant prototypes. - More reliable AVX512 detection. - Javascript/Webassembly builds now use dynamic memory growth. - Update to 1.0.18 - Enterprise versions of Visual Studio are now supported. - Visual Studio 2019 is now supported. - 32-bit binaries for Visual Studio 2010 are now provided. - A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been removed in order to fix Ansible builds. - Emscripten: print and printErr functions are overridden to send errors to the console, if there is one. - Emscripten: UTF8ToString() is now exported since Pointer_stringify() has been deprecated. - Libsodium version detection has been fixed in the CMake recipe. - Generic hashing got a 10% speedup on AVX2. - New target: WebAssembly/WASI (compile with dist-builds/wasm32-wasi.sh). - New functions to map a hash to an edwards25519 point or get a random point: core_ed25519_from_hash() and core_ed25519_random(). - crypto_core_ed25519_scalar_mul() has been implemented for scalar*scalar (mod L) multiplication. - Support for the Ristretto group has been implemented for interoperability with wasm-crypto. - Improvements have been made to the test suite. - Portability improvements have been made. - getentropy() is now used on systems providing this system call. - randombytes_salsa20 has been renamed to randombytes_internal. - Support for NativeClient has been removed. - Most ((nonnull)) attributes have been relaxed to allow 0-length inputs to be NULL. - The -ftree-vectorize and -ftree-slp-vectorize compiler switches are now used, if available, for optimized builds. - Add libsodium_configure_cpuid_chg.patch and call autoconf to regenerate configure script with proper CPUID checking. Required at least for PowerPC and ARM now that LTO enabled. - Revert previous change about cpuid as previous change rejected in https://build.opensuse.org/request/show/724809 - Disable LTO as bypass boo#1148184 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - fix ruleinfo of complex dependencies returning the wrong origin - bump version to 0.7.12 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - fix ruleinfo of complex dependencies returning the wrong origin - bump version to 0.7.12 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - fix ruleinfo of complex dependencies returning the wrong origin - bump version to 0.7.12 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - fix ruleinfo of complex dependencies returning the wrong origin - bump version to 0.7.12 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - Fix solvable swapping messing up idarrays - bump version to 0.7.13 - Support blacklisted packages in solver_findproblemrule() [bnc#1172135] - Support rules with multiple negative literals in choice rule generation - bump version to 0.7.14 - Enable zstd compression support for sle15-sp2 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - Enable zstd compression support for sle15 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix deduceq2addedmap clearing bits outside of the map - conda: feature depriorization first - conda: fix startswith implementation - move find_update_seeds() call in cleandeps calculation - set SOLVABLE_BUILDHOST in rpm and rpmmd parsers - new testcase_mangle_repo_names() function - new solv_fmemopen() function - bump version to 0.7.15 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - make testcase_mangle_repo_names deal correctly with freed repos [bnc#1177238] - do not ask the namespace callback for splitprovides when writing a testcase - fix add_complex_recommends() selecting conflicted packages in rare cases leading to crashes - improve choicerule generation so that package updates are prefered in more cases - bump version to 0.7.16 - repo_write: fix handling of nested flexarray - improve choicerule generation a bit more to cover more cases - harden testcase parser against repos being added too late - support python-3.10 - check %_dbpath macro in rpmdb code - handle default/visible/langonly attributes in comps parser - support multiple collections in updateinfo parser - add '-D' option in rpmdb2solv to set the dbpath - bump version to 0.7.17 - fixed regex code on win32 - fixed memory leak in choice rule generation - repo_add_conda: add flag to skip v2 packages - bump version to 0.7.18 - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt - fix a couple of memory leaks in error cases - fix error handling in solv_xfopen_fd() - bump version to 0.7.19 - Disable python2 usage on suse_version >= 1550 by default (still possible to use osc build --with=python). - fix misparsing of '&' in attributes with libxml2 - choice rules: treat orphaned packages as newest [bsc#1190465] - fix compatibility with Python 3.10 - new SOLVER_EXCLUDEFROMWEAK job type - support for environments in comps parser - bump version to 0.7.20 - fix segfault on conflict resolution when using bindings - fix split provides not working if the update includes a forbidden vendor change - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY - support zstd compressed control files in debian packages - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20) - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck - support solv files with an idarray block - allow accessing the toolversion at runtime - bump version to 0.7.21 - reworked choice rule generation to cover more usecases - support SOLVABLE_PREREQ_IGNOREINST in the ordering code [bsc#1196514] - support parsing of Debian's Multi-Arch indicator - bump version to 0.7.22 - fix "keep installed" jobs not disabling "best update" rules - do not autouninstall suse ptf packages - ensure duplinvolvedmap_all is reset when a solver is reused - special case file dependencies in the testcase writer - support stringification of multiple solvables - new weakdep introspection interface similar to ruleinfos - support decision reason queries - support merging of related decissions - support stringification of ruleinfo, decisioninfo and decision reasons - support better info about alternatives - new '-P' and '-W' options for testsolv - bump version to 0.7.23 - handle learnt rules in solver_alternativeinfo() - support x86_64_v[234] architecture levels - implement decision sorting for package decisionlists - add back findutils requires for the libsolv-tools packagse [bsc#1195633] - bump version to 0.7.24 - support complex deps in SOLVABLE_PREREQ_IGNOREINST - fix minimization not prefering installed packages in some cases - reduce memory usage in repo_updateinfoxml - fix lock-step interfering with architecture selection - fix choice rule handing for package downgrades - fix complex dependencies with an "else" part sometimes leading to unsolved dependencies - bump version to 0.7.25 - fix evr roundtrip in testcases - do not use deprecated headerUnload with newer rpm versions - bump version to 0.7.26 - add zstd support for the installcheck tool - add putinowndirpool cache to make file list handling in repo_write much faster - bump version to 0.7.27 - build for multiple python versions [jsc#PED-6218] - bump version to 0.7.28 - split libsolv-tools into libsolv-tools-base [jsc#PED-8153] - improve updating of installed multiversion packages - fix decision introspection going into an endless loop in some cases - added experimental lua bindings - bump version to 0.7.29 - add a conflict to older libsolv-tools to libsolv-tools-base - report unsupported compression in solv_xfopen() with errno - fix return value of repodata.add_solv() in the bindings - fix SHA-224 oid in solv_pgpvrfy - removed dependency on external find program in the repo2solv tool - bindings: fix return value of repodata.add_solv() - new SOLVER_FLAG_FOCUS_NEW flag - bump version to 0.7.30 - fix replaces_installed_package using the wrong solvable id when checking the noupdate map - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard - add rpm_query_idarray query function - support rpm's "orderwithrequires" dependency - bump version to 0.7.31 - Update to version 2.68.4: + WebSockets: - Ensure a new connection is created for WebSocket requests. - Do not start the input source when IO is closing. + build: Update glib requirement to 2.58. - Update to version 2.69.90: + Add new API to expose support for same-site cookies. + Fix TRACE method not being considered safe and idempotent internally. + WebSockets: ensure a new connection is created for WebSocket requests. + WebSockets: do not start the input source when IO is closing. + Deprecate soup_date_to_timeval(). + build: Update glib requirement to 2.58. + Updated translations. - Update to version 2.70.0: + Deprecate SoupSession:proxy-uri. + Updated translations. - Add libsoup-test-utils-fix.patch: test-utils: Clarify meaning of an environment variable. - Add libsoup-disable-ssl-tests.patch: Disable ssl tests, as they randomly fail for all arches (glgo#GNOME/libsoup#188). - Rebase/refresh patches. - Autodetect the location of krb5-config: krb5 adds itself to $PATH. - Update to version 2.71.0: + Redesign directory list returned for `file://` requests. + Add `SOUP_COOKIE_JAR_ACCEPT_GRANDFATHERED_THIRD_PARTY` policy. + Add soup_message_is_feature_disabled() API. + Fix potential leak when setting SoupSession:tls-interaction. + Fix building with Visual Studio. + Updated translations. - Drop libsoup-test-utils-fix.patch: fixed upstream. - Update to version 2.71.1: + Add support for 308 Premanent Redirect. + Add basic sysprof profiling for HTTP messages. + Various build fixes. + Updated translations. - Add pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4) BuildRequires: new dependencies. - Update to version 2.72.0: + Fix critical after cancelling a message that failed auth. + Updated translations. - Disable sysprof integration: this causes a nasty build cycle. + Pass -Dsysprof=disabled to meson. + Remove pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4), as well as pkgconfig(sysprof-4) in the devel project. - Fix tests: fix SSL test with glib-networking >= 2.65.90 * See https://gitlab.gnome.org/GNOME/libsoup/issues/201 - Add libsoup-fix-SSL-test.patch - Remove patches: * libsoup-disable-ssl-tests.patch * libsoup-disable-hsts-tests.patch - Disable tls_interaction-test until resolved upstream * See https://gitlab.gnome.org/GNOME/libsoup/issues/120 - Add libsoup-skip-tls_interaction-test.patch - Run the regression tests using GnuTLS NORMAL priority - Update to version 2.74.0: + IMPORTANT: Enable ssl-use-system-ca-file by default on deprecated Sync and Async sessions. + Fix including headers in C++ projects. + Fix attempting to resolve relative paths with data URIs. + Support Content-Disposition headers without a disposition-type. + Fix building VAPI bindings with latest Vala. + Fix sending a Content-Length header in a response with status code of 1xx or 204. + Updated translations. - Drop libsoup-fix-SSL-test.patch: fixed upstream. - Rename source package to libsoup2, as a compatibility package while the world moves to libsoup3 (with HTTP/2 support). - Add Provides: libsoup2 to the library, so that the lang package is installable. - Remove the left-over provides/obsoltes for libsoup (which is now libsoup 3). - Add libsoup2-extend-test-cert.patch to fix tests after 2027 (boo#1102840) - Update to version 2.74.1: + Fix support for older versions of Vala. + Fix trying to build sysprof as a subproject on Windows. + Fix missing `extern "C"` in an installed header. + Improve `gssapi` dependency handling. + Fix `libsoup-doc` build target. + Updated translations. - Update to version 2.74.2: + Error when libsoup3 is already loaded before libsoup2. - Add 04df03bc.patch: strictly don't allow NUL bytes in headers (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377). - Add libsoup-CVE-2024-52532.patch: websocket: Process the frame as soon as we read data (boo#1233287 CVE-2024-52532). - Add 29b96fab.patch: websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391). - Add a35222dd.patch: be more robust against invalid input when parsing params (boo#1233292 CVE-2024-52531 glgo#GNOME/libsoup!407). - Add 4c9e75c6.patch: fix an intermittent test failure (glgo#GNOME/soup#399). - Update to version 2.68.4: + WebSockets: - Ensure a new connection is created for WebSocket requests. - Do not start the input source when IO is closing. + build: Update glib requirement to 2.58. - Update to version 2.69.90: + Add new API to expose support for same-site cookies. + Fix TRACE method not being considered safe and idempotent internally. + WebSockets: ensure a new connection is created for WebSocket requests. + WebSockets: do not start the input source when IO is closing. + Deprecate soup_date_to_timeval(). + build: Update glib requirement to 2.58. + Updated translations. - Update to version 2.70.0: + Deprecate SoupSession:proxy-uri. + Updated translations. - Add libsoup-test-utils-fix.patch: test-utils: Clarify meaning of an environment variable. - Add libsoup-disable-ssl-tests.patch: Disable ssl tests, as they randomly fail for all arches (glgo#GNOME/libsoup#188). - Rebase/refresh patches. - Autodetect the location of krb5-config: krb5 adds itself to $PATH. - Update to version 2.71.0: + Redesign directory list returned for `file://` requests. + Add `SOUP_COOKIE_JAR_ACCEPT_GRANDFATHERED_THIRD_PARTY` policy. + Add soup_message_is_feature_disabled() API. + Fix potential leak when setting SoupSession:tls-interaction. + Fix building with Visual Studio. + Updated translations. - Drop libsoup-test-utils-fix.patch: fixed upstream. - Update to version 2.71.1: + Add support for 308 Premanent Redirect. + Add basic sysprof profiling for HTTP messages. + Various build fixes. + Updated translations. - Add pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4) BuildRequires: new dependencies. - Update to version 2.72.0: + Fix critical after cancelling a message that failed auth. + Updated translations. - Disable sysprof integration: this causes a nasty build cycle. + Pass -Dsysprof=disabled to meson. + Remove pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4), as well as pkgconfig(sysprof-4) in the devel project. - Fix tests: fix SSL test with glib-networking >= 2.65.90 * See https://gitlab.gnome.org/GNOME/libsoup/issues/201 - Add libsoup-fix-SSL-test.patch - Remove patches: * libsoup-disable-ssl-tests.patch * libsoup-disable-hsts-tests.patch - Disable tls_interaction-test until resolved upstream * See https://gitlab.gnome.org/GNOME/libsoup/issues/120 - Add libsoup-skip-tls_interaction-test.patch - Run the regression tests using GnuTLS NORMAL priority - Update to version 2.74.0: + IMPORTANT: Enable ssl-use-system-ca-file by default on deprecated Sync and Async sessions. + Fix including headers in C++ projects. + Fix attempting to resolve relative paths with data URIs. + Support Content-Disposition headers without a disposition-type. + Fix building VAPI bindings with latest Vala. + Fix sending a Content-Length header in a response with status code of 1xx or 204. + Updated translations. - Drop libsoup-fix-SSL-test.patch: fixed upstream. - Rename source package to libsoup2, as a compatibility package while the world moves to libsoup3 (with HTTP/2 support). - Add Provides: libsoup2 to the library, so that the lang package is installable. - Remove the left-over provides/obsoltes for libsoup (which is now libsoup 3). - Add libsoup2-extend-test-cert.patch to fix tests after 2027 (boo#1102840) - Update to version 2.74.1: + Fix support for older versions of Vala. + Fix trying to build sysprof as a subproject on Windows. + Fix missing `extern "C"` in an installed header. + Improve `gssapi` dependency handling. + Fix `libsoup-doc` build target. + Updated translations. - Update to version 2.74.2: + Error when libsoup3 is already loaded before libsoup2. - Add 04df03bc.patch: strictly don't allow NUL bytes in headers (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377). - Add libsoup-CVE-2024-52532.patch: websocket: Process the frame as soon as we read data (boo#1233287 CVE-2024-52532). - Add 29b96fab.patch: websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391). - Add a35222dd.patch: be more robust against invalid input when parsing params (boo#1233292 CVE-2024-52531 glgo#GNOME/libsoup!407). - Add 4c9e75c6.patch: fix an intermittent test failure (glgo#GNOME/soup#399). - Update to version 2.68.4: + WebSockets: - Ensure a new connection is created for WebSocket requests. - Do not start the input source when IO is closing. + build: Update glib requirement to 2.58. - Update to version 2.69.90: + Add new API to expose support for same-site cookies. + Fix TRACE method not being considered safe and idempotent internally. + WebSockets: ensure a new connection is created for WebSocket requests. + WebSockets: do not start the input source when IO is closing. + Deprecate soup_date_to_timeval(). + build: Update glib requirement to 2.58. + Updated translations. - Update to version 2.70.0: + Deprecate SoupSession:proxy-uri. + Updated translations. - Add libsoup-test-utils-fix.patch: test-utils: Clarify meaning of an environment variable. - Add libsoup-disable-ssl-tests.patch: Disable ssl tests, as they randomly fail for all arches (glgo#GNOME/libsoup#188). - Rebase/refresh patches. - Autodetect the location of krb5-config: krb5 adds itself to $PATH. - Update to version 2.71.0: + Redesign directory list returned for `file://` requests. + Add `SOUP_COOKIE_JAR_ACCEPT_GRANDFATHERED_THIRD_PARTY` policy. + Add soup_message_is_feature_disabled() API. + Fix potential leak when setting SoupSession:tls-interaction. + Fix building with Visual Studio. + Updated translations. - Drop libsoup-test-utils-fix.patch: fixed upstream. - Update to version 2.71.1: + Add support for 308 Premanent Redirect. + Add basic sysprof profiling for HTTP messages. + Various build fixes. + Updated translations. - Add pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4) BuildRequires: new dependencies. - Update to version 2.72.0: + Fix critical after cancelling a message that failed auth. + Updated translations. - Disable sysprof integration: this causes a nasty build cycle. + Pass -Dsysprof=disabled to meson. + Remove pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4), as well as pkgconfig(sysprof-4) in the devel project. - Fix tests: fix SSL test with glib-networking >= 2.65.90 * See https://gitlab.gnome.org/GNOME/libsoup/issues/201 - Add libsoup-fix-SSL-test.patch - Remove patches: * libsoup-disable-ssl-tests.patch * libsoup-disable-hsts-tests.patch - Disable tls_interaction-test until resolved upstream * See https://gitlab.gnome.org/GNOME/libsoup/issues/120 - Add libsoup-skip-tls_interaction-test.patch - Run the regression tests using GnuTLS NORMAL priority - Update to version 2.74.0: + IMPORTANT: Enable ssl-use-system-ca-file by default on deprecated Sync and Async sessions. + Fix including headers in C++ projects. + Fix attempting to resolve relative paths with data URIs. + Support Content-Disposition headers without a disposition-type. + Fix building VAPI bindings with latest Vala. + Fix sending a Content-Length header in a response with status code of 1xx or 204. + Updated translations. - Drop libsoup-fix-SSL-test.patch: fixed upstream. - Rename source package to libsoup2, as a compatibility package while the world moves to libsoup3 (with HTTP/2 support). - Add Provides: libsoup2 to the library, so that the lang package is installable. - Remove the left-over provides/obsoltes for libsoup (which is now libsoup 3). - Add libsoup2-extend-test-cert.patch to fix tests after 2027 (boo#1102840) - Update to version 2.74.1: + Fix support for older versions of Vala. + Fix trying to build sysprof as a subproject on Windows. + Fix missing `extern "C"` in an installed header. + Improve `gssapi` dependency handling. + Fix `libsoup-doc` build target. + Updated translations. - Update to version 2.74.2: + Error when libsoup3 is already loaded before libsoup2. - Add 04df03bc.patch: strictly don't allow NUL bytes in headers (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377). - Add libsoup-CVE-2024-52532.patch: websocket: Process the frame as soon as we read data (boo#1233287 CVE-2024-52532). - Add 29b96fab.patch: websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391). - Add a35222dd.patch: be more robust against invalid input when parsing params (boo#1233292 CVE-2024-52531 glgo#GNOME/libsoup!407). - Add 4c9e75c6.patch: fix an intermittent test failure (glgo#GNOME/soup#399). - Update to version 2.68.4: + WebSockets: - Ensure a new connection is created for WebSocket requests. - Do not start the input source when IO is closing. + build: Update glib requirement to 2.58. - Update to version 2.69.90: + Add new API to expose support for same-site cookies. + Fix TRACE method not being considered safe and idempotent internally. + WebSockets: ensure a new connection is created for WebSocket requests. + WebSockets: do not start the input source when IO is closing. + Deprecate soup_date_to_timeval(). + build: Update glib requirement to 2.58. + Updated translations. - Update to version 2.70.0: + Deprecate SoupSession:proxy-uri. + Updated translations. - Add libsoup-test-utils-fix.patch: test-utils: Clarify meaning of an environment variable. - Add libsoup-disable-ssl-tests.patch: Disable ssl tests, as they randomly fail for all arches (glgo#GNOME/libsoup#188). - Rebase/refresh patches. - Autodetect the location of krb5-config: krb5 adds itself to $PATH. - Update to version 2.71.0: + Redesign directory list returned for `file://` requests. + Add `SOUP_COOKIE_JAR_ACCEPT_GRANDFATHERED_THIRD_PARTY` policy. + Add soup_message_is_feature_disabled() API. + Fix potential leak when setting SoupSession:tls-interaction. + Fix building with Visual Studio. + Updated translations. - Drop libsoup-test-utils-fix.patch: fixed upstream. - Update to version 2.71.1: + Add support for 308 Premanent Redirect. + Add basic sysprof profiling for HTTP messages. + Various build fixes. + Updated translations. - Add pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4) BuildRequires: new dependencies. - Update to version 2.72.0: + Fix critical after cancelling a message that failed auth. + Updated translations. - Disable sysprof integration: this causes a nasty build cycle. + Pass -Dsysprof=disabled to meson. + Remove pkgconfig(sysprof-4) and pkgconfig(sysprof-capture-4), as well as pkgconfig(sysprof-4) in the devel project. - Fix tests: fix SSL test with glib-networking >= 2.65.90 * See https://gitlab.gnome.org/GNOME/libsoup/issues/201 - Add libsoup-fix-SSL-test.patch - Remove patches: * libsoup-disable-ssl-tests.patch * libsoup-disable-hsts-tests.patch - Disable tls_interaction-test until resolved upstream * See https://gitlab.gnome.org/GNOME/libsoup/issues/120 - Add libsoup-skip-tls_interaction-test.patch - Run the regression tests using GnuTLS NORMAL priority - Update to version 2.74.0: + IMPORTANT: Enable ssl-use-system-ca-file by default on deprecated Sync and Async sessions. + Fix including headers in C++ projects. + Fix attempting to resolve relative paths with data URIs. + Support Content-Disposition headers without a disposition-type. + Fix building VAPI bindings with latest Vala. + Fix sending a Content-Length header in a response with status code of 1xx or 204. + Updated translations. - Drop libsoup-fix-SSL-test.patch: fixed upstream. - Rename source package to libsoup2, as a compatibility package while the world moves to libsoup3 (with HTTP/2 support). - Add Provides: libsoup2 to the library, so that the lang package is installable. - Remove the left-over provides/obsoltes for libsoup (which is now libsoup 3). - Add libsoup2-extend-test-cert.patch to fix tests after 2027 (boo#1102840) - Update to version 2.74.1: + Fix support for older versions of Vala. + Fix trying to build sysprof as a subproject on Windows. + Fix missing `extern "C"` in an installed header. + Improve `gssapi` dependency handling. + Fix `libsoup-doc` build target. + Updated translations. - Update to version 2.74.2: + Error when libsoup3 is already loaded before libsoup2. - Add 04df03bc.patch: strictly don't allow NUL bytes in headers (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377). - Add libsoup-CVE-2024-52532.patch: websocket: Process the frame as soon as we read data (boo#1233287 CVE-2024-52532). - Add 29b96fab.patch: websocket-test: disconnect error copy after the test ends (glgo#GNOME/libsoup#391). - Add a35222dd.patch: be more robust against invalid input when parsing params (boo#1233292 CVE-2024-52531 glgo#GNOME/libsoup!407). - Add 4c9e75c6.patch: fix an intermittent test failure (glgo#GNOME/soup#399). - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - update to 1.4.3 compression: add support for zlib@openssh.com Bug fixes: sftp_read: return error if a too large package arrives libssh2_hostkey_hash.3: update the description of return value examples: use stderr for messages, stdout for data openssl: do not leak memory when handling errors improved handling of disabled MD5 algorithm in OpenSSL known_hosts: Fail when parsing unknown keys in known_hosts file configure: gcrypt doesn't come with pkg-config support session_free: wrong variable used for keeping state libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner userauth.c: fread() from public key file to correctly detect any errors configure.ac: Add option to disable build of the example applications Added 'Requires.private:' line to libssh2.pc SFTP: filter off incoming "zombie" responses gettimeofday: no need for a replacement under cygwin SSH_MSG_CHANNEL_REQUEST: default to want_reply win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB build error with gcrypt backend always do "forced" window updates to avoid corner case stalls aes: the init function fails when OpenSSL has AES support transport_send: Finish in-progress key exchange before sending data channel_write: acknowledge transport errors examples/x11.c: Make sure sizeof passed to read operation is correct examples/x11.c:,Fix suspicious sizeof usage sftp_packet_add: verify the packet before accepting it SFTP: preserve the original error code more sftp_packet_read: adjust window size as necessary Use safer snprintf rather then sprintf in several places Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET sftp_write: cannot return acked data *and* EAGAIN sftp_read: avoid data *and* EAGAIN libssh2.h: Add missing prototype for libssh2_session_banner_set() - dropped patches (already in the upstream) 0004-libssh2.h-Add-missing-prototype-for-libssh2_session_.patch 0005-Add-symbol-versioning.patch 0006-missing-libssh2_session_banner_set.patch - Use AC_CONFIG_HEADERS instead of AM_CONFIG_HEADER, fixes build with new automake - fix building on older kernels and older OS / SLE - ignore groff-full to remove factory build cycle - add groff to build requires to make tests passing - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Use AC_CONFIG_HEADERS instead of AM_CONFIG_HEADER, fixes build with new automake - fix building on older kernels and older OS / SLE - ignore groff-full to remove factory build cycle - add groff to build requires to make tests passing - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - fix building on older kernels and older OS / SLE - ignore groff-full to remove factory build cycle - add groff to build requires to make tests passing - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - ignore groff-full to remove factory build cycle - add groff to build requires to make tests passing - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - ignore groff-full to remove factory build cycle - add groff to build requires to make tests passing - update to 1.5.0 * fixes CVE-2015-1782 (bnc#921070) - tarball verification * added libssh2_org.keyring * added libssh2-1.5.0.tar.gz.asc Changes in 1.5.0: Added Windows Cryptography API: Next Generation based backend Bug fixes: Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782 missing _libssh2_error in _libssh2_channel_write knownhost: Fix DSS keys being detected as unknown. knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer. libssh2.h: on Windows, a socket is of type SOCKET, not int libssh2_priv.h: a 1 bit bit-field should be unsigned windows build: do not export externals from static library Fixed two potential use-after-frees of the payload buffer Fixed a few memory leaks in error paths userauth: Fixed an attempt to free from stack on error agent_list_identities: Fixed memory leak on OOM knownhosts: Abort if the hosts buffer is too small sftp_close_handle: ensure the handle is always closed channel_close: Close the channel even in the case of errors docs: added missing libssh2_session_handshake.3 file docs: fixed a bunch of typos userauth_password: pass on the underlying error code _libssh2_channel_forward_cancel: accessed struct after free _libssh2_packet_add: avoid using uninitialized memory _libssh2_channel_forward_cancel: avoid memory leaks on error _libssh2_channel_write: client spins on write when window full windows build: fix build errors publickey_packet_receive: avoid junk in returned pointers channel_receive_window_adjust: store windows size always userauth_hostbased_fromfile: zero assign to avoid uninitialized use configure: change LIBS not LDFLAGS when checking for libs agent_connect_unix: make sure there's a trailing zero MinGW build: Fixed redefine warnings. sftpdir.c: added authentication method detection. Watcom build: added support for WinCNG build. configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS sftp_statvfs: fix for servers not supporting statfvs extension knownhost.c: use LIBSSH2_FREE macro instead of free Fixed compilation using mingw-w64 knownhost.c: fixed that 'key_type_len' may be used uninitialized configure: Display individual crypto backends on separate lines examples on Windows: check for WSAStartup return code examples on Windows: check for socket return code agent.c: check return code of MapViewOfFile kex.c: fix possible NULL pointer de-reference with session->kex packet.c: fix possible NULL pointer de-reference within listen_state tests on Windows: check for WSAStartup return code userauth.c: improve readability and clarity of for-loops examples on Windows: use native SOCKET-type instead of int packet.c: i < 256 was always true and i would overflow to 0 kex.c: make sure mlist is not set to NULL session.c: check return value of session_nonblock in debug mode session.c: check return value of session_nonblock during startup userauth.c: make sure that sp_len is positive and avoid overflows knownhost.c: fix use of uninitialized argument variable wrote openssl: initialise the digest context before calling EVP_DigestInit() libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib configure.ac: Rework crypto library detection configure.ac: Reorder --with-* options in --help output configure.ac: Call zlib zlib and not libz in text but keep option names Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro sftp: seek: Don't flush buffers on same offset sftp: statvfs: Along error path, reset the correct 'state' variable. sftp: Add support for fsync (OpenSSH extension). _libssh2_channel_read: fix data drop when out of window comp_method_zlib_decomp: Improve buffer growing algorithm _libssh2_channel_read: Honour window_size_initial window_size: redid window handling for flow control reasons knownhosts: handle unknown key types - update to 1.6.0 Changes: Added CMake build system Added libssh2_userauth_publickey_frommemory() Bug fixes: wait_socket: wrong use of difftime() userauth: Fixed prompt text no longer being copied to the prompts struct mingw build: allow to pass custom CFLAGS Let mansyntax.sh work regardless of where it is called from Init HMAC_CTX before using it direct_tcpip: Fixed channel write WinCNG: fixed backend breakage OpenSSL: caused by introducing libssh2_hmac_ctx_init userauth.c: fix possible dereferences of a null pointer wincng: Added explicit clear memory feature to WinCNG backend openssl.c: fix possible segfault in case EVP_DigestInit fails wincng: fix return code of libssh2_md5_init() kex: do not ignore failure of libssh2_sha1_init() scp: fix that scp_send may transmit not initialised memory scp.c: improved command length calculation nonblocking examples: fix warning about unused tvdiff on Mac OS X configure: make clear-memory default but WARN if backend unsupported OpenSSL: Enable use of OpenSSL that doesn't have DSA OpenSSL: Use correct no-blowfish #define kex: fix libgcrypt memory leaks of bignum libssh2_channel_open: more detailed error message wincng: fixed memleak in (block) cipher destructor - update to 1.7.0 * Fixes CVE-2016-0787 (boo#967026) * Changes: libssh2_session_set_last_error: Add function mac: Add support for HMAC-SHA-256 and HMAC-SHA-512 WinCNG: support for SHA256/512 HMAC kex: Added diffie-hellman-group-exchange-sha256 support OS/400 crypto library QC3 support * and many bugfixes - Version update to 1.8.0: * support openssl-1.1 * many bugfixes - Fixes bsc#1042660 - Remove obsolete conditionals that are no longer needed - Remove --with-pic which is only for static libs - Drop openssh BuildRequires: this is only used for one of the minor self-tests. - Security fixes: * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport read allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3855.patch * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard interactive handling allows out-of-bounds write with specially crafted payload - libssh2_org-CVE-2019-3856.patch * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to zero-byte allocation and out-of-bounds with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3857.patch * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading to an out-of-bounds read with a specially crafted SFTP packet - libssh2_org-CVE-2019-3858.patch * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially crafted payloads due to unchecked use of _libssh2_packet_require and _libssh2_packet_requirev - libssh2_org-CVE-2019-3859.patch * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially crafted SFTP packets - libssh2_org-CVE-2019-3860.patch * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially crafted SSH packets - libssh2_org-CVE-2019-3861.patch * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with specially crafted message channel request SSH packet - libssh2_org-CVE-2019-3862.patch * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate keyboard interactive allows out-of-bounds writes with specially crafted keyboard responses - libssh2_org-CVE-2019-3863.patch - Version update to 1.8.2: [bsc#1130103] Bug fixes: * Fixed the misapplied userauth patch that broke 1.8.1 * moved the MAX size declarations from the public header - Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103] - Added libssh2_org-CVE-2019-3859-fix.patch - Security fix: [bsc#1154862, CVE-2019-17498] * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in a bounds check that might lead to disclose sensitive information or cause a denial of service * Add patch libssh2_org-CVE-2019-17498.patch - Drop man and groff BuildRequires: both are no longer used in current versions. - Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922] Enhancements and bugfixes: * adds ECDSA keys and host key support when using OpenSSL * adds ED25519 key and host key support when using OpenSSL 1.1.1 * adds OpenSSH style key file reading * adds AES CTR mode support when using WinCNG * adds PEM passphrase protected file support for Libgcrypt and WinCNG * adds SHA256 hostkey fingerprint * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path() * adds explicit zeroing of sensitive data in memory * adds additional bounds checks to network buffer reads * adds the ability to use the server default permissions when creating sftp directories * adds support for building with OpenSSL no engine flag * adds support for building with LibreSSL * increased sftp packet size to 256k * fixed oversized packet handling in sftp * fixed building with OpenSSL 1.1 * fixed a possible crash if sftp stat gets an unexpected response * fixed incorrect parsing of the KEX preference string value * fixed conditional RSA and AES-CTR support * fixed a small memory leak during the key exchange process * fixed a possible memory leak of the ssh banner string * fixed various small memory leaks in the backends * fixed possible out of bounds read when parsing public keys from the server * fixed possible out of bounds read when parsing invalid PEM files * no longer null terminates the scp remote exec command * now handle errors when diffie hellman key pair generation fails * improved building instructions * improved unit tests - Rebased patches: * libssh2-ocloexec.patch * libssh2_org-CVE-2019-17498.patch - Remove patches fixed in this version: libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch - Bump to version 1.10.0 Enhancements and bugfixes: * support ECDSA certificate authentication * fix detailed _libssh2_error being overwritten by generic errors * unified error handling * fix _libssh2_random() silently discarding errors * don't error if using keys without RSA * avoid OpenSSL latent error in FIPS mode * fix EVP_Cipher interface change in openssl 3 * fix potential overwrite of buffer when reading stdout of command * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data * correct a typo which may lead to stack overflow * fix random big number generation to match openssl * added key exchange group16-sha512 and group18-sha512. * add support for an OSS Fuzzer fuzzing target * adds support for ECDSA for both key exchange and host key algorithms * clean up curve25519 code * update the min, preferred and max DH group values based on RFC 8270. * changed type of LIBSSH2_FX_* constants to unsigned long * added diffie-hellman-group14-sha256 kex * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x. * fixes crash with delayed compression option using Bitvise server. * adds support for PKIX key reading * use new API to parse data in packet_x11_open() for better bounds checking. * double the static buffer size when reading and writing known hosts * improved bounds checking in packet_queue_listener * improve message parsing (CVE-2019-17498) * improve bounds checking in kex_agree_methods() * adding SSH agent forwarding. * fix agent forwarding message, updated example. * added integration test code and cmake target. Added example to cmake list. * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero. * add an EWOULDBLOCK check for better portability * fix off by one error when loading public keys with no id * fix use-after-free crash on reinitialization of openssl backend * preserve error info from agent_list_identities() * make sure the error code is set in _libssh2_channel_open() * fixed misspellings * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type` * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type - Rebased patch libssh2-ocloexec.path - Removed patch libssh2_org-CVE-2019-17498.patch: the security fix is already included in the latest version. - Update to 1.11.0: * Enhancements and bugfixes - Adds support for encrypt-then-mac (ETM) MACs - Adds support for AES-GCM crypto protocols - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys - Adds support for RSA certificate authentication - Adds FIDO support with *_sk() functions - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends - Adds Agent Forwarding and libssh2_agent_sign() - Adds support for Channel Signal message libssh2_channel_signal_ex() - Adds support to get the user auth banner message libssh2_userauth_banner() - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519, AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex() - Adds wolfSSL support to CMake file - Adds mbedTLS 3.x support - Adds LibreSSL 3.5 support - Adds support for CMake "unity" builds - Adds CMake support for building shared and static libs in a single pass - Adds symbol hiding support to CMake - Adds support for libssh2.rc for all build tools - Adds .zip, .tar.xz and .tar.bz2 release tarballs - Enables ed25519 key support for LibreSSL 3.7.0 or higher - Improves OpenSSL 1.1 and 3 compatibility - Now requires OpenSSL 1.0.2 or newer - Now requires CMake 3.1 or newer - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs - SFTP: No longer has a packet limit when reading a directory - SFTP: now parses attribute extensions if they exist - SFTP: no longer will busy loop if SFTP fails to initialize - SFTP: now clear various errors as expected - SFTP: no longer skips files if the line buffer is too small - SCP: add option to not quote paths - SCP: Enables 64-bit offset support unconditionally - Now skips leading \r and \n characters in banner_receive() - Enables secure memory zeroing with all build tools on all platforms - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive - Speed up base64 encoding by 7x - Assert if there is an attempt to write a value that is too large - WinCNG: fix memory leak in _libssh2_dh_secret() - Added protection against possible null pointer dereferences - Agent now handles overly large comment lengths - Now ensure KEX replies don't include extra bytes - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER - Fixed possible buffer overflow in keyboard interactive code path - Fixed overlapping memcpy() - Fixed Windows UWP builds - Fixed DLL import name - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows - Support for building with gcc versions older than 8 - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files - Restores ANSI C89 compliance - Enabled new compiler warnings and fixed/silenced them - Improved error messages - Now uses CIFuzz - Numerous minor code improvements - Improvements to CI builds - Improvements to unit tests - Improvements to doc files - Improvements to example files - Removed "old gex" build option - Removed no-encryption/no-mac builds - Removed support for NetWare and Watcom wmake build files * Rebase libssh2-ocloexec.patch - Security fix: [bsc#1214527, CVE-2020-22218] * The function _libssh2_packet_add() allows to access out of bounds memory. * Add libssh2_org-CVE-2020-22218.patch - Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040] * Add the keyring file: libssh2_org.keyring * Rebase libssh2-ocloexec.patch * Remove libssh2_org-CVE-2020-22218.patch - Security fix: [bsc#1218127, CVE-2023-48795] * Add 'strict KEX' to fix CVE-2023-48795 "Terrapin Attack" * Add libssh2_org-CVE-2023-48795.patch - Always add the KEX pseudo-methods "ext-info-c" and "kex-strict-c-v00@openssh.com" when configuring custom method list. [bsc#1218971, CVE-2023-48795] * The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically. * Add libssh2_org-CVE-2023-48795-ext.patch - Fix an issue with Encrypt-then-MAC family. [bsc#1221622] * Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331. * Add libssh2_org-ETM-remote.patch - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.5 * Added support to get known_hosts locations with ssh_options_get() * Fixed preferred algorithm for known hosts negotiations * Fixed KEX with some server implementations (e.g. Cisco) * Fixed issues with MSVC * Fixed keyboard-interactive auth in server mode (regression from CVE-2018-10933) * Fixed gssapi auth in server mode (regression from CVE-2018-10933) * Fixed socket fd handling with proxy command * Fixed a memory leak with OpenSSL - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - Update to version 0.8.6 * Fixed compilation issues with different OpenSSL versions * Fixed StrictHostKeyChecking in new knownhosts API * Fixed ssh_send_keepalive() with packet filter * Fixed possible crash with knownhosts options * Fixed issus with rekeying * Fixed strong ECDSA keys * Fixed some issues with rsa-sha2 extentions * Fixed access violation in ssh_init() (static linking) * Fixed ssh_channel_close() handling - Added the tests in a multiple build description file *test* to break the cycle for cmocka, curl, doxygen and libssh. - Drop doxygen from dependencies to avoid buildcycle * the documentation is available online anyway for anyone to consume and consult http://api.libssh.org - Update to version 0.8.7 * Fixed handling extension flags in the server implementation * Fixed exporting ed25519 private keys * Fixed corner cases for rsa-sha2 signatures * Fixed some issues with connector - Avoid build cycle between curl and libssh by using obs hint to prefer curl-mini - Add support for new AES-GCM encryption types; (bsc#1134193) * Add 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch * Add 0001-tests-Add-aes-gcm-ciphers-tests.patch - Fix the typo in Obsoletes for -devel-doc subpackage - Actually remove the description for -devel-doc subpackage - Update to verion 0.9.0 * Added support for AES-GCM * Added improved rekeying support * Added performance improvements * Disabled blowfish support by default * Fixed several ssh config parsing issues * Added support for DH Group Exchange KEX * Added support for Encrypt-then-MAC mode * Added support for parsing server side configuration file * Added support for ECDSA/Ed25519 certificates * Added FIPS 140-2 compatibility * Improved known_hosts parsing * Improved documentation * Improved OpenSSL API usage for KEX, DH, and signatures - Removed 0001-libcrypto-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-libgcrypt-Implement-OpenSSH-compatible-AES-GCM-ciphe.patch - Removed 0001-tests-Add-aes-gcm-ciphers-tests.patch - Add libssh client and server config files - Split out configuration to separate package to not mess up the library packaging and coinstallation - Update to version 0.9.1 * Added support for Ed25519 via OpenSSL * Added support for X25519 via OpenSSL * Added support for localuser in Match keyword * Fixed Match keyword to be case sensitive * Fixed compilation with LibreSSL * Fixed error report of channel open (T75) * Fixed sftp documentation (T137) * Fixed known_hosts parsing (T156) * Fixed build issue with MinGW (T157) * Fixed build with gcc 9 (T164) * Fixed deprecation issues (T165) * Fixed known_hosts directory creation (T166) - Update to version 0.9.2 * Fixed libssh-config.cmake * Fixed issues with rsa algorithm negotiation (T191) * Fixed detection of OpenSSL ed25519 support (T197) - Rename suffix define to pkg_suffix: rpm 4.15 has suffix reserved for internal use. - Update to version 0.9.3 * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state * SSH-01-006 General: Various unchecked Null-derefs cause DOS * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys * SSH-01-010 SSH: Deprecated hash function in fingerprinting * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access * SSH-01-001 State Machine: Initial machine states should be set explicitly * SSH-01-002 Kex: Differently bound macros used to iterate same array * SSH-01-005 Code-Quality: Integer sign confusion during assignments * SSH-01-008 SCP: Protocol Injection via unescaped File Names * SSH-01-009 SSH: Update documentation which RFCs are implemented * SSH-01-012 PKI: Information leak via uninitialized stack buffer - Drop the hack to pull curl-mini: we moved the split a bit higher up and now have a non-curl linked variant of cmake in openSUSE:Factory. - Update to version 0.9.4 * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ * Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) - update to 0.9.5 (bsc#1174713, CVE-2020-16135): * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) * Improve handling of library initialization (T222) * Fix parsing of subsecond times in SFTP (T219) * Make the documentation reproducible * Remove deprecated API usage in OpenSSL * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN * Define version in one place (T226) * Prevent invalid free when using different C runtimes than OpenSSL (T229) * Compatibility improvements to testsuite - Add missing BR for openssh needed for tests - Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 - Update to version 0.9.8 * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) * Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) * Fix several memory leaks in GSSAPI handling code - Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385) * Added libssh-fix-ipv6-hostname-regression.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Use --enable-link-serialization rather that --enable-link-mutex, the benefit of the former one is that the linker jobs are not holding tokens of the make's jobserver. - Add %limit_build for gcc13 to avoid OOM - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995. - riscv-atomic.patch: RISC-V: Add support for inlining subword atomic operations - riscv-pthread.patch: Don't add -latomic with -pthread - Add new x86-related intrinsics (amxcomplexintrin.h). - Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162. - Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231. * fixes compile-time issue reported in [bsc#1210557] * GCC 13.1 RC3 - Disable building the rust frontend. - Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256. * Includes GCC 13.1 release and first bugfixes - Update riscv-atomic.patch from the version committed upstream. - Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364. * Includes the RISC-V atomic changes - Remove riscv-atomic.patch and riscv-pthread.patch now included - Make libstdc++6-devel packages own their directories since they can be installed standalone. [bsc#1211427] - Raise architecture levels for ALP. [PED-153] * Raise POWER architecture baseline to power9. [PED-2005] * Raise x86-64 architecture baseline to x86-64-v2 for ALP. [PED-252] * Delay raising s390x architecture baseline to z14. [PED-253] - Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489. - Add gcc13-pr110334.patch to fix missed optimization in Skia resulting in Firefox crashes when building with LTO. [boo#1212101] - Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552 - Remove gcc13-pr110334.patch again as it breaks libreoffice build. - Also handle -static-pie in the default-PIE specs - Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597 * GCC 13.2 RC1 - Add rpmlint filter for SLE12 complaining about invalid licenses. - gdcflags.patch: Use substituted GDCFLAGS - Filter out -Werror=return-type from D compile flags - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683 * Includes GCC 13.2 release * Includes patch to fix broken testcase in libbacktrace, fixing build problems on SLES 12 - Raise Power architecture baseline to Power9 only for ALP (boo#1213915). - Turn cross compiler to s390x to a glibc cross. [bsc#1214460] - Disable building glibc cross compilers on SLE based code streams, the required cross-glibc packages are not available there. - Disable building avr cross on non-openSUSE code streams since avr-libc isn't available there. - Disable building newlib cross compilers on non-openSUSE code streams since newlib isn't available there. - Fix typo preventing s390x compiler build. - Raise s390x architecture baseline to z14 for ALP. [PED-253] - Turn cross compiler to ppc64le to a glibc cross. - Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831 * Includes many bugfixes * Includes fix to -fstack-protector issues with variable length stack allocations on aarch64. [bsc#1214052] (CVE-2023-4039) - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - add pr111411.patch (bsc#1215427) - Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during C++ standard library initialization. [bsc#1216664] - Avoid update-alternatives dependency for accelerator crosses. - Package tool links to llvm in cross-amdgcn-gcc13 rather than in cross-amdgcn-newlib13-devel since that also has the dependence. - Depend on llvmVER instead of llvm with VER equal to %product_libs_llvm_ver where available and adjust tool discovery accordingly. This should also properly trigger re-builds when the patchlevel version of llvmVER changes, possibly changing the binary names we link to. [bsc#1217450] - Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109 * Includes fix for building mariadb on i686. [bsc#1217667] * Remove pr111411.patch contained in the update. - Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205 - Package m2rte.so plugin in the gcc13-m2 sub-package rather than in gcc13-devel. [boo#1210959] - Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs are linked against libstdc++6. - Add cross-X-newlib-devel requires to newlib cross compilers. [boo#1219031] - Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250 * Includes fix for building TVM. [boo#1218492] - Use %{_target_cpu} to determine host and build. - Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285 - Add gcc13-pr88345-min-func-alignment.diff to add support for - fmin-function-alignment. [bsc#1214934] - Add gcc13-sanitizer-remove-crypt-interception.patch to remove crypt and crypt_r interceptors. The crypt API change in SLE15 SP3 breaks them. [bsc#1219520] - Use %patch -P N instead of %patchN. - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Revert libgccjit dependency change. [boo#1220724] - Add gcc13-pr111731.patch to fix unwinding for JIT code. [bsc#1221239] - Make requirement to lld version specific to avoid requiring the meta-package. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from the GCN offload compiler as that is requiring Code Object version 3 which is no longer supported by llvm18. - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761 - Removed gcc13-pr111731.patch now included upstream - Update to GCC 13.3 release - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Update to trunk head, b702dc980215074a06535e3aa52a766bef, git8486 - Refresh gcc7-remove-Wexpansion-to-defined-from-Wextra.patch - Up requirement to llvm15 when building GCN offload compiler, needed for gfx1100 support. - Remove obsolete gcc11-amdgcn-disable-hot-cold-partitioning.patch and gcc10-amdgcn-llvm-as.patch patches. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Use %{_target_cpu} to determine host and build. - Update to trunk head, c5d34912ad576be1ef19be92f7eabde54b, git8817 * bumps libgo SONAME - Update to trunk head, 5c3ba60024fedc6b3d374ebb071bcf5b3e, git8840 - Disable epiphany cross compiler since it fails building. - Update to trunk head, 4a1cd5560b9b545eb848eb1d1e06d345fb, git8957 * bumps libgphobos and libgdrundime SONAME - Use %patch -P N instead of %patchN - Refresh gcc44-rename-info-files.patch - Fix libgccjit-devel dependency, a newer shared library is OK. - Fix libgccjit dependency, the corresponding compiler isn't required. - Update to trunk head, b209d905f5ce1fa9d76ce634fd54245ff3, git9355 - Revert libgccjit dependency change. [boo#1220724] - Remove timezone Recommends from the libstdc++6 package. [boo#1221601] - Add newlib-gcn-iolock.diff to fix locking for I/O on gcn offload targets. - Update to trunk head, 0b02da5b99e89347f5f8bf875ec8318f84, git9687 - Fix install link to amdgcn-amdhsa-ld. - Add gcc13-pr101523.patch to avoid combine spending too much compile-time and memory doing nothing on s390x. [boo#1188441] - Update to trunk head, 109f1b28fc94c93096506e3df0c25e331, git9885 - Package Modula-2 info files. - Install/Remove Modula-2 and D info files. - Update to trunk head, 7c2a9dbcc2c1cb1563774068c59d5e09e, git10008 - Update to gcc-14 branch head, 7a00c459cbb913ac165a39d34, git10154 * GCC 14.1 RC1 - Update to GCC 14.1 release. - Update to gcc-14 branch head, 272e8c90af527fc1d0055ad0f, git10335 * picks first batch of post-release fixes - Update to gcc-14 branch head, a544898f6dd6a1689bb25abfd, git10504 * GCC 14.2 release candidate. - Update to GCC 14.2.0 release, c035a7c30c310ff928988cbcf, git10526 - Add libquadmath0-devel-gcc14 sub-package to allow installing quadmath.h and SO link without installing the fortran frontend - Drop SLE11 compatibility %selfconflict wrapper, drop various conditions gating SLE11 build support - Re-enable cross compiler builds on i586. - Add gcc14-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657] - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - asan_build: build ASAN included - debug_build: build more suitable for debugging - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - asan_build: build ASAN included - debug_build: build more suitable for debugging - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - asan_build: build ASAN included - debug_build: build more suitable for debugging - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update: * CVE-2024-7006 [bsc#1228924] Fix pointer deref in tif_dirinfo.c + tiff-CVE-2024-7006.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update: * CVE-2024-7006 [bsc#1228924] Fix pointer deref in tif_dirinfo.c + tiff-CVE-2024-7006.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update: * CVE-2024-7006 [bsc#1228924] Fix pointer deref in tif_dirinfo.c + tiff-CVE-2024-7006.patch - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Use %license (boo#1082318) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - Adjust include directory [bsc#1083902] - Update to libtirpc 1.0.3 - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429) - Avoid choosing reserved ports in legacy RPC APIs - rpcinfo: change order of version to be tried to 4, 3, 2 - includes 003-rpc-types.patch - includes 004-replace-bzero-with-memset.patch - includes 005-missing-includes.patch - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch - includes decls.patch - Drop COPYING.GPLv2, GPLv2 code was removed from library - Remove ineffective --with-pic. - Revert binddynport changes as they break backward compatibility [brc#1562169]. - add 002-revert-binddynport.patch - fix socket leak introduced by change-rpc-protocol-version-order patch (bsc#1087925) - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch - Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096). - Add upstream patch 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release) - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect upstream changes after 1.1.4 release - remove /etc/bindresvport.blacklist as it's still supported by glibc although it's not compiled with --enable-obsolete-rpc - Drop patches accepted in previous releases or not needed - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4) - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory) - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1) - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch (backport of 25d38d7, libtirpc-1-0-4-rc1) - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch (backport of 145272c, libtirpc-1-0-4-rc2) - Add fixes from upcomming release - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch - Fix previous version: - actually delete 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch) - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch (renamed from 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Update to libtirpc 1.2.5 - A number resource leaks and other issues were fix which were identified by a Coverity Scan. - The AUTH_DES authentication has been deprecated. If any of those routines are called, they will fail immediately. - numerous bug fixes - Package changes: - Build without AUTH_DES authentication - Add patch from next release 0001-Add-authdes_seccreate-stub.patch (a86b4ff Add authdes_seccreate() stub) - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch) - Drop patches all patches backported from this release (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch, 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch, 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch) - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Update to libtirpc 1.2.6 - Drop patches all patches backported from this release (0001-Add-authdes_seccreate-stub.patch, 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch) - add option to enforce connection via protocol version 2 first (bsc#1196647) add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - check for nullpointer in check_address (bsc#1198176) update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix memory leak in params.r_addr assignement (bsc#1198752) - add 0001-fix-parms.r_addr-memory-leak.patch -exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch - consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding to a random port (bsc#1199467) - add binddynport-honor-ip_local_reserved_ports.patch - update to 1.3.4 (bsc#1199467) * binddynport.c honor ip_local_reserved_ports - replaces: binddynport-honor-ip_local_reserved_ports.patch * gss-api: expose gss major/minor error in authgss_refresh() * rpcb_clnt.c: Eliminate double frees in delete_cache() * rpcb_clnt.c: memory leak in destroy_addr * portmapper: allow TCP-only portmapper * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep * clnt_raw.c: fix a possible null pointer dereference * bindresvport.c: fix a potential resource leakage - update to 1.3.3 (bsc#1201680, CVE-2021-46828): * Fix DoS vulnerability in libtirpc - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch * _rpc_dtablesize: use portable system call * libtirpc: Fix use-after-free accessing the error number * Fix potential memory leak of parms.r_addr - replaces 0001-fix-parms.r_addr-memory-leak.patch * rpcb_clnt.c add mechanism to try v2 protocol first - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch * Eliminate deadlocks in connects with an MT environment * clnt_dg_freeres() uncleared set active state may deadlock * thread safe clnt destruction * SUNRPC: mutexed access blacklist_read state variable * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c - drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream) - update to 1.3.2: * Replace the final SunRPC licenses with BSD licenses * blacklist: Add a few more well known ports * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS - Update to libtirpc 1.3.1 * Remove AUTH_DES interfaces from auth_des.h The unsupported AUTH_DES authentication has be compiled out since commit d918e41d889 (Wed Oct 9 2019) replaced by API routines that return errors. * svc_dg: Free xp_netid during destroy * Fix memory management issues of fd locks * libtirpc: replace array with list for per-fd locks * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf * __rpc_dtbsize: rlim_cur instead of rlim_max * pkg-config: use the correct replacements for libdir/includedir Patches replaced by update: binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467) 0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680) 0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752) 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch (bsc#1196647), (bsc#1200800), (bsc#1198176) * replaces /etc/netconfig-try-2-first by the environment variable RPCB_V2FIRST - fix sed parsing for libtirpc.pc.in in specfile (boo#1216862) - update to 2.4.2: - The generic approximation of the command line length limit (when getconf is not available) works again. Regression introduced in v2.2.6-39-g9c3d4d8. - The bug that leaked developer tool paths into the release tarballs from ./bootstrap is fixed. - Improved support for the Cuda Compiler Driver (nvcc) on Darwin. - For GCC LTO support, the -fuse-linker-plugin switch is now also removed when computing compiler postdeps. - The undocumented hardcode_libdir_flag_spec_ld tag variable has been removed in favor of using hardcode_libdir_flag_spec with $wl set to empty. - buildrequire automake for file list check - buildrequire makeinfo which is a seperate package now. - Add config-guess-sub-update.patch: Update config.guess/sub for aarch64 - Change License as described in bnc#818958. - Add libtool-ppc64le.patch to fix libtool-testsuite tests - install COPYING as %doc - Drop patch config-guess-sub-update.patch for libltdl/config as the folder no longer exists. - Drop patch libtool-ppc64le.patch for ppc handling as it is already part of v2.4.3 - Update to libtool 2.4.3 * * New features: - Moved to gnulib release infrastructure. - M4 is now used for scanning the M4 macros in your configure.ac that 'libtoolize' looks at to determine what files you want, and where you would like them installed. This means that you can compose your version number or any other argument that Libtoolize needs to know at M4 time using git-version-gen from gnulib, for example. - Invoking 'libtoolize --ltdl' no longer maintains a separate autoconf macro directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever macro directory is declared by the parent project. (Note: if you were already sharing a macro directory with AC_CONFIG_MACRO_DIR(ltdl/m4) or similar, that still works as does any other directory choice). - Invoking 'libtoolize --ltdl' no longer maintains a separate auxiliary scripts directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever auxiliary scripts directory is declared by the parent project. (Note: if you were already sharing an auxiliary directory with subproject libltdl using AC_CONFIG_AUX_DIR(ltdl/config) or similar, that still works as does any other directory choice). - The legacy tests have all been migrated to the Autotest harness. - The Autotest testsuite can be run without the especially time consuming tests with: make check-local TESTSUITEFLAGS='-k "!expensive"' * * Bug fixes: - Fix a long-standing latent bug in autom4te include path for autotests with VPATH builds. - Fix a long-standing latent bug in libtoolize that could delete lines from libltdl/Makefile.am in recursive mode due to underquoting in a sed script. - Fix a long-standing bug in libtoolize, by outputting the 'putting auxiliary files in' header with 'libtoolize --ltdl --subproject'. - Fix a long-standing bug in libtoolize subproject installation, by not installing a set of autoconf macro files into the parent project if there is no configure.ac present to use them. - The libtoolize subproject mode selector is now named '--subproject' and is equivalent to the implied '--subproject' mode when no other mode is selected; '--standalone' never worked, and is no longer accepted. - Libtool and libtoolize no longer choke on paths with a comma in them. - In the case where $SHELL does not have the same enhanced features (e.g. the ability to parse 'var+=append') as $CONFIG_SHELL, libtool will now correctly fallback to using only vanilla shell features instead of failing with a parse at startup. - Correctly recognize import libraries when Microsoft dumpbin is used as the name lister and extend the dumpbin wrapper to find symbols in import libraries using the -headers option of dumpbin. Also fix a bug in the dumpbin wrapper that could lead to broken symbol listings in some corner cases. - Use the improved Microsoft dumpbin support to mend preloading of import libraries for Microsoft Visual C/C++. - No longer mangle module-definition (.def) files when feeding them to the Microsoft Visual C/C++ linker via the -export-symbols argument to the libtool script, thus matching how .def files are handled when using GNU tools. - Recognize more variants (e.g. those starting with a LIBRARY statement) of module-definitions (.def) files when using them instead of a raw list of symbols to export. - Fix a long-standing bug when using libtoolize without automake; we no longer remove install-sh with --force, since it's not a file libtoolize will reinstall without --install.. * * Important incompatible changes: - GNU M4 is required to run libtoolize in a directory with a 'configure.ac' (or 'configure.in') that needs tracing to determine what modes and directories have been specified. - The use of the idiosyncratically named 'Makefile.inc' in nonrecursive libltdl builds is deprecated, although it will be supported for one more year or until the next release, whichever takes longer. Please upgrade to the more standard naming of 'ltdl.mk' in keeping with other GNU projects. - libtoolize now behaves consistenty in respect of multiple directory arguments to ACLOCAL_AMFLAGS and multiple invocations of AC_CONFIG- _MACRO_DIRS, where the first directory is always selected. Previous releases took the first ACLOCAL_AMFLAGS argument, but the last invocation of AC_CONFIG_MACRO_DIRS. - The libtoolize program now advises use of the new Autoconf AC_CONFIG_MACRO_DIRS declaration. If you follow that advice, all your developers will need at least autoconf-2.70 and automake-1.13 to rebootstrap your probject. If you still need to support bootstrap with older Autotools, then you should add the following to your configure.ac file: m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_define([AC_CONFIG_MACRO_DIRS], m4_defn([AC_CONFIG_MACRO_DIR]))]) - Overhead of probing for a non-backslash crippled echo equivalent during initialization of every script has been removed in favor of trusting that "printf %s\n" works out of the box on all non-museum host architectures. Manually setting ECHO appropriately in the build environment will be necessary on some ancient architectures. * * Changes in supported systems or compilers: - Support for bitrig (*-*-bitrig*). - Solaris 7 and earlier requires ECHO=/usr/ucb/echo in the build environment, to build and use libtool. - Add libtool-dont_delete_gnulib_files.patch that prevents deletion of files from gnulib to be deleted by libtoolize. - BuildRequire help2man. - Remove unneeded clean section. - Use rpm macros where possible. - Pass V=1 to make to make compilation verbose. - - Drop patch libtool-dont_delete_gnulib_files.patch which is included in 2.4.4 - Update to libtool 2.4.4 * * New features: - Libltdl maintains its own fork of argz, with macros and files in the LT_ and lt__ namespaces (resp.) where they cannot clash with client projects' use of gnulib argz. * * Bug fixes: - Installation of 'libtoolize' once again obeys '--program-prefix', '--program-suffix' and '--program-transform-name' configure options. - `libtoolize` doesn't remove any files that it can't reinstall, including old versions of the snippet directory, and gnulib's version of the argz module and supporting files. - LT_FUNC_DLYSM_USCORE now works correctly on systems that don't support self dlopen()ing. * * Important incompatible changes: - LT_LIB_DLLOAD no longer prepends -ldl or -ldld to LIBS, causing duplicate occurrences in libltdl link lines. If you need to add a library for dlopen() or shl_load() in your Makefile, then use $(LIBADD_DLOPEN) or $(LIBADD_SHL_LOAD) respectively. If you are using libltdl, this all happens automatically, and the only difference you'll see is no more duplicated library names in the verbose link line. * * Changes in supported systems or compilers: - Preliminary support for tcc on linux*. Although it already worked sometimes in previous releases, making sure to set LD correctly now avoids mis-matching GNU ld with tcc: ./configure CC=tcc LD=tcc - Added -os2dllname option to work around 8 character base name limit on OS/2. The option has no effect on other systems. - Support for DLL versioning, -export-symbols and -export-symbols-regex on OS/2. - Support filename-based shared library versioning on AIX. See manual for details. - Require M4 as libtool's libtoolize requires it since 2.4.3 - Update to libtool 2.4.5 New features: - Libtoolize searches for the best available M4 on the user PATH at runtime, rather than settling for the first one found. - Support munging sys_lib_dlsearch_path_spec with LT_SYS_LIBRARY_PATH environment variable. Bug fixes: - Bail out at configure time if the installed M4 is not sufficient for the purposes of libtoolize. - freebsd-elf library versioning was upgraded incorrectly in 2.4.4, but now works properly again. - Fix a 2.4.4 regression so that libltdl subprojects do not warn about missing libltdl/libltdl directory as in prior releases. - When using Sun C++ on Solaris or GNU/Linux we used to set libtool's postdeps permanently, based on the contents of $CXX and $CXXFLAGS at configure time, which was brittle and error-prone. Now, we no longer check for a SunCC ABI at configure time, but augment the postdeps at libtool time based on the current invocation flags on each call. Changes in supported systems or compilers: - /usr/local prefixed rpaths are now added to the link-line on ia64-hp-hpux*, because the default system runtime loader path does not contain them. - Previously, when using Sun C++ on Solaris or GNU/Linux, `-Cstd -Crun` flags were added to $postdeps unless CXX or CXXFLAGS contained `-library=stlport4`. Newer releases have added other compiler flags that are also incompatible with `-Cstd -Crun`, so now we don't add them if any of `-std=c++[0-9][0-9]`, `-library=stdcxx4` or `-compat=g` were found in CXX or CXXFLAGS when the Sun C++ compiler is detected. - Add libtool-no_host_name.patch to remove the host name from generated scripts (bnc#916268). - Update to 2.4.6: Noteworthy changes in release 2.4.6 (2015-02-15) [stable] * New features: - LT_SYS_LIBRARY_PATH can be set in config.site, or at configure time and persists correctly in the generated libtool script. * Bug fixes: - Fix a race condition in ltdl dryrun test that would cause spurious random failures of that test. - LT_SYS_DLSEARCH_PATH is munged correctly. - Add tarball signature. - Use url for signature - Add keyring file for automatic verification of signature - Cleanup spec file with spec-cleaner - Remove old ppc/ppc64 obsolete/provides - Update info pre/post requires and replace postun with preun - Remove empty entry. - Fix call of install_info. - Remove spurious install_info_delete in postun (bsc#940773). - Fix install_info_{install,delete} usage: install-info does not allow file globbing. - update to 2.4.2: - The generic approximation of the command line length limit (when getconf is not available) works again. Regression introduced in v2.2.6-39-g9c3d4d8. - The bug that leaked developer tool paths into the release tarballs from ./bootstrap is fixed. - Improved support for the Cuda Compiler Driver (nvcc) on Darwin. - For GCC LTO support, the -fuse-linker-plugin switch is now also removed when computing compiler postdeps. - The undocumented hardcode_libdir_flag_spec_ld tag variable has been removed in favor of using hardcode_libdir_flag_spec with $wl set to empty. - buildrequire automake for file list check - buildrequire makeinfo which is a seperate package now. - Add config-guess-sub-update.patch: Update config.guess/sub for aarch64 - Change License as described in bnc#818958. - Add libtool-ppc64le.patch to fix libtool-testsuite tests - install COPYING as %doc - Drop patch config-guess-sub-update.patch for libltdl/config as the folder no longer exists. - Drop patch libtool-ppc64le.patch for ppc handling as it is already part of v2.4.3 - Update to libtool 2.4.3 * * New features: - Moved to gnulib release infrastructure. - M4 is now used for scanning the M4 macros in your configure.ac that 'libtoolize' looks at to determine what files you want, and where you would like them installed. This means that you can compose your version number or any other argument that Libtoolize needs to know at M4 time using git-version-gen from gnulib, for example. - Invoking 'libtoolize --ltdl' no longer maintains a separate autoconf macro directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever macro directory is declared by the parent project. (Note: if you were already sharing a macro directory with AC_CONFIG_MACRO_DIR(ltdl/m4) or similar, that still works as does any other directory choice). - Invoking 'libtoolize --ltdl' no longer maintains a separate auxiliary scripts directory in the libltdl tree, but automatically adjusts the installed libltdl configuration files to share whatever auxiliary scripts directory is declared by the parent project. (Note: if you were already sharing an auxiliary directory with subproject libltdl using AC_CONFIG_AUX_DIR(ltdl/config) or similar, that still works as does any other directory choice). - The legacy tests have all been migrated to the Autotest harness. - The Autotest testsuite can be run without the especially time consuming tests with: make check-local TESTSUITEFLAGS='-k "!expensive"' * * Bug fixes: - Fix a long-standing latent bug in autom4te include path for autotests with VPATH builds. - Fix a long-standing latent bug in libtoolize that could delete lines from libltdl/Makefile.am in recursive mode due to underquoting in a sed script. - Fix a long-standing bug in libtoolize, by outputting the 'putting auxiliary files in' header with 'libtoolize --ltdl --subproject'. - Fix a long-standing bug in libtoolize subproject installation, by not installing a set of autoconf macro files into the parent project if there is no configure.ac present to use them. - The libtoolize subproject mode selector is now named '--subproject' and is equivalent to the implied '--subproject' mode when no other mode is selected; '--standalone' never worked, and is no longer accepted. - Libtool and libtoolize no longer choke on paths with a comma in them. - In the case where $SHELL does not have the same enhanced features (e.g. the ability to parse 'var+=append') as $CONFIG_SHELL, libtool will now correctly fallback to using only vanilla shell features instead of failing with a parse at startup. - Correctly recognize import libraries when Microsoft dumpbin is used as the name lister and extend the dumpbin wrapper to find symbols in import libraries using the -headers option of dumpbin. Also fix a bug in the dumpbin wrapper that could lead to broken symbol listings in some corner cases. - Use the improved Microsoft dumpbin support to mend preloading of import libraries for Microsoft Visual C/C++. - No longer mangle module-definition (.def) files when feeding them to the Microsoft Visual C/C++ linker via the -export-symbols argument to the libtool script, thus matching how .def files are handled when using GNU tools. - Recognize more variants (e.g. those starting with a LIBRARY statement) of module-definitions (.def) files when using them instead of a raw list of symbols to export. - Fix a long-standing bug when using libtoolize without automake; we no longer remove install-sh with --force, since it's not a file libtoolize will reinstall without --install.. * * Important incompatible changes: - GNU M4 is required to run libtoolize in a directory with a 'configure.ac' (or 'configure.in') that needs tracing to determine what modes and directories have been specified. - The use of the idiosyncratically named 'Makefile.inc' in nonrecursive libltdl builds is deprecated, although it will be supported for one more year or until the next release, whichever takes longer. Please upgrade to the more standard naming of 'ltdl.mk' in keeping with other GNU projects. - libtoolize now behaves consistenty in respect of multiple directory arguments to ACLOCAL_AMFLAGS and multiple invocations of AC_CONFIG- _MACRO_DIRS, where the first directory is always selected. Previous releases took the first ACLOCAL_AMFLAGS argument, but the last invocation of AC_CONFIG_MACRO_DIRS. - The libtoolize program now advises use of the new Autoconf AC_CONFIG_MACRO_DIRS declaration. If you follow that advice, all your developers will need at least autoconf-2.70 and automake-1.13 to rebootstrap your probject. If you still need to support bootstrap with older Autotools, then you should add the following to your configure.ac file: m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_define([AC_CONFIG_MACRO_DIRS], m4_defn([AC_CONFIG_MACRO_DIR]))]) - Overhead of probing for a non-backslash crippled echo equivalent during initialization of every script has been removed in favor of trusting that "printf %s\n" works out of the box on all non-museum host architectures. Manually setting ECHO appropriately in the build environment will be necessary on some ancient architectures. * * Changes in supported systems or compilers: - Support for bitrig (*-*-bitrig*). - Solaris 7 and earlier requires ECHO=/usr/ucb/echo in the build environment, to build and use libtool. - Add libtool-dont_delete_gnulib_files.patch that prevents deletion of files from gnulib to be deleted by libtoolize. - BuildRequire help2man. - Remove unneeded clean section. - Use rpm macros where possible. - Pass V=1 to make to make compilation verbose. - - Drop patch libtool-dont_delete_gnulib_files.patch which is included in 2.4.4 - Update to libtool 2.4.4 * * New features: - Libltdl maintains its own fork of argz, with macros and files in the LT_ and lt__ namespaces (resp.) where they cannot clash with client projects' use of gnulib argz. * * Bug fixes: - Installation of 'libtoolize' once again obeys '--program-prefix', '--program-suffix' and '--program-transform-name' configure options. - `libtoolize` doesn't remove any files that it can't reinstall, including old versions of the snippet directory, and gnulib's version of the argz module and supporting files. - LT_FUNC_DLYSM_USCORE now works correctly on systems that don't support self dlopen()ing. * * Important incompatible changes: - LT_LIB_DLLOAD no longer prepends -ldl or -ldld to LIBS, causing duplicate occurrences in libltdl link lines. If you need to add a library for dlopen() or shl_load() in your Makefile, then use $(LIBADD_DLOPEN) or $(LIBADD_SHL_LOAD) respectively. If you are using libltdl, this all happens automatically, and the only difference you'll see is no more duplicated library names in the verbose link line. * * Changes in supported systems or compilers: - Preliminary support for tcc on linux*. Although it already worked sometimes in previous releases, making sure to set LD correctly now avoids mis-matching GNU ld with tcc: ./configure CC=tcc LD=tcc - Added -os2dllname option to work around 8 character base name limit on OS/2. The option has no effect on other systems. - Support for DLL versioning, -export-symbols and -export-symbols-regex on OS/2. - Support filename-based shared library versioning on AIX. See manual for details. - Require M4 as libtool's libtoolize requires it since 2.4.3 - Update to libtool 2.4.5 New features: - Libtoolize searches for the best available M4 on the user PATH at runtime, rather than settling for the first one found. - Support munging sys_lib_dlsearch_path_spec with LT_SYS_LIBRARY_PATH environment variable. Bug fixes: - Bail out at configure time if the installed M4 is not sufficient for the purposes of libtoolize. - freebsd-elf library versioning was upgraded incorrectly in 2.4.4, but now works properly again. - Fix a 2.4.4 regression so that libltdl subprojects do not warn about missing libltdl/libltdl directory as in prior releases. - When using Sun C++ on Solaris or GNU/Linux we used to set libtool's postdeps permanently, based on the contents of $CXX and $CXXFLAGS at configure time, which was brittle and error-prone. Now, we no longer check for a SunCC ABI at configure time, but augment the postdeps at libtool time based on the current invocation flags on each call. Changes in supported systems or compilers: - /usr/local prefixed rpaths are now added to the link-line on ia64-hp-hpux*, because the default system runtime loader path does not contain them. - Previously, when using Sun C++ on Solaris or GNU/Linux, `-Cstd -Crun` flags were added to $postdeps unless CXX or CXXFLAGS contained `-library=stlport4`. Newer releases have added other compiler flags that are also incompatible with `-Cstd -Crun`, so now we don't add them if any of `-std=c++[0-9][0-9]`, `-library=stdcxx4` or `-compat=g` were found in CXX or CXXFLAGS when the Sun C++ compiler is detected. - Add libtool-no_host_name.patch to remove the host name from generated scripts (bnc#916268). - Update to 2.4.6: Noteworthy changes in release 2.4.6 (2015-02-15) [stable] * New features: - LT_SYS_LIBRARY_PATH can be set in config.site, or at configure time and persists correctly in the generated libtool script. * Bug fixes: - Fix a race condition in ltdl dryrun test that would cause spurious random failures of that test. - LT_SYS_DLSEARCH_PATH is munged correctly. - Add tarball signature. - Use url for signature - Add keyring file for automatic verification of signature - Cleanup spec file with spec-cleaner - Remove old ppc/ppc64 obsolete/provides - Update info pre/post requires and replace postun with preun - Remove empty entry. - Fix call of install_info. - Remove spurious install_info_delete in postun (bsc#940773). - Fix install_info_{install,delete} usage: install-info does not allow file globbing. - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 8.10.0 - jsc#PED-1472 - New virt-qemu-sev-validate utility for validating the measurement reported for a domain launched with AMD SEV - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v8-10-0-2022-12-01 - Dropped patches: f81ee7b5-tests-Fix-libxlxml2domconfigtest.patch - Fix lxc container initialization with systemd and hybrid cgroups suse-fix-lxc-container-init.patch boo#1183247 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Update to libvirt 9.0.0 - jsc#PED-620 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-0-0-2023-01-16 - Added patches: ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch - qemu: Fix umount of /dev in VM private namespace c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch boo#1207889 - Apparmor: Add support for SUSE edk2 firmware paths 4959490e-support-SUSE-edk2-firmware-paths.patch boo#1208567 - tools: Fix detection of remote libvirt access in virt-qemu-sev-validate 0f350a4d-virt-qemu-sev-validate-remote-detect.patch jsc#PED-1472 - libxl: Support custom firmware paths bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch bsc#1209161 - spec: Move ovmf dependency to correct package - qemu: Fix potential crash during driver cleanup 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch bsc#1209861 - qemu: Fix cdrom media change 86cfe93e-qemuProcessRefreshDisks-fix-info.patch bsc#1210666 - CVE-2023-2700: virpci: Resolve leak in virPCIVirtualFunctionList 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch bsc#1211390 - spec: Replace /etc/apparmor.d/<libvirt-profile> on package upgrade apparmor: Add support for local profile customizations 9b743ee1-apparmor-support-local-profile-customizations.patch bsc#1211472 - libxl: Improve handling of errors across migration phases f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch bsc#1213186 spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: Stop packaging empty /etc/apparmor.d/local/* files bsc#1211472 - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 - Move to a more git-centric packaging workflow using tar_scm instead of download_files - New source README.packaging.txt - Drop now unused signature file and libvirt.keyring - Patches dropped and now maintained in git ef482951-apparmor-Allow-umount-dev.patch, d6a8b9ee-qemu-Fix-managed-no-when-creating-ethdev.patch, c3f16cea-qemu-cleanup-label-on-umount-failure.patch, 697c16e3-qemu_process-better-debug-message.patch, 5155ab4b-qemu_namespace-nested-mounts-when-umount.patch, 4959490e-support-SUSE-edk2-firmware-paths.patch, 0f350a4d-virt-qemu-sev-validate-remote-detect.patch, bf3be5b7-libxl-Support-custom-firmware-path.patch, 705525cb-libxl-Support-custom-firmware-path-conversion.patch, 15277033-qemu-Fix-potential-crash-during-driver-cleanup.patch, 86cfe93e-qemuProcessRefreshDisks-fix-info.patch, 6425a311-virpci-Resolve-leak-in-virPCIVirtualFunctionList.patch, 9b743ee1-apparmor-support-local-profile-customizations.patch, f3ed5c27-libxl-dont-resume-domain-on-canceled-mig.patch, b9eeeebd-libxl-support-MIGRATE_CHANGE_PROTECTION.patch, libxl-dom-reset.patch, network-don-t-use-dhcp-authoritative-on-static-netwo.patch, 0001-util-Don-t-spawn-pkttyagent-when-stdin-is-not-a-tty.patch, libvirt-power8-models.patch, ppc64le-canonical-name.patch, libxl-set-migration-constraints.patch, libxl-set-cach-mode.patch, 0001-libxl-add-support-for-BlockResize-API.patch, suse-libvirtd-disable-tls.patch, suse-libvirt-guests-service.patch, suse-qemu-conf.patch, suse-qemu-ovmf-paths.patch, libxl-support-block-script.patch, qemu-apparmor-screenshot.patch, libvirt-suse-netcontrol.patch, lxc-wait-after-eth-del.patch, suse-libxl-disable-autoballoon.patch, suse-xen-ovmf-paths.patch, virt-create-rootfs.patch, suse-fix-lxc-container-init.patch - Drop old, unused SUSEfirewall2 config file libvirtd-relocation-server.fw - spec: Remove unneeded use of ldconfig - spec: Remove libvirt_sysconfig_{pre,posttrans} macros. They are noops on SUSE distros since files in /etc/sysconfig/ are not owned by rpm. - spec: Build library with support for modular daemons bsc#1213352 - libxl: Fix connection to modular network daemon bsc#1214223 - conf: Remove some firmware validation checks bsc#1216980 - qemu: domain: Fix logic when tainting domain bsc#1220512 - Fix off-by-one error in udevListInterfacesByStatus CVE-2024-1441 bsc#1221237 - interface: fix udev_device_get_sysattr_value return value check CVE-2024-2496 bsc#1221468 - CVE-2024-2494: remote: check for negative array lengths before allocation bsc#1221815 - security: Ensure file exists before attempting to restore label bsc#1220714 - rpc: Don't warn about "max_client_requests" in single-threaded daemons boo#1224327 - Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67. Patch has been borrowed by Fedora, upstream is still busy working out a patch (I'd not be surprised if they end up merging this finally. https://github.com/vmware/open-vm-tools/issues/500 - Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools package fails. - Update to 11.3.0 (build 18090558) (boo#1187567) + Resolved issues: - The following github issues and pull requests have been resolved: 446, 481, 500, and 509 - The following Pull requests have been resolved: 474 and 505 - A number of issues detected by Coverity, internally or by third parties, have been addressed. - A command line tool, vmwgfxctrl, has been added to open-vm-tools for Linux that can be used to control various aspects of the vmwgfx Linux kernel module. Currently it can both display and set the current topology of the vmwgfx kernel driver. It is useful when trying to configure custom resolutions on recent Linux distributions, including multi-monitor setups. - A command line tool, vmware-alias-import, has been added to open-vm-tools that can be used to import vgauth config data and apply it to the running vgauth service. - Enhancements to support or utilize various vSphere features. - Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path "/var/run" to "/run" for it's PIDfile. - Update pam-vmtoolsd.patch to compensate for new line numbers. - Drop patch now contained in 11.3.0: - open-vm-tools-glib-2.67.patch - open-vm-tools-pollGtk.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools package fails. - Update to 11.3.0 (build 18090558) (boo#1187567) + Resolved issues: - The following github issues and pull requests have been resolved: 446, 481, 500, and 509 - The following Pull requests have been resolved: 474 and 505 - A number of issues detected by Coverity, internally or by third parties, have been addressed. - A command line tool, vmwgfxctrl, has been added to open-vm-tools for Linux that can be used to control various aspects of the vmwgfx Linux kernel module. Currently it can both display and set the current topology of the vmwgfx kernel driver. It is useful when trying to configure custom resolutions on recent Linux distributions, including multi-monitor setups. - A command line tool, vmware-alias-import, has been added to open-vm-tools that can be used to import vgauth config data and apply it to the running vgauth service. - Enhancements to support or utilize various vSphere features. - Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path "/var/run" to "/run" for it's PIDfile. - Update pam-vmtoolsd.patch to compensate for new line numbers. - Drop patch now contained in 11.3.0: - open-vm-tools-glib-2.67.patch - open-vm-tools-pollGtk.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog - convert to obs_scm - update to 12.5.0 (boo#1231826): There are no new features in the open-vm-tools 12.5.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been integrated. Please see the Resolved Issues section of the Release Notes. * For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.5.0 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/ReleaseNotes.md The granular changes that have gone into the 12.5.0 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/open-vm-tools/ChangeLog - Adjust baselibs for new libxcb-dri3-0 and libxcb-present0 subpackages - Fixup package descriptions - Update to version 1.10: + Bump libxcb-xkb SONAME due to ABI break introduced in 1.9.2 + Enable libxcb-xkb by default + Bump libxcb-sync SONAME + c_client.py: Fix _sizeof() functions + c_client.py: Do not create pointers in unions + c_client.py: Always initialize xcb_align_to + Re-introduce xcb_ge_event_t (deprecated, xcb_ge_generic_event_t should be used instead) + Fix alignment issues in FD passing code + Fix poll() if POLLIN == ROLLRDNORM|POLLRDBAND + Use /usr/spool/sockets/X11/ on HP-UX for UNIX sockets + Make xsltproc optional - update to current git commit 4ffa6f8 to match current xcb-proto git sources - remove URL in specfile sourceline for snapshot tarball in the hope to be accepted by buildservice now - Update to a newer snapshot - Add missing BuildRequires - added missing python-xcb-proto-devel >= 7.6_1.10.1 BuildRequires - Update to version 1.11: This fixes some bugs with 64 bit fields and the present extension. - added baselibs.conf as source to specfile - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - Update to version 1.11.1: This fixes some threading-related bugs with xcb_wait_for_special_event() and adds 64-bit versions of functions that work with sequence numbers. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch: If auth with credentials for hostname fails retry with XAUTHLOCALHOSTNAME (boo#906622). - Update to version 1.12 * here is a new version of libxcb for you to enjoy. The highlights are the same as for the new xcb-proto release: xinput support, RandR 1.5 and an automatic alignment checker. - removed libxcb-xevie0/libxcb-xprint0 subpackages - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Modify this patch to do what it say - retry not only if the current hostname is not found in the xauthority file, but also when it is rejected by X server. (bnc#1043221) - fixes build against python3 (package rename of python-xcb-proto-devel to python3-xcb-proto-devel) - Use spaces instead of tabs in the patches (as does the original source code) to avoid confusion. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * If authentication (with *stage == 0) failed and the variable XAUTHLOCALHOSTNAME wasn't set, we were never getting to stage 2 in the original patch, causing calls to xcb_connect_to_display to be stuck in an infinite loop. Now we also go to stage 2 if the variable isn't set. - n_If-auth-with-credentials-for-hostname-fails-retry-with-XAUTHLOCALHOSTNAME.patch * Prevent infinite loop also in case DISPLAY is non-local. - Enable xinput extension. (bnc#1074249) - U_add-support-for-eventstruct.patch * Update xinput to the state when it was enabled by default upstream. - Really conditionalize the python3 option to allow us building without any python2 present * u_build_python3.patch - Convert to pkgconfig style deps - Format bit with spec-cleaner - Update to version 1.13 * As with xcb-proto, this release mainly enables multi-planar buffers in DRI3 v1.2 via support for variable-sized lists of FDs, and enables sending GenericEvents to other clients. Present v1.2 and RandR v1.6 did not require any specific library changes. - supersedes U_add-support-for-eventstruct.patch, u_build_python3.patch - u_don-t-flag-extra-reply-in-xcb_take_socket.patch * Fix IO errors with KWin in combination with NVIDIA driver. (bnc#1101560) - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - ABI compatible replacement for libcypt from glibc - Update to libxcrypt 4.0.1 - Update to libxcrypt 4.1.0 * Fix spelling of SUSE. * Lower the minimum required automake version to 1.14. * Fix build with USE_SWAPCONTEXT turned off. * Extend --enable-weak-hashes configure option to accept optional "glibc" parameter. * Fix the leak of obtained random bytes. * Check expected output strings for deterministic methods. * Fix memory leak in crypt_sha1_rn. * Fix read of random bytes out of bounds in gensalt_sha1_rn. * Make it possible to disable individual hashes at configure time. * Make salt validation pickier. * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation. * Make crypt_gensalt for $sha1 deterministic. * Fix incorrect output-size computation in crypt_sha1_rn. * Add docs for SHA1, MD5/Sun, NTHASH. * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros. * Install libcrypt.pc symlink along with libxcrypt.pc. * Extend --enable-obsolete-api configure option. * Extend overall test coverage. - Fix RPM groups for Factory. - Add conflicts with glibc-devel < 2.28 - Set compatibility level to suse - Update to version 4.4.3: * Add libxcrypt.so, libxcrypt.a and xcrypt.h. * Add new man3 manual pages. - format-overflow.patch: Fix -Werror=format-overflow - Disable LTO due to symbol versioning (boo#1138833). - Update to version 4.4.10 * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt. * The crypt_* functions will now all fail and set errno to ERANGE if their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE characters (this is currently 512) * The NT hashing method no longer truncates passphrases at 128 characters; Windows does not do this. - format-overflow.patch: remove - gcc10.patch: fix build with gcc10 (bsc#1158192) - Update to version 4.4.11 * Fixes for GCC v10.x * Change how the known-answer tests are parallelized - gcc10.patch: remove - Update to version 4.4.12 * Another fix for GCC v10.x, which occurs on s390 architectures only. - Update to version 4.4.15 * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r, xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further * Speed up ka-sunmd5 by skipping most of the test phrases - Package README.md and TODO.md (bsc#1165389) - Add compatibility provides for SLE15 - add compatibility provides for Step 15 as well (bsc#1181571) - fix variable name for datamember in 'struct crypt_data' [bsc#1215496] - added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2 + libxcrypt-man-fix-variable-name.patch - Update to new upstream release 0.7.0 * Added support for different "modes" of calculating consumed modifiers. The existing mode, based on the XKB standard, has proven to be unintuitive in various shortcut implementations. * A new mode, based on the calculation used by the GTK toolkit, is added. This mode is less eager to declare a modifier as consumed. - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - enable 32bit libxkbregistry0 and libxkbregistry0-devel for use by Wine. (bsc#1218639) - Update to new upstream release 0.7.0 * Added support for different "modes" of calculating consumed modifiers. The existing mode, based on the XKB standard, has proven to be unintuitive in various shortcut implementations. * A new mode, based on the calculation used by the GTK toolkit, is added. This mode is less eager to declare a modifier as consumed. - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - Update to new upstream release 0.7.0 * Added support for different "modes" of calculating consumed modifiers. The existing mode, based on the XKB standard, has proven to be unintuitive in various shortcut implementations. * A new mode, based on the calculation used by the GTK toolkit, is added. This mode is less eager to declare a modifier as consumed. - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - Update to new upstream release 0.7.0 * Added support for different "modes" of calculating consumed modifiers. The existing mode, based on the XKB standard, has proven to be unintuitive in various shortcut implementations. * A new mode, based on the calculation used by the GTK toolkit, is added. This mode is less eager to declare a modifier as consumed. - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - enable 32bit libxkbregistry0 and libxkbregistry0-devel for use by Wine. (bsc#1218639) - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - enable 32bit libxkbregistry0 and libxkbregistry0-devel for use by Wine. (bsc#1218639) - Update to new upstream release 0.7.1 * Fixed various reported problems when the current locale is tr_TR.UTF-8. - Update to new upstream release 0.7.2 * Added new keysym definitions from xproto. * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN, XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset. - Allow building x11 subpackage on any distribution - Update to new upstream release 0.8.0 * Added xkb_keysym_to_{upper,lower} to perform case-conversion directly on keysyms. This is useful in some odd cases, but working with the Unicode representations should be preferred when possible. * Added Unicode conversion rules for the signifblank and permille keysyms. * Fixed a bug in the parsing of XKB key type definitions where the number of levels were determined by the number of level * names*. Keymaps which omit level names were hence miscompiled. This regressed in version 0.4.3. Keymaps from xkeyboard-config were not affected since they don't omit level names. - Update to new upstream release 0.8.2 (boo#1105832) * Fix a few NULL-dereferences, out-of-bounds access and undefined behavior in the XKB text format parser. * CVEs fixed: CVE-2018-15853, CVE-2018-15854, CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859, CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864 - run make check - Update to new upstream release 0.8.3 * New APIs: XKB_KEY_XF86MonBrightnessCycle, XKB_KEY_XF86RotationLockToggle. - Update to new upstream release 0.8.4 * Only changes to the build procedure. - Update to release 0.9.0 * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user to have full control of the keymap definitions, instead of only augmenting them. - Update to release 0.9.1 * Fix context creation failing when run in privileged processes as defined by `secure_getenv(3)`, e.g. GDM. - Update to release 0.10.0 * Fix quadratic complexity in the XKB file parser. * Add $XDG_CONFIG_HOME/xkb to the default search path. If $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If $HOME is not set, the path is not added. The XDG path is looked up before the existing default search path $HOME/.xkb. * Add support for include statements in XKB rules files. * Fix bug where the merge mode only applied to the first vmod in a "virtual_modifiers" statement. * Reject interpret modifier predicate with more than one value. * Correctly handle capitalization of the ssharp keysym. - Update to release 1.0.0 * Now it is possible to add custom layouts and options at the system (/etc) and user (~/.config) level, at least when libxkbcommon is in use. * libxkbregistry is a C library that lists available XKB models, layouts and variants for a given ruleset. This is a separate library (.so/.pc files) and aimed at tools that provide a listing of available keyboard layouts to the user. * Add an `xkbcli` command-line utility. - Update to release 1.0.1 * Make the table output of `xkbcli how-to-type` aligned. - Update to release 1.0.2 * Fix a bug where a keysym that cannot be resolved in a keymap gets compiled to a garbage keysym. Now it is set to XKB_KEY_NoSymbol instead. * Improve the speed of xkb_x11_keymap_new_from_device() on repeated calls in the same xkb_context(). - Update to release 1.0.3 * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device() in some unclear situation (bug introduced in 1.0.2). * Fix keymaps created with xkb_x11_keymap_new_from_device() do not have level names (bug introduced in 0.8.0). - Fix dependency of libxkbregistry-devel: the devel package must require the library libxkbregistry0. - Update to release 1.1.0 * Update keysym definitions to latest xorgproto. In particular, this adds many special keysyms corresponding to Linux evdev keycodes. * New XKB_KEY_* definitions. - Update to release 1.2.0 * `xkb_x11_keymap_new_from_device()` is much faster. It now performs only 2 roundtrips to the X server, instead of dozens (in first-time calls). * Case-sensitive `xkb_keysym_from_name()` is much faster. * Keysym names of the form `0x12AB` and `U12AB` are parsed more strictly. * Compose files now have a size limit (65535 internal nodes). * Compose table loading (`xkb_compose_table_new_from_locale()` and similar) is much faster. - Update to release 1.2.1 [boo#1184688] * Fix `xkb_x11_keymap_new_from_device()` failing when the keymap contains key types with missing level names, like the one used by the `numpad:mac` option in xkeyboard-config. (Regressed in 1.2.0.) - Update to release 1.3.0 * `xkbcli list` was changed to output YAML instead of a custom format. * Fix segmentation fault in case-insensitive `xkb_keysym_from_name` for certain values like the empty string. - enable 32bit libxkbregistry0 and libxkbregistry0-devel for use by Wine. (bsc#1218639) - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Fixed dependencies with libraries (bsc#1012246): * libxmlsec1-openssl.so * libxmlsec1-gcrypt.so * libxmlsec1-gnutls.so * libxmlsec1-nss.so - Version update to 1.2.24: * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support for xmlsec-nss. * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS handling. * Disabled external entities loading by xmlsec utility app by default to prevent XXE attacks. * Improved OpenSSL version and features detection. * Cleaned up, simplified, and standardized internal error reporting. * Fixed a few Coverity-discovered bugs. * Marked as deprecated all the functions in xmlsec/soap.h file and a couple other functions no longer required by xmlsec. These functions will be removed in the future releases. * Several other small fixes (see commit log for more details). - Version update to 1.2.25: * Various small fixes * Coverity cleanups * Removed support for old openssl - Version update to 1.2.26: * Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto * Added LibreSSL 2.7 support * Upgraded documentation build process to support the latest gtk-doc - Fixed (bsc#1104876). Added: Requires: %{libname} = %{version} to each module in the spec file. This will ensure that when one of the modules is installed the corresponding version of libxmlsec1-1 will also be installed/upgraded. - Add rplintrc to avoid bogus errors: * xmlsec1-rpmlintrc - Version update to 1.2.27: * Added AES-GCM support for OpenSSL and MSCNG (snargit). * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos). * Added RSA-OAEP support for MSCNG (vmiklos). * Continuous build integration in Travis and Appveyor. * Several other small fixes (more details). - Drop the gnutls backend as based on the tests it is quite borked: * We still have nss and openssl backend for people to use - Make sure to recommend at least one backend when you install just xmlsec1 - Update to 1.2.28: * Added BoringSSL support (chenbd). * Added gnutls-3.6.x support (alonbl). * Added DSA and ECDSA key size getter for MSCNG (vmiklos). * Added --enable-mans configuration option (alonbl). * Added coninuous build integration for MacOSX (vmiklos). * Several other small fixes (more details). - Update to 1.2.30: * Enabled XML_PARSE_HUGE for all xml parsers. * Various build and tests fixes and improvements. * Move remaining private header files away from xmlsec/include/ folder. - Update to version 1.2.31: + Unload error strings in OpenSSL shutdown. + Make userData available when executing preExecCallback function. + Add an option to use secure memset. - Pass --disable-md5 to configure: The cryptographic strength of the MD5 algorithm is sufficiently doubtful that its use is discouraged at this time. It is not listed as an algorithm in [XMLDSIG-CORE1] https://www.w3.org/TR/xmlsec-algorithms/#bib-XMLDSIG-CORE1 - Relax the crypto policies for the test-suite. This allows the tests using certificates with small key lengths to pass. - update to 1.2.32: + Remove MD5 for NSS 3.59 and above + Fix PKCS12_parse return code handling + Fix OpenSSL lookup + xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice - add upstream signing key and validate source signature - put license text into all subpackages - treat all compiler warnings as errors - update to 1.2.33: * Fix decrypting session key for two recipients * Added --privkey-openssl-engine option to enhance openssl engine support - update to 1.2.34: * Support for OpenSSL compiled with OPENSSL_NO_ERR. * Full support for LibreSSL 3.5.0 and above * Several other small fixes - Add export CFLAGS/CXXFLAGS="-Wno-error=deprecated-declarations" inbefore configure. We pass --enable-werror to configure, and that leads to warnings about deprecations failing build. As deprecations is mainly a consern for upstream, stop failing on those. - Update to 1.2.36: * Retired the XMLSec mailing list "xmlsec@aleksey.com" and the XMLSec Online Signature Verifier. - Update to 1.2.35: * Migration to OpenSSL 3.0 API (based on PR by @snargit). Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use "--enable-openssl3-engines" configure flag (there will be a lot of deprecation warnings). * The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library. * Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled "-Werror" and "-pedantic" flags on CI builds. * Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility). * Moved all CI builds to GitHub actions. - update to 1.2.37: Fixed two regressions from 1.2.36 release - switch to pkgconfig(zlib) to allow alternative providers as well - Fixed dependencies with libraries (bsc#1012246): * libxmlsec1-openssl.so * libxmlsec1-gcrypt.so * libxmlsec1-gnutls.so * libxmlsec1-nss.so - Version update to 1.2.24: * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support for xmlsec-nss. * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS handling. * Disabled external entities loading by xmlsec utility app by default to prevent XXE attacks. * Improved OpenSSL version and features detection. * Cleaned up, simplified, and standardized internal error reporting. * Fixed a few Coverity-discovered bugs. * Marked as deprecated all the functions in xmlsec/soap.h file and a couple other functions no longer required by xmlsec. These functions will be removed in the future releases. * Several other small fixes (see commit log for more details). - Version update to 1.2.25: * Various small fixes * Coverity cleanups * Removed support for old openssl - Version update to 1.2.26: * Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto * Added LibreSSL 2.7 support * Upgraded documentation build process to support the latest gtk-doc - Fixed (bsc#1104876). Added: Requires: %{libname} = %{version} to each module in the spec file. This will ensure that when one of the modules is installed the corresponding version of libxmlsec1-1 will also be installed/upgraded. - Add rplintrc to avoid bogus errors: * xmlsec1-rpmlintrc - Version update to 1.2.27: * Added AES-GCM support for OpenSSL and MSCNG (snargit). * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos). * Added RSA-OAEP support for MSCNG (vmiklos). * Continuous build integration in Travis and Appveyor. * Several other small fixes (more details). - Drop the gnutls backend as based on the tests it is quite borked: * We still have nss and openssl backend for people to use - Make sure to recommend at least one backend when you install just xmlsec1 - Update to 1.2.28: * Added BoringSSL support (chenbd). * Added gnutls-3.6.x support (alonbl). * Added DSA and ECDSA key size getter for MSCNG (vmiklos). * Added --enable-mans configuration option (alonbl). * Added coninuous build integration for MacOSX (vmiklos). * Several other small fixes (more details). - Update to 1.2.30: * Enabled XML_PARSE_HUGE for all xml parsers. * Various build and tests fixes and improvements. * Move remaining private header files away from xmlsec/include/ folder. - Update to version 1.2.31: + Unload error strings in OpenSSL shutdown. + Make userData available when executing preExecCallback function. + Add an option to use secure memset. - Pass --disable-md5 to configure: The cryptographic strength of the MD5 algorithm is sufficiently doubtful that its use is discouraged at this time. It is not listed as an algorithm in [XMLDSIG-CORE1] https://www.w3.org/TR/xmlsec-algorithms/#bib-XMLDSIG-CORE1 - Relax the crypto policies for the test-suite. This allows the tests using certificates with small key lengths to pass. - update to 1.2.32: + Remove MD5 for NSS 3.59 and above + Fix PKCS12_parse return code handling + Fix OpenSSL lookup + xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice - add upstream signing key and validate source signature - put license text into all subpackages - treat all compiler warnings as errors - update to 1.2.33: * Fix decrypting session key for two recipients * Added --privkey-openssl-engine option to enhance openssl engine support - update to 1.2.34: * Support for OpenSSL compiled with OPENSSL_NO_ERR. * Full support for LibreSSL 3.5.0 and above * Several other small fixes - Add export CFLAGS/CXXFLAGS="-Wno-error=deprecated-declarations" inbefore configure. We pass --enable-werror to configure, and that leads to warnings about deprecations failing build. As deprecations is mainly a consern for upstream, stop failing on those. - Update to 1.2.36: * Retired the XMLSec mailing list "xmlsec@aleksey.com" and the XMLSec Online Signature Verifier. - Update to 1.2.35: * Migration to OpenSSL 3.0 API (based on PR by @snargit). Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use "--enable-openssl3-engines" configure flag (there will be a lot of deprecation warnings). * The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library. * Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled "-Werror" and "-pedantic" flags on CI builds. * Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility). * Moved all CI builds to GitHub actions. - update to 1.2.37: Fixed two regressions from 1.2.36 release - switch to pkgconfig(zlib) to allow alternative providers as well - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Initial packaging based on Mageia package - Update to 0.7.6 + SHA-512 and SHA-512/128 support + New default chunk checksum type SHA-512/128 + Automatic chunking moved into libzck and is now default + New option to disable automatic chunking + Bugfixes - Do not manually specify dependencies which are automatically generated - Make requirements of devel package less strict - Rebase to 0.9.11 + Fix small bug where creating a zck_dl context fails when zck context is NULL + Fix security bugs found by Coverity + Fix test failures for zstd <= 1.3.4 + Add gen_xml_dictionary to libexecdir with zck_ prefix + Fix intermittent bug where auto-chunking wasn't deterministic + ABI (but not API change) - Use bool from stdbool.h + Allow specification of output file in zck + Set minimum and maximum chunk sizes for both automatic and manual chunking + New error handling functions + File format changes + API changes - Make requirements between subpackages stricter to avoid issues due to inter-subpackage ABI/API changes - Bump meson build dependency to match meson.build requirement - Update to version 0.9.13 * Add read support for zchunk files with optional flags * Fix tests for zstd-1.3.6 - Update to version 0.9.17 + Turn off some tests for big-endian architectures since zstd isn't deterministic on them + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file + Add functions to API to simplify extracting a single chunk + Change default zstd compression to 9 for a 6x speed increase in compression speed for a 5% increase in compression size + Switch from optional flags to more robust optional elements + Sanity check hex hashes passed in as an option - Update to version 1.0.2 + Use hash table for finding identical chunks, speeding up process considerably + Add test case to verify that identical chunk checking is working - Backport patch from upstream to fix bugs discovered by Coverity + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.0.3 + Fix some small bugs found by Coverity + Fix memory leak and off-by-one errors - Drop patches part of 1.0.3 release + 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.1.0 + Fix multipart boundary bug when dealing with lighttpd servers + Optimize chunk matching while downloading, significantly reducing CPU usage - Update to version 1.1.4: * Simplify regex for detecting part header info * Fix coverity warnings * Open files with permissions 0666 and let umask(2) do its job. * Multipart boundary field can be quoted. - Update to version 1.1.5 + Handle write errors correctly - Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build with zstd 1.4.7+. - Update to version 1.1.9 * Handle zstd 1.4.7+ * Update documentation * unzck: require a *.zck extension * General bug fixes - Dropped upstream merged d2eae512bee09a4047cfe586de12f644d73b0736.patch - Add fix-test-argp.patch: Fix argp detection - Update to version 1.1.11 * Fix memory leak of zck->prep_digest * Fix argp detection * Handle certain rare web servers that don't start with \r\n - Drop upstream merged fix-test-argp.patch - Update to version 1.1.12 * Update testsuite for zstd 1.5 - Update to version 1.1.14 * Final fixes for zstd 1.5 support - Update to version 1.1.16 * Fix major bug when compressing with dictionary - Fix CVE-2023-46228, bsc#1216268 * Handle overflow errors in malformed zchunk files. - Added patch: * CVE-2023-46228.patch - Initial packaging based on Mageia package - Update to 0.7.6 + SHA-512 and SHA-512/128 support + New default chunk checksum type SHA-512/128 + Automatic chunking moved into libzck and is now default + New option to disable automatic chunking + Bugfixes - Do not manually specify dependencies which are automatically generated - Make requirements of devel package less strict - Rebase to 0.9.11 + Fix small bug where creating a zck_dl context fails when zck context is NULL + Fix security bugs found by Coverity + Fix test failures for zstd <= 1.3.4 + Add gen_xml_dictionary to libexecdir with zck_ prefix + Fix intermittent bug where auto-chunking wasn't deterministic + ABI (but not API change) - Use bool from stdbool.h + Allow specification of output file in zck + Set minimum and maximum chunk sizes for both automatic and manual chunking + New error handling functions + File format changes + API changes - Make requirements between subpackages stricter to avoid issues due to inter-subpackage ABI/API changes - Bump meson build dependency to match meson.build requirement - Update to version 0.9.13 * Add read support for zchunk files with optional flags * Fix tests for zstd-1.3.6 - Update to version 0.9.17 + Turn off some tests for big-endian architectures since zstd isn't deterministic on them + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file + Add functions to API to simplify extracting a single chunk + Change default zstd compression to 9 for a 6x speed increase in compression speed for a 5% increase in compression size + Switch from optional flags to more robust optional elements + Sanity check hex hashes passed in as an option - Update to version 1.0.2 + Use hash table for finding identical chunks, speeding up process considerably + Add test case to verify that identical chunk checking is working - Backport patch from upstream to fix bugs discovered by Coverity + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.0.3 + Fix some small bugs found by Coverity + Fix memory leak and off-by-one errors - Drop patches part of 1.0.3 release + 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.1.0 + Fix multipart boundary bug when dealing with lighttpd servers + Optimize chunk matching while downloading, significantly reducing CPU usage - Update to version 1.1.4: * Simplify regex for detecting part header info * Fix coverity warnings * Open files with permissions 0666 and let umask(2) do its job. * Multipart boundary field can be quoted. - Update to version 1.1.5 + Handle write errors correctly - Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build with zstd 1.4.7+. - Update to version 1.1.9 * Handle zstd 1.4.7+ * Update documentation * unzck: require a *.zck extension * General bug fixes - Dropped upstream merged d2eae512bee09a4047cfe586de12f644d73b0736.patch - Add fix-test-argp.patch: Fix argp detection - Update to version 1.1.11 * Fix memory leak of zck->prep_digest * Fix argp detection * Handle certain rare web servers that don't start with \r\n - Drop upstream merged fix-test-argp.patch - Update to version 1.1.12 * Update testsuite for zstd 1.5 - Update to version 1.1.14 * Final fixes for zstd 1.5 support - Update to version 1.1.16 * Fix major bug when compressing with dictionary - Fix CVE-2023-46228, bsc#1216268 * Handle overflow errors in malformed zchunk files. - Added patch: * CVE-2023-46228.patch - Initial packaging based on Mageia package - Update to 0.7.6 + SHA-512 and SHA-512/128 support + New default chunk checksum type SHA-512/128 + Automatic chunking moved into libzck and is now default + New option to disable automatic chunking + Bugfixes - Do not manually specify dependencies which are automatically generated - Make requirements of devel package less strict - Rebase to 0.9.11 + Fix small bug where creating a zck_dl context fails when zck context is NULL + Fix security bugs found by Coverity + Fix test failures for zstd <= 1.3.4 + Add gen_xml_dictionary to libexecdir with zck_ prefix + Fix intermittent bug where auto-chunking wasn't deterministic + ABI (but not API change) - Use bool from stdbool.h + Allow specification of output file in zck + Set minimum and maximum chunk sizes for both automatic and manual chunking + New error handling functions + File format changes + API changes - Make requirements between subpackages stricter to avoid issues due to inter-subpackage ABI/API changes - Bump meson build dependency to match meson.build requirement - Update to version 0.9.13 * Add read support for zchunk files with optional flags * Fix tests for zstd-1.3.6 - Update to version 0.9.17 + Turn off some tests for big-endian architectures since zstd isn't deterministic on them + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file + Add functions to API to simplify extracting a single chunk + Change default zstd compression to 9 for a 6x speed increase in compression speed for a 5% increase in compression size + Switch from optional flags to more robust optional elements + Sanity check hex hashes passed in as an option - Update to version 1.0.2 + Use hash table for finding identical chunks, speeding up process considerably + Add test case to verify that identical chunk checking is working - Backport patch from upstream to fix bugs discovered by Coverity + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.0.3 + Fix some small bugs found by Coverity + Fix memory leak and off-by-one errors - Drop patches part of 1.0.3 release + 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.1.0 + Fix multipart boundary bug when dealing with lighttpd servers + Optimize chunk matching while downloading, significantly reducing CPU usage - Update to version 1.1.4: * Simplify regex for detecting part header info * Fix coverity warnings * Open files with permissions 0666 and let umask(2) do its job. * Multipart boundary field can be quoted. - Update to version 1.1.5 + Handle write errors correctly - Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build with zstd 1.4.7+. - Update to version 1.1.9 * Handle zstd 1.4.7+ * Update documentation * unzck: require a *.zck extension * General bug fixes - Dropped upstream merged d2eae512bee09a4047cfe586de12f644d73b0736.patch - Add fix-test-argp.patch: Fix argp detection - Update to version 1.1.11 * Fix memory leak of zck->prep_digest * Fix argp detection * Handle certain rare web servers that don't start with \r\n - Drop upstream merged fix-test-argp.patch - Update to version 1.1.12 * Update testsuite for zstd 1.5 - Update to version 1.1.14 * Final fixes for zstd 1.5 support - Update to version 1.1.16 * Fix major bug when compressing with dictionary - Fix CVE-2023-46228, bsc#1216268 * Handle overflow errors in malformed zchunk files. - Added patch: * CVE-2023-46228.patch - Do not clean up MediaSetAccess before using the geoip file (fixes #424) - version 17.31.4 (22) - Create '.no_auto_prune' in the package cache dir to prevent auto cleanup of orphaned repositories (bsc#1204956) - properly reset range requests (bsc#1204548) - version 17.31.5 (22) - Avoid calling getsockopt when we know the info already. This patch hopefully fixes logging on WSL, getsockopt seems to not be fully supported but the code required it when accepting new socket connections. (for bsc#1178233) - Enhance yaml-cpp detection (fixes #428) - No need to redirect 'history.logfile=/dev/null' into the target. - MultiCurl: Make sure to reset the progress function when falling back. - version 17.31.6 (22) - Hint to "zypper removeptf" to remove PTFs. - Removing a PTF without enabled repos should always fail (bsc#1203248) Without enabled repos, the dependent PTF-packages would be removed (not replaced!) as well. To remove a PTF "zypper install - - -PTF" or a dedicated "zypper removeptf PTF" should be used. This will update the installed PTF packages to theit latest version. - version 17.31.7 (22) - ProgressData: enforce reporting the INIT||END state (bsc#1206949) - ps: fix service detection on newer Tumbleweed systems (bsc#1205636) - version 17.31.8 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Do not clean up MediaSetAccess before using the geoip file (fixes #424) - version 17.31.4 (22) - Create '.no_auto_prune' in the package cache dir to prevent auto cleanup of orphaned repositories (bsc#1204956) - properly reset range requests (bsc#1204548) - version 17.31.5 (22) - Avoid calling getsockopt when we know the info already. This patch hopefully fixes logging on WSL, getsockopt seems to not be fully supported but the code required it when accepting new socket connections. (for bsc#1178233) - Enhance yaml-cpp detection (fixes #428) - No need to redirect 'history.logfile=/dev/null' into the target. - MultiCurl: Make sure to reset the progress function when falling back. - version 17.31.6 (22) - Hint to "zypper removeptf" to remove PTFs. - Removing a PTF without enabled repos should always fail (bsc#1203248) Without enabled repos, the dependent PTF-packages would be removed (not replaced!) as well. To remove a PTF "zypper install - - -PTF" or a dedicated "zypper removeptf PTF" should be used. This will update the installed PTF packages to theit latest version. - version 17.31.7 (22) - ProgressData: enforce reporting the INIT||END state (bsc#1206949) - ps: fix service detection on newer Tumbleweed systems (bsc#1205636) - version 17.31.8 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Do not clean up MediaSetAccess before using the geoip file (fixes #424) - version 17.31.4 (22) - Create '.no_auto_prune' in the package cache dir to prevent auto cleanup of orphaned repositories (bsc#1204956) - properly reset range requests (bsc#1204548) - version 17.31.5 (22) - Avoid calling getsockopt when we know the info already. This patch hopefully fixes logging on WSL, getsockopt seems to not be fully supported but the code required it when accepting new socket connections. (for bsc#1178233) - Enhance yaml-cpp detection (fixes #428) - No need to redirect 'history.logfile=/dev/null' into the target. - MultiCurl: Make sure to reset the progress function when falling back. - version 17.31.6 (22) - Hint to "zypper removeptf" to remove PTFs. - Removing a PTF without enabled repos should always fail (bsc#1203248) Without enabled repos, the dependent PTF-packages would be removed (not replaced!) as well. To remove a PTF "zypper install - - -PTF" or a dedicated "zypper removeptf PTF" should be used. This will update the installed PTF packages to theit latest version. - version 17.31.7 (22) - ProgressData: enforce reporting the INIT||END state (bsc#1206949) - ps: fix service detection on newer Tumbleweed systems (bsc#1205636) - version 17.31.8 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Do not clean up MediaSetAccess before using the geoip file (fixes #424) - version 17.31.4 (22) - Create '.no_auto_prune' in the package cache dir to prevent auto cleanup of orphaned repositories (bsc#1204956) - properly reset range requests (bsc#1204548) - version 17.31.5 (22) - Avoid calling getsockopt when we know the info already. This patch hopefully fixes logging on WSL, getsockopt seems to not be fully supported but the code required it when accepting new socket connections. (for bsc#1178233) - Enhance yaml-cpp detection (fixes #428) - No need to redirect 'history.logfile=/dev/null' into the target. - MultiCurl: Make sure to reset the progress function when falling back. - version 17.31.6 (22) - Hint to "zypper removeptf" to remove PTFs. - Removing a PTF without enabled repos should always fail (bsc#1203248) Without enabled repos, the dependent PTF-packages would be removed (not replaced!) as well. To remove a PTF "zypper install - - -PTF" or a dedicated "zypper removeptf PTF" should be used. This will update the installed PTF packages to theit latest version. - version 17.31.7 (22) - ProgressData: enforce reporting the INIT||END state (bsc#1206949) - ps: fix service detection on newer Tumbleweed systems (bsc#1205636) - version 17.31.8 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Workround bsc#1195633 while libsolv <= 0.7.23 is used. - Fix potential endless loop in new ZYPP_MEDIANETWORK. - ZYPP_METALINK_DEBUG=1: Log URL and priority of the mirrors parsed from a metalink file. - multicurl: propagate ssl settings stored in repo url (boo#1127591) Closes #335. - Teach MediaNetwork to retry on HTTP2 errors. - fix CapDetail to return Rel::NONE if an EXPRESSION is used as a NAMED cap. - Capability: support parsing richdeps from string. - defaultLoadSystem: default to LS_NOREFRESH if not root. - Detect x86_64_v[234]: Fix LZCNT bit used in detection (fixes [#439]) Merges rpm-software-management/rpm#2412: The bit for LZCNT is in CPUID 0x80000001, not 1. - Detect x86_64_v[234] architecture levels (fixes #439) - Support x86_64_v[234] architecture levels (for #439) - version 17.31.9 (22) - BuildRequires: libsolv-devel >= 0.7.24 for x86_64_v[234] support. - version 17.31.10 (22) - fix build with boost 1.82 - MediaCurl: Fix endless loop if wrong credentials are stored in credentials.cat (bsc#1210870) Since libzypp-17.31.7 wrong credentials stored in credentials.cat may lead to an endless loop. Rather than asking for the right credentials, the stored ones are used again and again. - zypp.conf: Introduce 'download.connect_timeout' [60 sec.] (bsc#1208329) Maximum time in seconds that you allow the connection phase to the server to take. This only limits the connection phase, it has no impact once it has connected. (see also CURLOPT_CONNECTTIMEOUT) - commit: Try to provide /dev fs if not present (fixes #444) - fix build with boost 1.82. - version 17.31.11 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - Do not unconditionally release a medium if provideFile failed (bsc#1211661) - libzypp.spec.cmake: remove duplicate file listing. - version 17.31.12 (22) - curl: Trim user agent string (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. Violation results in curl error: 92: HTTP/2 PROTOCOL_ERROR. - version 17.31.13 (22) - build: honor libproxy.pc's includedir (bsc#1212222) - Curl: trim all custom headers (bsc#1212187) HTTP/2 RFC 9113 forbids fields ending with a space. So we make sure all custom headers are trimmed. This also includes headers returned by URL-Resolver plugins. - version 17.31.14 (22) - Fix build against protobuf >= 22 (fixes #465, closes #466) Port away from protobuf_generate_cpp. Upstream protobuf does not export protobuf_generate_cpp by default anymore. Use protobuf_generate instead, which is also available on older versions. - Remove SUSE < SLE11 constructs (fixes #464). - version 17.31.15 (22) - Fix negative ZYPP_LOCK_TIMEOUT not waiting forever (bsc#1213231) - Don't cleanup orphaned dirs if read-only mode was promised (bsc#1210740) - version 17.31.16 (22) - Fix wrong filesize exceeded dl abort in zyppng::Downloader (bsc#1213673) In some cases when downloading very small files we can run into issues when the URL is protected by credentials. - version 17.31.17 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - SINGLE_RPMTRANS: Respect ZYPP_READONLY_HACK when checking the zypp-rpm lock (fixes openSUSE/openSUSE-repos#29) - version 17.31.18 (22) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix zypp-tui/output/Out.h to build with clang. - Fix zypp/Arch.h for clang (fixes #478) Clang seems to have issues with picking the overload in std::men_fn if there is a static overload of a member function. We need to explicitely specify the correct type of the function pointer. To make sure this would not break compiling a application with clang that builds against libzypp this patch works around the problem. - version 17.31.19 (22) - Fixup changes for 17.31.16. Remove faulty reference to a bug actually fixed in 2019. - version 17.31.20 (22) - Attempt to delay %transfiletrigger(postun|in) execution if rpm supports it (bsc#1041742) Decide during installation whether rpm is capable of delayed %posttrans %transfiletrigger(postun|in) execution or whether we can just handle the packages %posttrans. On TW a delayed %transfiletrigger handling is possible since rpm-4.17. - Make sure the old target is deleted before a new one is created (bsc#1203760) - version 17.31.21 (22) - Preliminary disable 'rpm --runposttrans' usage for chrooted systems (bsc#1216091) This limits the %transfiletrigger(postun|in) support in the default installer if --root is used (as described in bsc#1041742). The chrooted execution of the scripts in 'rpm --runposttrans' broke in rpm-4.18. It's expected to be fixed in rpm-4.19. Then we'll enable the feature again. - fix comment typo on zypp.conf (boo#1215979) - version 17.31.22 (22) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) - Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) - Avoid using select() since it does not support fd numbers > 1024 (fixes #447) - tools/DownloadFiles: use standard zypp progress bar (fixes #489) - Revert "Color download progress bar" (fixes #475) Cyan is already used for the output of RPM scriptlets. Avoid this colorific collision between download progress bar and scriptlet output. - Fix ProgressBar's calculation of the printed tag position (fixes #494) - Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144) - Fix usage of deprecated CURL features (fixes #486) - version 17.31.24 (22) - Fix build issue with zchunk build flags (fixes #500) - version 17.31.25 (22) - Call zypp commit plugins during transactional update (fixes #506) - Add support for loongarch64 (fixes #504) - Teach MediaMultiCurl to download HTTP Multibyte ranges. - Teach zsync downloads to MultiCurl. - Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Convenient and helps documentation as it may refer to a single command for a bunch of distributions. Like e.g. "zypper ar 'https://server.my/$releasever/my.repo'". - version 17.31.26 (22) - CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) - version 17.31.27 (22) - Fix to build with libxml 2.12.x (fixes #505) - version 17.31.28 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - ProblemSolution::skipsPatchesOnly overload to handout the patches. - Remove https->http redirection exceptions for download.opensuse.org. - version 17.31.32 (22) - Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525) - New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - Tests: fix vsftpd.conf where SUSE and Fedora use different defaults (fixes #522) - Add default stripe minimum (#529) - Don't expose std::optional where YAST/PK explicitly use c++11. - Digest: Avoid using the deprecated OPENSSL_config. - version 17.32.0 (32) - Add resolver option 'removeUnneeded' to file weak remove jobs for unneeded packages (bsc#1175678) - version 17.32.1 (32) - Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) Fixed the name of the keyword to "support_superseded" as it was agreed on in jsc#OBS-301. - version 17.32.2 (32) - Update RepoStatus fromCookieFile according to the files mtime (bsc#1222086) - TmpFile: Don't call chmod if makeSibling failed. - version 17.32.3 (32) - Fix creation of sibling cache dirs with too restrictive mode (bsc#1222398) Some install workflows in YAST may lead to too restrictive (0700) raw cache directories in case of newly created repos. Later commands running with user privileges may not be able to access these repos. - version 17.32.4 (32) - Don't try to refresh volatile media as long as raw metadata are present (bsc#1223094) - version 17.32.5 (32) - Fix download from gpgkey URL (bsc#1223430, fixes openSUSE/zypper#546) - version 17.32.6 (32) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - Url: queryparams without value should not have a trailing "=". - version 17.35.16 (35) - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - Url: queryparams without value should not have a trailing "=". - version 17.35.16 (35) - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - Url: queryparams without value should not have a trailing "=". - version 17.35.16 (35) - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - single_rpmtrans: fix installation of .src.rpms (bsc#1228647) - version 17.35.9 (35) - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - Conflicts: zypper <= 1.14.76 - version 17.35.10 (35) - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267) It's preferred to explicitly tell the root directory of the system whose database you want to query. - version 17.35.11 (35) - PluginFrame: Send unescaped colons in header values (bsc#1231043) According to the STOMP protocol it would be correct to escape a colon in a header-value, but it breaks plugin receivers which do not expect this. The first colon separates header-name from header-value, so escaping in the header-value is not needed anyway. Escaping in the header-value affects especially the urlresolver plugins. The input URL is passed in a header, but sent back as raw data in the frames body. If the plugin receiver does not correctly unescape the URL we may get back a "https\c//" which is not usable. - Do not ignore return value of std::remove_if in MediaSyncFacade (fixes #579) - Fix hang in curl code with no network connection (bsc#1230912) - version 17.35.12 (35) - BuildCache: Don't try to retrieve missing raw metadata if no permission to write the cache (bsc#1225451) - RepoManager: throw RepoNoPermissionException if the user has no permission to update(write) the caches (bsc#1225451) - version 17.35.13 (35) - The 20MB download limit must not apply to non-metadata files like package URLs provided via the CLI (bsc#1233393). - version 17.35.14 (35) - Url query part: `=` is a safe char in value (bsc#1234304) - RpmDb: Recognize rpmdb.sqlite as database file (#593) - Fix typo (fixes #592) - cmake: check location of fcgi header and adjust include accordingly. On Debian and derivatives the fcgi headers are not stored in a fastcgi/ subdirectory.(#590) - version 17.35.15 (35) - Url: queryparams without value should not have a trailing "=". - version 17.35.16 (35) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - Add ZYPP_API for exported functions and switch to visibility=hidden (jsc#PED-8153) - Dynamically resolve libproxy (jsc#PED-8153) - version 17.33.0 (33) - switch to reduced size libsolv-tools-base (jsc#PED-8153) - version 17.33.1 (33) - fix up requires_eq usage for libsolv-tools-base - add one more missing export for PackageKit - version 17.33.2 - Revert eintrSafeCall behavior to setting errno to 0. - version 17.33.3 (34) - add one more missing export for libyui-qt-pkg - version 17.33.4 (35) - version 17.34.0 (34) - Fix versioning scheme - don't require libproxy1 on tumbleweed, it is optional now - zypp-tui: Make sure translated texts use the correct textdomain (fixes #551) - Skip libproxy1 requires for tumbleweed. - version 17.34.1 (34) - Workaround broken libsolv-tools-base requirements (fixes openSUSE/zypper#551) - Strip ssl_clientkey from repo urls (bsc#1226030) - Remove protobuf build dependency. - Lazily attach medium during refresh workflows (bsc#1223094) - Refactor RepoManager and add Service workflows. - version 17.34.2 (34) - Update soname due to RepoManager refactoring and cleanup. - version 17.35.0 (35) - Install zypp/APIConfig.h legacy include (fixes #557) - version 17.35.1 (35) - Keep UrlResolverPlugin API public (fixes #560) - Blacklist /snap executables for 'zypper ps' (bsc#1226014) - Fix handling of buddies when applying locks (bsc#1225267) Buddy pairs (like -release package and product) internally share the same status object. When applying locks from query results the locked bit must be set if either item is locked. - version 17.35.2 (35) - Translation: updated .pot file. - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793) Older zypp-plugins reject stomp headers including a '-'. Like the 'content-length' header we may send. - Fix int overflow in Provider (fixes #559) This patch fixes an issue in safe_strtonum which caused timestamps to overflow in the Provider message parser. - Fix error reporting on repoindex.xml parse error (bsc#1227625) - version 17.35.3 (35) - Fix typo in the geoip update pipeline (bsc#1228206) - Export RepoVariablesStringReplacer for yast2 (bsc#1228138) - version 17.35.4 (35) - Export asSolvable for YAST (bsc#1228420) - Fix 4 typos in zypp.conf. - version 17.35.5 (35) - Export CredentialManager for legacy YAST versions (bsc#1228420) - version 17.35.6 (35) - MediaPluginType must be resolved to a valid MediaHandler (bsc#1228208) - version 17.35.7 (35) - Make sure not to statically linked installed tools (bsc#1228787) - version 17.35.8 (35) - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.4. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Don't use gold for linking anymore: on s390x we use ld.bfd with LLVMgold.so, on ppc64 we disable ThinLTO for now. - Using ld.bfd on s390x exposed an issue with the existing llvm_build_tablegen_component_as_shared_library.patch: linking llvm-tblgen with libLLVM.so means we also have to link libraries used for that (like LLVMTableGenGlobalISel) with libLLVM.so. - Rewrite summary and description for llvm-gold to point out that it can also be used with ld.bfd, recommend with binutils. - Prefer RPM macros over shell scripting, so that we can better inspect the build script with substitutions in place. - More memory for stage 1 build jobs due to recent OOMs. - Add %_libclang_sonum RPM macro to llvm-devel, since that might now diverge from %_llvm_sonum. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Update to version 14.0.5. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 14.0.6. * This release contains bug-fixes for the LLVM 14.0.0 release. This release is API and ABI compatible with 14.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Add llvm-glibc-2-36.patch in order to address boo#1202215. - Add WebAssembly support for all architectures. - Use black RPM macro magic to deduplicate binary lists. This should have no effect on the generated RPM but shaves ~400 lines off the specfile and hopefully makes future maintenance easier. - Don't declare python3-clang as noarch: Python packages are installed into %{_libdir}. - Add llvm-lifetime-for-rust.patch to have Rust memory management functions considered as lifetime markers. This should aid dead store elimination to dynamically allocated memory in Rust code. - Make sure we keep -DNDEBUG. At some point %{optflags} must have lost it, perhaps because CMake usually adds it on top. So when overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF, because that's the default anyway and hasn't helped here. - Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation caused by mixing up values of the current and previous iteration. (See gh#llvm/llvm-project#56242.) - Update to version 15.0.0. * For details, see the release notes: - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html * New LLVM tools: - llvm-debuginfod: Provides debug info to remote hosts. - llvm-dwarfutil: Can copy and manipulate debug info. - llvm-remark-size-diff: Compute diff between remark files. * New Clang tools: - clang-offload-packager: Bundle multiple objects into single fat binaries including offload code. - clang-pseudo: Approximate heuristic parser for C++. - Rebase patches: * check-no-llvm-exegesis.patch * link-clang-tools-extra-shared.patch * lld-default-sha1.patch * llvm-do-not-install-static-libraries.patch * lto-disable-cache.patch - Drop patches that have landed upstream: * clang-repl-private-deps.patch * llvm-glibc-2-36.patch * llvm-scev-fix-isImpliedViaMerge.patch - Drop llvm-lifetime-for-rust.patch: this is now solved via attributes and LLVM doesn't need a hardcoded list of allocation functions anymore. - Add llvm-link-atomic.patch to fix build on ppc. - Add libcxx-test-library-path.patch to fix libc++ tests failing without RUNPATH on libc++.so. - Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l. - Thanks to Andreas Schwab for most of the rebasing! - Use correct LLVM_HOST_TRIPLE for riscv64 - Always drop -gnu from triple for consistency. Patch a test that was looking for -linux- in clang-test-xfail-gnuless-triple.patch. - Update to version 15.0.1. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.2. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.3. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix lowering of non-canonical vector comparison with zero on armv7, preventing a crash (boo#1204267, gh#llvm/llvm-project#58514). - Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.4. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.5. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Remove obsolete lldb-swig-4.1.0-build-fix.patch. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.6. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Update to version 15.0.7. * This release contains bug-fixes for the LLVM 15.0.0 release. This release is API and ABI compatible with 15.0.0. - Rebase llvm-do-not-install-static-libraries.patch. - Build stage 2 with -fno-plt on x86_64: since building with - Wl,-z,now the PLT stubs are basically dead code, so eliminating the indirection reduces the number of branches and improves code locality for the quite frequent cross-DSO calls. - Add llvm-workaround-superfluous-branches.patch: hints LLVM to eliminate branches until gh#llvm/llvm-project#28804 is solved. - update constraints to exclude workers with very slow CPU - Manage clang-cpp with update-alternatives like other binaries. Solves upgrade issues from Leap 15.5 to 15.6. [boo#1221183] - bsc#1160729: Make valid shell check only a warning * Add shadow-4.8-shell-check.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - bsc#1228770: Fix not copying of skel files Update shadow-CVE-2013-4235.patch - Remove aaa_base compat setting that is from 2003, we do not support such migration anymore - Version update to 3.12.3: * Fixed accident removal of rotated files with dateext. (#118) * Line comments inside globs in config files are now skipped. (#109) * logrotate now recovers from a corrupted state file. (#45) * createolddir now creates old directory as unprivileged user. (#114) * weekly rotations are now predictable and configurable. (#93) * Errors in config files are no longer treated as fatal errors. (#81) * configure --with-default-mail-command specifies default mail command. (#100) * Fixed heap buffer overflow when parsing crafted config file. (#33) * build fixes related to -Werror (#119) and -Werror=format= (#108) * configure --enable-werror now controls use of the -Werror flag (#123) * copy and copytruncate directives now work together again * unlink() is no longer preceded by open() unless shred is enabled (#124) * compress and uncompress now take commands from $PATH, too (#122) - By default disable werror while building - Version update to 3.13.0: * make distribution tarballs report logrotate version properly * make (un)compress work even if stdin and/or stdout are closed (#154) * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152) * uncompress logs before mailing them even if delaycompress is enabled (#151) * handle unlink of a non-existing log file as a warning only (#144) * include compile-time options in the output of logrotate --version (#145) * make logrotate --version print to stdout instead of stderr (#145) * flush write buffers before syncing state file (#148) * specify (un)compress utility explicitly in tests (#137) * enable running tests in parallel (#132) * explicitly map root UID/GID to 0 on Cygwin (#133) * add .dpkg-bak and .dpkg-del to default tabooext list (#134) - Use %license instead of %doc [bsc#1082318] - Add "Environment=HOME=/root" to logrotate.service file in order to allow mariadb to rotate its logs when the database has a root password defined [bsc#1093617] - Added patch: * logrotate-3.13.0-systemd_add_home_env.patch - Version update to 3.14.0: * make configure show support status for SELinux and ACL at the end * make logrotate build again on FreeBSD * move wtmp and btmp definitions from logrotate.conf to separate configuration files in logrotate.d * print a warning about logrotate doing nothing when -d is used * do not reject executable config files * add hardening options to logrotate.service in examples * fix spurious compressor failure when using su and compress * keep logrotate version in .tarball-version in release tarballs * introduce the hourago configuration directive * ignore empty patterns in tabooext to avoid exclusion of everything * properly report skipped test cases instead of pretending success - Use noun phrase. Trim filler wording from description. Add a note that it is unrelated to journald. - Rebase the logrotate-3.13.0-systemd_add_home_env.patch to be unified patch again - Version update to 3.15.0: * timer unit: change trigger fuzz from 12h to 1h * service unit: only run if /var/log is mounted * preserve fractional part of timestamps when compressing * re-indent source code using spaces only * minage: avoid rounding issue while comparing the amount of seconds * never remove old log files if rotate -1 is specified * return non-zero exit status if a config file contains an error * make copytruncate work with rotate 0 * warn user if both size and the time interval options are used * pass rotated log file name as the 2nd argument of the postrotate script when sharedscript is not enabled * rename logrotate-default to logrotate.conf - Added asc file. - Use systemd_ordering instead of systemd_requires - Update to 3.15.1: * use correct create mode in examples/btmp (#257) * fix several bugs found by fuzzing (#254) * do not abort globbing on a broken symlink (#251) * rearrange logrotate.8 man page to improve readability (#248) * encourage admins to use the su directive in logrotate.8 man page (#236) - Update to 3.16.0 bsc#1160281: * fix compilation with gcc-10, which defaults to -fno-common (#288) * reduce number of open() operations on state file (#282) * validate user/group given to the su directive early (#276) * add hardening options to systemd unit file in examples (#274, #291) * fix crash of logrotate on invalid configuration with include (#271) * fix heap buffer overflow on too long logfile extension (#270) - Require /usr/bin/xz instead of xz to make it working with busybox - Update to 3.17.0: * lock state file to prevent parallel execution of logrotate * add '.bak' extension to default taboo list * allow to pass a home-relative path to 'include' * 'switch_user_permanently': skip switchback check if switched to root * logrotate.service: enable 'ProtectClock' to restrict setting of clock * delete old logs hit by 'maxage' regardless of 'dateext' - Update to 3.18.0: * Allow UIDs and GIDs to be specified numerically * Add support for Zstandard compressed files * Make delaycompress not to fail with rotate 0 - update to 3.18.1: * fix memory leaks on error-handling paths * make `renamecopy` and `copytruncate` override each other * improve error handling in the parser of configuration files * improve user experience for non-privileged users of logrotate - Security fix: (bsc#1199652, CVE-2022-1348) * insecure permissions for state file creation * Added patch logrotate-CVE-2022-1348.patch * Added patch logrotate-CVE-2022-1348-follow-up.patch - Fix "logrotate emits unintended warning: keyword size not properly separated, found 0x3d" (bsc#1200278, bsc#1200802): * Added patch logrotate-dont_warn_on_size=_syntax.patch - Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864) * enforce stricter parsing to avoid CVE-2021-3864 * Added patch logrotate-enforce-stricter-parsing.patch * Added patch logrotate-enforce-stricter-parsing-extra-tests.patch - Backport 'ignoreduplicates' configuration flag (jsc#PED-10366) * Added patch logrotate-ignore-duplicates.patch * Allows log processing with duplicate logfile matches - Remove aaa_base compat setting that is from 2003, we do not support such migration anymore - Version update to 3.12.3: * Fixed accident removal of rotated files with dateext. (#118) * Line comments inside globs in config files are now skipped. (#109) * logrotate now recovers from a corrupted state file. (#45) * createolddir now creates old directory as unprivileged user. (#114) * weekly rotations are now predictable and configurable. (#93) * Errors in config files are no longer treated as fatal errors. (#81) * configure --with-default-mail-command specifies default mail command. (#100) * Fixed heap buffer overflow when parsing crafted config file. (#33) * build fixes related to -Werror (#119) and -Werror=format= (#108) * configure --enable-werror now controls use of the -Werror flag (#123) * copy and copytruncate directives now work together again * unlink() is no longer preceded by open() unless shred is enabled (#124) * compress and uncompress now take commands from $PATH, too (#122) - By default disable werror while building - Version update to 3.13.0: * make distribution tarballs report logrotate version properly * make (un)compress work even if stdin and/or stdout are closed (#154) * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152) * uncompress logs before mailing them even if delaycompress is enabled (#151) * handle unlink of a non-existing log file as a warning only (#144) * include compile-time options in the output of logrotate --version (#145) * make logrotate --version print to stdout instead of stderr (#145) * flush write buffers before syncing state file (#148) * specify (un)compress utility explicitly in tests (#137) * enable running tests in parallel (#132) * explicitly map root UID/GID to 0 on Cygwin (#133) * add .dpkg-bak and .dpkg-del to default tabooext list (#134) - Use %license instead of %doc [bsc#1082318] - Add "Environment=HOME=/root" to logrotate.service file in order to allow mariadb to rotate its logs when the database has a root password defined [bsc#1093617] - Added patch: * logrotate-3.13.0-systemd_add_home_env.patch - Version update to 3.14.0: * make configure show support status for SELinux and ACL at the end * make logrotate build again on FreeBSD * move wtmp and btmp definitions from logrotate.conf to separate configuration files in logrotate.d * print a warning about logrotate doing nothing when -d is used * do not reject executable config files * add hardening options to logrotate.service in examples * fix spurious compressor failure when using su and compress * keep logrotate version in .tarball-version in release tarballs * introduce the hourago configuration directive * ignore empty patterns in tabooext to avoid exclusion of everything * properly report skipped test cases instead of pretending success - Use noun phrase. Trim filler wording from description. Add a note that it is unrelated to journald. - Rebase the logrotate-3.13.0-systemd_add_home_env.patch to be unified patch again - Version update to 3.15.0: * timer unit: change trigger fuzz from 12h to 1h * service unit: only run if /var/log is mounted * preserve fractional part of timestamps when compressing * re-indent source code using spaces only * minage: avoid rounding issue while comparing the amount of seconds * never remove old log files if rotate -1 is specified * return non-zero exit status if a config file contains an error * make copytruncate work with rotate 0 * warn user if both size and the time interval options are used * pass rotated log file name as the 2nd argument of the postrotate script when sharedscript is not enabled * rename logrotate-default to logrotate.conf - Added asc file. - Use systemd_ordering instead of systemd_requires - Update to 3.15.1: * use correct create mode in examples/btmp (#257) * fix several bugs found by fuzzing (#254) * do not abort globbing on a broken symlink (#251) * rearrange logrotate.8 man page to improve readability (#248) * encourage admins to use the su directive in logrotate.8 man page (#236) - Update to 3.16.0 bsc#1160281: * fix compilation with gcc-10, which defaults to -fno-common (#288) * reduce number of open() operations on state file (#282) * validate user/group given to the su directive early (#276) * add hardening options to systemd unit file in examples (#274, #291) * fix crash of logrotate on invalid configuration with include (#271) * fix heap buffer overflow on too long logfile extension (#270) - Require /usr/bin/xz instead of xz to make it working with busybox - Update to 3.17.0: * lock state file to prevent parallel execution of logrotate * add '.bak' extension to default taboo list * allow to pass a home-relative path to 'include' * 'switch_user_permanently': skip switchback check if switched to root * logrotate.service: enable 'ProtectClock' to restrict setting of clock * delete old logs hit by 'maxage' regardless of 'dateext' - Update to 3.18.0: * Allow UIDs and GIDs to be specified numerically * Add support for Zstandard compressed files * Make delaycompress not to fail with rotate 0 - update to 3.18.1: * fix memory leaks on error-handling paths * make `renamecopy` and `copytruncate` override each other * improve error handling in the parser of configuration files * improve user experience for non-privileged users of logrotate - Security fix: (bsc#1199652, CVE-2022-1348) * insecure permissions for state file creation * Added patch logrotate-CVE-2022-1348.patch * Added patch logrotate-CVE-2022-1348-follow-up.patch - Fix "logrotate emits unintended warning: keyword size not properly separated, found 0x3d" (bsc#1200278, bsc#1200802): * Added patch logrotate-dont_warn_on_size=_syntax.patch - Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864) * enforce stricter parsing to avoid CVE-2021-3864 * Added patch logrotate-enforce-stricter-parsing.patch * Added patch logrotate-enforce-stricter-parsing-extra-tests.patch - Backport 'ignoreduplicates' configuration flag (jsc#PED-10366) * Added patch logrotate-ignore-duplicates.patch * Allows log processing with duplicate logfile matches - Remove aaa_base compat setting that is from 2003, we do not support such migration anymore - Version update to 3.12.3: * Fixed accident removal of rotated files with dateext. (#118) * Line comments inside globs in config files are now skipped. (#109) * logrotate now recovers from a corrupted state file. (#45) * createolddir now creates old directory as unprivileged user. (#114) * weekly rotations are now predictable and configurable. (#93) * Errors in config files are no longer treated as fatal errors. (#81) * configure --with-default-mail-command specifies default mail command. (#100) * Fixed heap buffer overflow when parsing crafted config file. (#33) * build fixes related to -Werror (#119) and -Werror=format= (#108) * configure --enable-werror now controls use of the -Werror flag (#123) * copy and copytruncate directives now work together again * unlink() is no longer preceded by open() unless shred is enabled (#124) * compress and uncompress now take commands from $PATH, too (#122) - By default disable werror while building - Version update to 3.13.0: * make distribution tarballs report logrotate version properly * make (un)compress work even if stdin and/or stdout are closed (#154) * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152) * uncompress logs before mailing them even if delaycompress is enabled (#151) * handle unlink of a non-existing log file as a warning only (#144) * include compile-time options in the output of logrotate --version (#145) * make logrotate --version print to stdout instead of stderr (#145) * flush write buffers before syncing state file (#148) * specify (un)compress utility explicitly in tests (#137) * enable running tests in parallel (#132) * explicitly map root UID/GID to 0 on Cygwin (#133) * add .dpkg-bak and .dpkg-del to default tabooext list (#134) - Use %license instead of %doc [bsc#1082318] - Add "Environment=HOME=/root" to logrotate.service file in order to allow mariadb to rotate its logs when the database has a root password defined [bsc#1093617] - Added patch: * logrotate-3.13.0-systemd_add_home_env.patch - Version update to 3.14.0: * make configure show support status for SELinux and ACL at the end * make logrotate build again on FreeBSD * move wtmp and btmp definitions from logrotate.conf to separate configuration files in logrotate.d * print a warning about logrotate doing nothing when -d is used * do not reject executable config files * add hardening options to logrotate.service in examples * fix spurious compressor failure when using su and compress * keep logrotate version in .tarball-version in release tarballs * introduce the hourago configuration directive * ignore empty patterns in tabooext to avoid exclusion of everything * properly report skipped test cases instead of pretending success - Use noun phrase. Trim filler wording from description. Add a note that it is unrelated to journald. - Rebase the logrotate-3.13.0-systemd_add_home_env.patch to be unified patch again - Version update to 3.15.0: * timer unit: change trigger fuzz from 12h to 1h * service unit: only run if /var/log is mounted * preserve fractional part of timestamps when compressing * re-indent source code using spaces only * minage: avoid rounding issue while comparing the amount of seconds * never remove old log files if rotate -1 is specified * return non-zero exit status if a config file contains an error * make copytruncate work with rotate 0 * warn user if both size and the time interval options are used * pass rotated log file name as the 2nd argument of the postrotate script when sharedscript is not enabled * rename logrotate-default to logrotate.conf - Added asc file. - Use systemd_ordering instead of systemd_requires - Update to 3.15.1: * use correct create mode in examples/btmp (#257) * fix several bugs found by fuzzing (#254) * do not abort globbing on a broken symlink (#251) * rearrange logrotate.8 man page to improve readability (#248) * encourage admins to use the su directive in logrotate.8 man page (#236) - Update to 3.16.0 bsc#1160281: * fix compilation with gcc-10, which defaults to -fno-common (#288) * reduce number of open() operations on state file (#282) * validate user/group given to the su directive early (#276) * add hardening options to systemd unit file in examples (#274, #291) * fix crash of logrotate on invalid configuration with include (#271) * fix heap buffer overflow on too long logfile extension (#270) - Require /usr/bin/xz instead of xz to make it working with busybox - Update to 3.17.0: * lock state file to prevent parallel execution of logrotate * add '.bak' extension to default taboo list * allow to pass a home-relative path to 'include' * 'switch_user_permanently': skip switchback check if switched to root * logrotate.service: enable 'ProtectClock' to restrict setting of clock * delete old logs hit by 'maxage' regardless of 'dateext' - Update to 3.18.0: * Allow UIDs and GIDs to be specified numerically * Add support for Zstandard compressed files * Make delaycompress not to fail with rotate 0 - update to 3.18.1: * fix memory leaks on error-handling paths * make `renamecopy` and `copytruncate` override each other * improve error handling in the parser of configuration files * improve user experience for non-privileged users of logrotate - Security fix: (bsc#1199652, CVE-2022-1348) * insecure permissions for state file creation * Added patch logrotate-CVE-2022-1348.patch * Added patch logrotate-CVE-2022-1348-follow-up.patch - Fix "logrotate emits unintended warning: keyword size not properly separated, found 0x3d" (bsc#1200278, bsc#1200802): * Added patch logrotate-dont_warn_on_size=_syntax.patch - Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864) * enforce stricter parsing to avoid CVE-2021-3864 * Added patch logrotate-enforce-stricter-parsing.patch * Added patch logrotate-enforce-stricter-parsing-extra-tests.patch - Backport 'ignoreduplicates' configuration flag (jsc#PED-10366) * Added patch logrotate-ignore-duplicates.patch * Allows log processing with duplicate logfile matches - Remove aaa_base compat setting that is from 2003, we do not support such migration anymore - Version update to 3.12.3: * Fixed accident removal of rotated files with dateext. (#118) * Line comments inside globs in config files are now skipped. (#109) * logrotate now recovers from a corrupted state file. (#45) * createolddir now creates old directory as unprivileged user. (#114) * weekly rotations are now predictable and configurable. (#93) * Errors in config files are no longer treated as fatal errors. (#81) * configure --with-default-mail-command specifies default mail command. (#100) * Fixed heap buffer overflow when parsing crafted config file. (#33) * build fixes related to -Werror (#119) and -Werror=format= (#108) * configure --enable-werror now controls use of the -Werror flag (#123) * copy and copytruncate directives now work together again * unlink() is no longer preceded by open() unless shred is enabled (#124) * compress and uncompress now take commands from $PATH, too (#122) - By default disable werror while building - Version update to 3.13.0: * make distribution tarballs report logrotate version properly * make (un)compress work even if stdin and/or stdout are closed (#154) * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152) * uncompress logs before mailing them even if delaycompress is enabled (#151) * handle unlink of a non-existing log file as a warning only (#144) * include compile-time options in the output of logrotate --version (#145) * make logrotate --version print to stdout instead of stderr (#145) * flush write buffers before syncing state file (#148) * specify (un)compress utility explicitly in tests (#137) * enable running tests in parallel (#132) * explicitly map root UID/GID to 0 on Cygwin (#133) * add .dpkg-bak and .dpkg-del to default tabooext list (#134) - Use %license instead of %doc [bsc#1082318] - Add "Environment=HOME=/root" to logrotate.service file in order to allow mariadb to rotate its logs when the database has a root password defined [bsc#1093617] - Added patch: * logrotate-3.13.0-systemd_add_home_env.patch - Version update to 3.14.0: * make configure show support status for SELinux and ACL at the end * make logrotate build again on FreeBSD * move wtmp and btmp definitions from logrotate.conf to separate configuration files in logrotate.d * print a warning about logrotate doing nothing when -d is used * do not reject executable config files * add hardening options to logrotate.service in examples * fix spurious compressor failure when using su and compress * keep logrotate version in .tarball-version in release tarballs * introduce the hourago configuration directive * ignore empty patterns in tabooext to avoid exclusion of everything * properly report skipped test cases instead of pretending success - Use noun phrase. Trim filler wording from description. Add a note that it is unrelated to journald. - Rebase the logrotate-3.13.0-systemd_add_home_env.patch to be unified patch again - Version update to 3.15.0: * timer unit: change trigger fuzz from 12h to 1h * service unit: only run if /var/log is mounted * preserve fractional part of timestamps when compressing * re-indent source code using spaces only * minage: avoid rounding issue while comparing the amount of seconds * never remove old log files if rotate -1 is specified * return non-zero exit status if a config file contains an error * make copytruncate work with rotate 0 * warn user if both size and the time interval options are used * pass rotated log file name as the 2nd argument of the postrotate script when sharedscript is not enabled * rename logrotate-default to logrotate.conf - Added asc file. - Use systemd_ordering instead of systemd_requires - Update to 3.15.1: * use correct create mode in examples/btmp (#257) * fix several bugs found by fuzzing (#254) * do not abort globbing on a broken symlink (#251) * rearrange logrotate.8 man page to improve readability (#248) * encourage admins to use the su directive in logrotate.8 man page (#236) - Update to 3.16.0 bsc#1160281: * fix compilation with gcc-10, which defaults to -fno-common (#288) * reduce number of open() operations on state file (#282) * validate user/group given to the su directive early (#276) * add hardening options to systemd unit file in examples (#274, #291) * fix crash of logrotate on invalid configuration with include (#271) * fix heap buffer overflow on too long logfile extension (#270) - Require /usr/bin/xz instead of xz to make it working with busybox - Update to 3.17.0: * lock state file to prevent parallel execution of logrotate * add '.bak' extension to default taboo list * allow to pass a home-relative path to 'include' * 'switch_user_permanently': skip switchback check if switched to root * logrotate.service: enable 'ProtectClock' to restrict setting of clock * delete old logs hit by 'maxage' regardless of 'dateext' - Update to 3.18.0: * Allow UIDs and GIDs to be specified numerically * Add support for Zstandard compressed files * Make delaycompress not to fail with rotate 0 - update to 3.18.1: * fix memory leaks on error-handling paths * make `renamecopy` and `copytruncate` override each other * improve error handling in the parser of configuration files * improve user experience for non-privileged users of logrotate - Security fix: (bsc#1199652, CVE-2022-1348) * insecure permissions for state file creation * Added patch logrotate-CVE-2022-1348.patch * Added patch logrotate-CVE-2022-1348-follow-up.patch - Fix "logrotate emits unintended warning: keyword size not properly separated, found 0x3d" (bsc#1200278, bsc#1200802): * Added patch logrotate-dont_warn_on_size=_syntax.patch - Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864) * enforce stricter parsing to avoid CVE-2021-3864 * Added patch logrotate-enforce-stricter-parsing.patch * Added patch logrotate-enforce-stricter-parsing-extra-tests.patch - Backport 'ignoreduplicates' configuration flag (jsc#PED-10366) * Added patch logrotate-ignore-duplicates.patch * Allows log processing with duplicate logfile matches - No longer recommend -lang: supplements are in use. - Disable LTO as it causes random build failures on some architectures (bsc#1164297) - Update to version B.02.18+git.20191228: * fix #755: handle invalid FAT * code clean-up * volumes: Add support for detecting Apple APFS fstype * partitions: Add Apple APFS GUID * specfile: Fix version issue * Do not show modified time with -notime option * Update help message and man page - Drop upstreamed patches: * lshw-help-man.patch * lshw-modified-time.patch - Add lshw-nvme.patch to support nvme devices bsc#1161323 - Update to version B.02.19.2: * New release tagged, no significant changes from previous version (git snapsho) - Drop no longer needed patches: * lshw-display-latest-version.patch * lshw-add-notime-option-to-manpage.patch * lshw-nvme.patch - Disable LTO for aarch64 & PowerPC, bypass boo#1168865 - Reenable LTO for powerpc and aarch64 - Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668 * lshw-fix-segfault-in-apfs-volume-code.patch - Fix aarch64 SIGABRT: (boo#1169668) * lshw-fix-mmc.patch - Fix detection of ppc products - boo#1172156 * lshw-fix-ppc.patch - Display UUID on Power VM LPAR (bsc#1181411 ltc#191040) * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210429: * Fix getting size of memory banks <32GiB * devtree: Add UUID property * code clean-up * improve portability (esp. musl) * fix potential crash * add static target to Makefile * Avoid crash on device-tree parsing * Add JEDEC manufacturer * Report correct memory size on SMBIOS < 2.7 * fix man page after previous update - Drop no longer needed patches: * lshw-fix-segfault-in-apfs-volume-code.patch * lshw-fix-mmc.patch * lshw-fix-ppc.patch * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210619: * Fix typos in translatable messages - jsc#SLE-19399 - Update versioning to to allow easy transition on SLE - Disable parallel build to avoid random failures - Update to version B.02.19.2+git.20211013: * add some includes * fix typo * cosmetic fixes * support for new ethtool capabilities * code clean-up * code clean-up * allow pkg-config override * allow pkg-config override * Remove unnecessary space before closing parenthesis * Translate all words of a phrase together * Fix another typo - Update to version B.02.19.2+git.20211102: * merge Github PR#77 * use max (9) Gzip compression * Add Catalan translation * Update POT file * Add more network speeds - Update to version B.02.19.2+git.20211222: * Add Spanish translation * Fix mistakes in Catalan translation - Update to version B.02.19.2+git.20220310: * Github PR85 Set product name for all netdevs sharing the same PCI number - Update to version B.02.19.2+git.20220628 (jsc#526): * make version check optional - Update to version B.02.19.2+git.20220831: * PA-RISC: handle pushd failure - Update to version B.02.19.2+git.20230320 (bsc#1209531): * fix NVMe multipath detection * NVMe: fix logical name with native multipath - Update to version B.02.19.2+git.20231115: * merge github PR #98 - Update to version B.02.20 (jsc#9912): * update changelog * update data files * get rid of GTK deprecation warning * get rid of some snprintf warnings * Add support for 100Gbit interfaces - No longer recommend -lang: supplements are in use. - Disable LTO as it causes random build failures on some architectures (bsc#1164297) - Update to version B.02.18+git.20191228: * fix #755: handle invalid FAT * code clean-up * volumes: Add support for detecting Apple APFS fstype * partitions: Add Apple APFS GUID * specfile: Fix version issue * Do not show modified time with -notime option * Update help message and man page - Drop upstreamed patches: * lshw-help-man.patch * lshw-modified-time.patch - Add lshw-nvme.patch to support nvme devices bsc#1161323 - Update to version B.02.19.2: * New release tagged, no significant changes from previous version (git snapsho) - Drop no longer needed patches: * lshw-display-latest-version.patch * lshw-add-notime-option-to-manpage.patch * lshw-nvme.patch - Disable LTO for aarch64 & PowerPC, bypass boo#1168865 - Reenable LTO for powerpc and aarch64 - Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668 * lshw-fix-segfault-in-apfs-volume-code.patch - Fix aarch64 SIGABRT: (boo#1169668) * lshw-fix-mmc.patch - Fix detection of ppc products - boo#1172156 * lshw-fix-ppc.patch - Display UUID on Power VM LPAR (bsc#1181411 ltc#191040) * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210429: * Fix getting size of memory banks <32GiB * devtree: Add UUID property * code clean-up * improve portability (esp. musl) * fix potential crash * add static target to Makefile * Avoid crash on device-tree parsing * Add JEDEC manufacturer * Report correct memory size on SMBIOS < 2.7 * fix man page after previous update - Drop no longer needed patches: * lshw-fix-segfault-in-apfs-volume-code.patch * lshw-fix-mmc.patch * lshw-fix-ppc.patch * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210619: * Fix typos in translatable messages - jsc#SLE-19399 - Update versioning to to allow easy transition on SLE - Disable parallel build to avoid random failures - Update to version B.02.19.2+git.20211013: * add some includes * fix typo * cosmetic fixes * support for new ethtool capabilities * code clean-up * code clean-up * allow pkg-config override * allow pkg-config override * Remove unnecessary space before closing parenthesis * Translate all words of a phrase together * Fix another typo - Update to version B.02.19.2+git.20211102: * merge Github PR#77 * use max (9) Gzip compression * Add Catalan translation * Update POT file * Add more network speeds - Update to version B.02.19.2+git.20211222: * Add Spanish translation * Fix mistakes in Catalan translation - Update to version B.02.19.2+git.20220310: * Github PR85 Set product name for all netdevs sharing the same PCI number - Update to version B.02.19.2+git.20220628 (jsc#526): * make version check optional - Update to version B.02.19.2+git.20220831: * PA-RISC: handle pushd failure - Update to version B.02.19.2+git.20230320 (bsc#1209531): * fix NVMe multipath detection * NVMe: fix logical name with native multipath - Update to version B.02.19.2+git.20231115: * merge github PR #98 - Update to version B.02.20 (jsc#9912): * update changelog * update data files * get rid of GTK deprecation warning * get rid of some snprintf warnings * Add support for 100Gbit interfaces - No longer recommend -lang: supplements are in use. - Disable LTO as it causes random build failures on some architectures (bsc#1164297) - Update to version B.02.18+git.20191228: * fix #755: handle invalid FAT * code clean-up * volumes: Add support for detecting Apple APFS fstype * partitions: Add Apple APFS GUID * specfile: Fix version issue * Do not show modified time with -notime option * Update help message and man page - Drop upstreamed patches: * lshw-help-man.patch * lshw-modified-time.patch - Add lshw-nvme.patch to support nvme devices bsc#1161323 - Update to version B.02.19.2: * New release tagged, no significant changes from previous version (git snapsho) - Drop no longer needed patches: * lshw-display-latest-version.patch * lshw-add-notime-option-to-manpage.patch * lshw-nvme.patch - Disable LTO for aarch64 & PowerPC, bypass boo#1168865 - Reenable LTO for powerpc and aarch64 - Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668 * lshw-fix-segfault-in-apfs-volume-code.patch - Fix aarch64 SIGABRT: (boo#1169668) * lshw-fix-mmc.patch - Fix detection of ppc products - boo#1172156 * lshw-fix-ppc.patch - Display UUID on Power VM LPAR (bsc#1181411 ltc#191040) * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210429: * Fix getting size of memory banks <32GiB * devtree: Add UUID property * code clean-up * improve portability (esp. musl) * fix potential crash * add static target to Makefile * Avoid crash on device-tree parsing * Add JEDEC manufacturer * Report correct memory size on SMBIOS < 2.7 * fix man page after previous update - Drop no longer needed patches: * lshw-fix-segfault-in-apfs-volume-code.patch * lshw-fix-mmc.patch * lshw-fix-ppc.patch * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210619: * Fix typos in translatable messages - jsc#SLE-19399 - Update versioning to to allow easy transition on SLE - Disable parallel build to avoid random failures - Update to version B.02.19.2+git.20211013: * add some includes * fix typo * cosmetic fixes * support for new ethtool capabilities * code clean-up * code clean-up * allow pkg-config override * allow pkg-config override * Remove unnecessary space before closing parenthesis * Translate all words of a phrase together * Fix another typo - Update to version B.02.19.2+git.20211102: * merge Github PR#77 * use max (9) Gzip compression * Add Catalan translation * Update POT file * Add more network speeds - Update to version B.02.19.2+git.20211222: * Add Spanish translation * Fix mistakes in Catalan translation - Update to version B.02.19.2+git.20220310: * Github PR85 Set product name for all netdevs sharing the same PCI number - Update to version B.02.19.2+git.20220628 (jsc#526): * make version check optional - Update to version B.02.19.2+git.20220831: * PA-RISC: handle pushd failure - Update to version B.02.19.2+git.20230320 (bsc#1209531): * fix NVMe multipath detection * NVMe: fix logical name with native multipath - Update to version B.02.19.2+git.20231115: * merge github PR #98 - Update to version B.02.20 (jsc#9912): * update changelog * update data files * get rid of GTK deprecation warning * get rid of some snprintf warnings * Add support for 100Gbit interfaces - No longer recommend -lang: supplements are in use. - Disable LTO as it causes random build failures on some architectures (bsc#1164297) - Update to version B.02.18+git.20191228: * fix #755: handle invalid FAT * code clean-up * volumes: Add support for detecting Apple APFS fstype * partitions: Add Apple APFS GUID * specfile: Fix version issue * Do not show modified time with -notime option * Update help message and man page - Drop upstreamed patches: * lshw-help-man.patch * lshw-modified-time.patch - Add lshw-nvme.patch to support nvme devices bsc#1161323 - Update to version B.02.19.2: * New release tagged, no significant changes from previous version (git snapsho) - Drop no longer needed patches: * lshw-display-latest-version.patch * lshw-add-notime-option-to-manpage.patch * lshw-nvme.patch - Disable LTO for aarch64 & PowerPC, bypass boo#1168865 - Reenable LTO for powerpc and aarch64 - Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668 * lshw-fix-segfault-in-apfs-volume-code.patch - Fix aarch64 SIGABRT: (boo#1169668) * lshw-fix-mmc.patch - Fix detection of ppc products - boo#1172156 * lshw-fix-ppc.patch - Display UUID on Power VM LPAR (bsc#1181411 ltc#191040) * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210429: * Fix getting size of memory banks <32GiB * devtree: Add UUID property * code clean-up * improve portability (esp. musl) * fix potential crash * add static target to Makefile * Avoid crash on device-tree parsing * Add JEDEC manufacturer * Report correct memory size on SMBIOS < 2.7 * fix man page after previous update - Drop no longer needed patches: * lshw-fix-segfault-in-apfs-volume-code.patch * lshw-fix-mmc.patch * lshw-fix-ppc.patch * lshw-devtree-Add-UUID-property.patch - Update to version B.02.19+git.20210619: * Fix typos in translatable messages - jsc#SLE-19399 - Update versioning to to allow easy transition on SLE - Disable parallel build to avoid random failures - Update to version B.02.19.2+git.20211013: * add some includes * fix typo * cosmetic fixes * support for new ethtool capabilities * code clean-up * code clean-up * allow pkg-config override * allow pkg-config override * Remove unnecessary space before closing parenthesis * Translate all words of a phrase together * Fix another typo - Update to version B.02.19.2+git.20211102: * merge Github PR#77 * use max (9) Gzip compression * Add Catalan translation * Update POT file * Add more network speeds - Update to version B.02.19.2+git.20211222: * Add Spanish translation * Fix mistakes in Catalan translation - Update to version B.02.19.2+git.20220310: * Github PR85 Set product name for all netdevs sharing the same PCI number - Update to version B.02.19.2+git.20220628 (jsc#526): * make version check optional - Update to version B.02.19.2+git.20220831: * PA-RISC: handle pushd failure - Update to version B.02.19.2+git.20230320 (bsc#1209531): * fix NVMe multipath detection * NVMe: fix logical name with native multipath - Update to version B.02.19.2+git.20231115: * merge github PR #98 - Update to version B.02.20 (jsc#9912): * update changelog * update data files * get rid of GTK deprecation warning * get rid of some snprintf warnings * Add support for 100Gbit interfaces - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Update to release 2.0.2 - Update to release 2.0.3 - Upgrade to version 2.1.1 (FATE#314846) Changelog 2.1.1: * Fix: update next_net_seq_num after sending header * Fix: wrong loop continuation in metadata thread * Fix: lttng create session memleaks * Fix: remove unused session id map * Fix: wrong session id used on relayd lookup * Fix: add missing UST abi header for make dist * Fix: add missing rcu read side lock/unlock Changelog 2.1.0: * STABLE VERSION 2.1.0-stable - "Basse Messe" * Multiple minor fixes * Multiple memory and fd leaks * Fix: Off by one in seq num for data pending command * Fix: flag metadata stream on quiescent control cmd * Fix: prioritize control socket communication in relayd * Fix: poll and epoll fd set reallocation * Fix: add missing goto pending if data is inflight * Fix: remove ua_sess->started assert on stop trace * Set classes of traffic in high_throughput_limit * Fix: use the poll wait ret value when iterating on fd(s) * Fix: force the poll() return value to be nb_fd * Fix: Wrong check of node when cleaning up ht * Fix: set started flag of ust app after ustctl * Fix: memory leak in add relayd socket error path * Fix: add packed attribute to filter structure * Fix: Add missing health code update for consumer command * Add LTTNG_PACKED macro * Fix data pending for inflight streaming * Map session id of relayd and sessiond in consumer * Add the relayd create session command * Make the consumer sends a ACK after each command * Remove MSG_WAITALL on every recvmsg() socket typ * Fix: Add missing relayd ht cleanup and ht destroy * Fix: Relayd and sessiond version check * Fix: protect consumer_find_channel with rcu locking * Fix: don't steal key when adding a metadata stream * Consumer hold stream mutex for add stream Changelog 2.1.0-rc9: * Fix: set the stream ht static in consumer file * Update sessiond man page with new env var * Update lttng.1 man page * Fix: enable-consumer for all domains missing dir * Fix: Add missing fct prototypes when disabling UST * Fix a typo in lttng-probe-module name * Assign values to enum lttcomm_sessiond_command * Fix: run health test only if root * Clarify empty string/NULL filter errors * Fix: add missing padding for UST filter Changelog 2.1.0-rc8: * Fix: Uninit. variable in lttng view * Add already enabled UST event error code * lttng.h API update: set filter becomes enable event with filter * Change the UST event hash table match function * Pass lttng_event struct to the set_filter API call * Adding context to an event is no longer possible * Add UST overlap tests * Add filter sequence number to UST * Fix: Typo from a previous patch in an assert() * Fix: Warn if session is running with lttng view * Fix: Add bash requirement to README for make check * Fix: add the notion of domain to lttng.1 man page * Enable additional kernel probes * Update CodingStyle * Use the new functions for default subbuf sizes * Add default subbuf sizes getter functions * Add max() and min() macro in common Changelog 2.1.0-rc7: * Fix: Add pointer check when freeing poll events * Fix: FD leak on thread error * Fix: Wrong fd used by kernel_wait_quiescent * Support new lttng-ust error code * Fix: Don't set filter if enable event fails * Fix: Wrong data port when listing session * Fix: Enable event after start command * Fix: Teardown of thread_manage_clients on failure of listen/create_poll * Add a timeout to UST application socket * Fix: Consumerd error socket connect race * Fix: Set CLOEXEC flag on every created sockets * Remove consumer poll timeout in data thread * Fix: RCU hash table seed * Fix: Do not install health tests helper libraries * Fix: Create default channel on add-context if none * Support new liblttng-ust-ctl error code * Fix: Add EPIPE error handling on buffer splice * Fix: Channel creation error return code was not set * Fix: Wrong poll events on UST application socket * Fix: Remove dependency to urcu-cds in tools tests * Fix: Missing librt dependency in configure check for lttng-ust-ctl * Fix: Don't append datetime to default session name * Fix: Deny session creation name 'auto' * Fix: Add space for stream name CPU number * Fix: Add output option to enable-channel command Changelog 2.1.0-rc6: * Tests: Add filtering tests for uncovered cases * Fix: Sync issue when deleting a data stream * Rename data_available to data_pending * Fix: consumer health state * Fix: Add the ACCOUNTING flag to ht creation and set bucket size to 0 * Fix: Bad return error code handling * Fix: Use after free() of the rundir string * Fix: Cleanup UST app session on ustctl create session error * Fix: add missing pthread_join in sessiond * Fix: free running directory string * Fix: UST app clean list node usage * Add liblttng-ctl destructor to cleanup memory * Fix: Cleanup URIs on teardown * Fix: relayd memleaks * Fix: Memory leaks of allocated URIs * Fix: consumer output memory leak on creation * Fix: missing addrlen initialization before accept(2) * Fix: relayd trace file padding memleak * Fix: Remove useless consumer subdir string concatenation * Fix: lttng create allocated path memleak * Fix: Cppcheck memleakOnRealloc mistake * Fix: Synchronization issue for data available command * Fix: consumer relayd cleanup on disconnect * Fix: Handle the unary bitwise negation operator (~) in the XML printer * Fix: Possible memory leaks when creating filter IR root node * Fix: Delete stream on write error in consumer * Fix: Error handling when sending relayd sockets to consumer * Add stream lock comment for nesting * Fix: Mutex and RCU lock nesting in consumer * Fix: Uninitialized ret code * Fix: Remove bad condition and fix overflow issue * Fix: consumerd pthread error flow * Fix: Set a single return point and mutex unlock * Fix: Remove useless NULL and zero assignment * Fix: segfault on create session with two URLs Changelog 2.1.0-rc5: * Fix: Remove network stream ID ABI calls * Tests: Add filtering tests * Wait for data availability when stopping a session * Relayd data available command support * Lib lttng-ctl data available command support * Consumer daemon data available command support * Add data structure for the data available command * Change the metadata hash table node * Make stream hash tables global to the consumer * Move add data stream to the data thread * Rename consumer threads and spawn them in daemon * Fix: relayd close stream command was not working * Fix: Relayd and consumerd socket leaks * Fix: Missing -ENODATA handling in the consumer * Fix: Empty metadata buffer(s) on HUP|ERR * ABI with support for compat 32/64 bits * Fix: Stream allocation and insertion consistency * Fix: output number of bytes written by relayd * Add hash table argument to helper functions * Fix: Add missing call rcu and read side lock * Tests: Fix LD_PRELOAD library lookup path for health tests * Fix: Add arbitrary wait period for kernel streaming test * Fix coding style and add/change debug statements * Fix: Build out of src tree * Tests: Add health check tests to configure * Tests: Add health check thread stall test * Tests: Add health check thread exit test * Tests: Add a health check utility program * Add testpoints in lttng-sessiond for each threads * New testpoint mechanism to instrument binaries for testing * Fix: off-by-one in comm proto between lttng-ctl and sessiond * Fix: Metadata stream leak when received in consumer * Fix: consumer_allocate_stream error handling * Fix: consumer should await for initial streams * Fix: Missing rcu read side lock in consumer Changelog 2.1.0-rc4: * Fix: Change sempahore to pthread conditions * Fix: relayd relay_send_version: handle sscanf return code * Fix relayd: NULL ptr deref * Fix: relayd: possible NULL ptr deref, memory leak, accept fd leak * Tests: add print bytecode to filter grammar test * Cleanup: assign values to bytecode opcodes * Fix: Filter: Fix allocation length error * Fix: Filter: add missing ast free * Tests: Add high throughput with bandwidth limits test * Fix: Returned code when listing kernel channel * Tests: Rename helper functions to have consistent names * Tests: Cleanup redundant code and use printing helper functions * Tests: Add helper functions for printing status and banner * Tests: Add a check for color support when printing status * Fix: Lib lttng-ctl on error returns lttng code * Fix: lttng_set_event_filter() was returning bad error code * Fix: printing [no write] on lttng list -uf * Fix: Disable event on filter error with lttng * Fix: Wrong returned error code on UST enable event * Add consumer commands to lttng.1 man page * Add lttng_health_check(3) man page * Fix: Remove LPOLLNVAL from consumer metadata revents * Fix: Mismatch of field name between ust and tools * Add the written value when listing fields * Fix: Consumer return value check after mmap/splice * Don't send the subbuffer padding for streaming * Fix: Returned error code in consumer on read buffer Changelog 2.1.0-rc3: * Fix: Relayd fix ret value when adding a connection * Add new thread in consumer for metadata handling * Fix: consumer recv command error path * Fix filter: fix recent regressions * Update lttng-ust-abi.h from upstream lttng-ust * Fix: Accept bytecode of length 65536 bytes * Fix: Generation of bytecode longer than 32768 bytes fails * Fix: Filter bytecode alloc buffer size must be a power of 2 * Add lttng-ctl SWIG python bindings * Add C++ support to API header files * Librarify filter in liblttng-ctl and hide symbols * Set hidden visibility for calls used in lttng-ctl * Notify the user if a filter is already enabled * Install lttng-error.h and include it in lttng.h * Add lttng-error.h containing every API err. code * Fix: missing hostname context Changelog 2.1.0-rc2: * Fix: put back 2.0 output text for lttng create cmd * Fix: remove set subdir call that uses bad ptr * Filter: Handle the unary bitwise not operator (~) with an unsupported * Fix: missing mutex unlock on register consumer err * Remove underscore from ifndef of lttng.h * Remove unused define in lttng.h * Standardize lttng command line usage text * Merge duplicate code in consumer for destroy relayd * Merge duplicate code in consumer for add relayd * Fix: Possible buffer overflows in strncat() usage * Move code out of main.c and fix some issues Changelog 2.1.0-rc1: * Feature: Network Streaming * Add the lttng-relayd binary for network streaming * Support user space tracer filtering * Multiple fixes - Update to version 2.3.1 - Update to version 2.4.0. Changelog for changes between 2.3.0 and 2.4.0 may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=refs/heads/stable-2.4 - Update to version 2.4.1 Changelog: * Fix: don't delete stream from connection recv list * Fix: use after free of a relayd stream * Fix: don't print stream name in error message * Fix: take session list lock when listing tp * Fix: add consumer wake up pipe to avoid race * Fix: don't spawn relayd if URL is provided * Fix: don't ask data pending if session was not started * Fix: missing test file in EXTRA dist * Fix: allow empty URL for live session creation * Fix: missing valid return code when adding an URI to consumer * Fix: syntax error in lttng.1 * Fix: check relayd fd leak in lttng cmdline * Fix: remove unused tp in high-throughput test * Use autoconf AM_MAINTAINER_MODE. * Fix: clang 'constant-out-of-range-compare' warning * Fix: Unchecked session pointer when destroying a connection in relayd - Add dependancy on babeltrace and recommend kmps (bnc#872688) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Add Fix-Crash-when-unregistering-UST-apps-during-shutdow.patch: Fix crash when unregistering UST apps during shutdown (bsc#1230128) - Update to release 2.0.3 - Upgrade to version 2.1.1 (FATE#314846) Changelog 2.1.1: * Fix: update next_net_seq_num after sending header * Fix: wrong loop continuation in metadata thread * Fix: lttng create session memleaks * Fix: remove unused session id map * Fix: wrong session id used on relayd lookup * Fix: add missing UST abi header for make dist * Fix: add missing rcu read side lock/unlock Changelog 2.1.0: * STABLE VERSION 2.1.0-stable - "Basse Messe" * Multiple minor fixes * Multiple memory and fd leaks * Fix: Off by one in seq num for data pending command * Fix: flag metadata stream on quiescent control cmd * Fix: prioritize control socket communication in relayd * Fix: poll and epoll fd set reallocation * Fix: add missing goto pending if data is inflight * Fix: remove ua_sess->started assert on stop trace * Set classes of traffic in high_throughput_limit * Fix: use the poll wait ret value when iterating on fd(s) * Fix: force the poll() return value to be nb_fd * Fix: Wrong check of node when cleaning up ht * Fix: set started flag of ust app after ustctl * Fix: memory leak in add relayd socket error path * Fix: add packed attribute to filter structure * Fix: Add missing health code update for consumer command * Add LTTNG_PACKED macro * Fix data pending for inflight streaming * Map session id of relayd and sessiond in consumer * Add the relayd create session command * Make the consumer sends a ACK after each command * Remove MSG_WAITALL on every recvmsg() socket typ * Fix: Add missing relayd ht cleanup and ht destroy * Fix: Relayd and sessiond version check * Fix: protect consumer_find_channel with rcu locking * Fix: don't steal key when adding a metadata stream * Consumer hold stream mutex for add stream Changelog 2.1.0-rc9: * Fix: set the stream ht static in consumer file * Update sessiond man page with new env var * Update lttng.1 man page * Fix: enable-consumer for all domains missing dir * Fix: Add missing fct prototypes when disabling UST * Fix a typo in lttng-probe-module name * Assign values to enum lttcomm_sessiond_command * Fix: run health test only if root * Clarify empty string/NULL filter errors * Fix: add missing padding for UST filter Changelog 2.1.0-rc8: * Fix: Uninit. variable in lttng view * Add already enabled UST event error code * lttng.h API update: set filter becomes enable event with filter * Change the UST event hash table match function * Pass lttng_event struct to the set_filter API call * Adding context to an event is no longer possible * Add UST overlap tests * Add filter sequence number to UST * Fix: Typo from a previous patch in an assert() * Fix: Warn if session is running with lttng view * Fix: Add bash requirement to README for make check * Fix: add the notion of domain to lttng.1 man page * Enable additional kernel probes * Update CodingStyle * Use the new functions for default subbuf sizes * Add default subbuf sizes getter functions * Add max() and min() macro in common Changelog 2.1.0-rc7: * Fix: Add pointer check when freeing poll events * Fix: FD leak on thread error * Fix: Wrong fd used by kernel_wait_quiescent * Support new lttng-ust error code * Fix: Don't set filter if enable event fails * Fix: Wrong data port when listing session * Fix: Enable event after start command * Fix: Teardown of thread_manage_clients on failure of listen/create_poll * Add a timeout to UST application socket * Fix: Consumerd error socket connect race * Fix: Set CLOEXEC flag on every created sockets * Remove consumer poll timeout in data thread * Fix: RCU hash table seed * Fix: Do not install health tests helper libraries * Fix: Create default channel on add-context if none * Support new liblttng-ust-ctl error code * Fix: Add EPIPE error handling on buffer splice * Fix: Channel creation error return code was not set * Fix: Wrong poll events on UST application socket * Fix: Remove dependency to urcu-cds in tools tests * Fix: Missing librt dependency in configure check for lttng-ust-ctl * Fix: Don't append datetime to default session name * Fix: Deny session creation name 'auto' * Fix: Add space for stream name CPU number * Fix: Add output option to enable-channel command Changelog 2.1.0-rc6: * Tests: Add filtering tests for uncovered cases * Fix: Sync issue when deleting a data stream * Rename data_available to data_pending * Fix: consumer health state * Fix: Add the ACCOUNTING flag to ht creation and set bucket size to 0 * Fix: Bad return error code handling * Fix: Use after free() of the rundir string * Fix: Cleanup UST app session on ustctl create session error * Fix: add missing pthread_join in sessiond * Fix: free running directory string * Fix: UST app clean list node usage * Add liblttng-ctl destructor to cleanup memory * Fix: Cleanup URIs on teardown * Fix: relayd memleaks * Fix: Memory leaks of allocated URIs * Fix: consumer output memory leak on creation * Fix: missing addrlen initialization before accept(2) * Fix: relayd trace file padding memleak * Fix: Remove useless consumer subdir string concatenation * Fix: lttng create allocated path memleak * Fix: Cppcheck memleakOnRealloc mistake * Fix: Synchronization issue for data available command * Fix: consumer relayd cleanup on disconnect * Fix: Handle the unary bitwise negation operator (~) in the XML printer * Fix: Possible memory leaks when creating filter IR root node * Fix: Delete stream on write error in consumer * Fix: Error handling when sending relayd sockets to consumer * Add stream lock comment for nesting * Fix: Mutex and RCU lock nesting in consumer * Fix: Uninitialized ret code * Fix: Remove bad condition and fix overflow issue * Fix: consumerd pthread error flow * Fix: Set a single return point and mutex unlock * Fix: Remove useless NULL and zero assignment * Fix: segfault on create session with two URLs Changelog 2.1.0-rc5: * Fix: Remove network stream ID ABI calls * Tests: Add filtering tests * Wait for data availability when stopping a session * Relayd data available command support * Lib lttng-ctl data available command support * Consumer daemon data available command support * Add data structure for the data available command * Change the metadata hash table node * Make stream hash tables global to the consumer * Move add data stream to the data thread * Rename consumer threads and spawn them in daemon * Fix: relayd close stream command was not working * Fix: Relayd and consumerd socket leaks * Fix: Missing -ENODATA handling in the consumer * Fix: Empty metadata buffer(s) on HUP|ERR * ABI with support for compat 32/64 bits * Fix: Stream allocation and insertion consistency * Fix: output number of bytes written by relayd * Add hash table argument to helper functions * Fix: Add missing call rcu and read side lock * Tests: Fix LD_PRELOAD library lookup path for health tests * Fix: Add arbitrary wait period for kernel streaming test * Fix coding style and add/change debug statements * Fix: Build out of src tree * Tests: Add health check tests to configure * Tests: Add health check thread stall test * Tests: Add health check thread exit test * Tests: Add a health check utility program * Add testpoints in lttng-sessiond for each threads * New testpoint mechanism to instrument binaries for testing * Fix: off-by-one in comm proto between lttng-ctl and sessiond * Fix: Metadata stream leak when received in consumer * Fix: consumer_allocate_stream error handling * Fix: consumer should await for initial streams * Fix: Missing rcu read side lock in consumer Changelog 2.1.0-rc4: * Fix: Change sempahore to pthread conditions * Fix: relayd relay_send_version: handle sscanf return code * Fix relayd: NULL ptr deref * Fix: relayd: possible NULL ptr deref, memory leak, accept fd leak * Tests: add print bytecode to filter grammar test * Cleanup: assign values to bytecode opcodes * Fix: Filter: Fix allocation length error * Fix: Filter: add missing ast free * Tests: Add high throughput with bandwidth limits test * Fix: Returned code when listing kernel channel * Tests: Rename helper functions to have consistent names * Tests: Cleanup redundant code and use printing helper functions * Tests: Add helper functions for printing status and banner * Tests: Add a check for color support when printing status * Fix: Lib lttng-ctl on error returns lttng code * Fix: lttng_set_event_filter() was returning bad error code * Fix: printing [no write] on lttng list -uf * Fix: Disable event on filter error with lttng * Fix: Wrong returned error code on UST enable event * Add consumer commands to lttng.1 man page * Add lttng_health_check(3) man page * Fix: Remove LPOLLNVAL from consumer metadata revents * Fix: Mismatch of field name between ust and tools * Add the written value when listing fields * Fix: Consumer return value check after mmap/splice * Don't send the subbuffer padding for streaming * Fix: Returned error code in consumer on read buffer Changelog 2.1.0-rc3: * Fix: Relayd fix ret value when adding a connection * Add new thread in consumer for metadata handling * Fix: consumer recv command error path * Fix filter: fix recent regressions * Update lttng-ust-abi.h from upstream lttng-ust * Fix: Accept bytecode of length 65536 bytes * Fix: Generation of bytecode longer than 32768 bytes fails * Fix: Filter bytecode alloc buffer size must be a power of 2 * Add lttng-ctl SWIG python bindings * Add C++ support to API header files * Librarify filter in liblttng-ctl and hide symbols * Set hidden visibility for calls used in lttng-ctl * Notify the user if a filter is already enabled * Install lttng-error.h and include it in lttng.h * Add lttng-error.h containing every API err. code * Fix: missing hostname context Changelog 2.1.0-rc2: * Fix: put back 2.0 output text for lttng create cmd * Fix: remove set subdir call that uses bad ptr * Filter: Handle the unary bitwise not operator (~) with an unsupported * Fix: missing mutex unlock on register consumer err * Remove underscore from ifndef of lttng.h * Remove unused define in lttng.h * Standardize lttng command line usage text * Merge duplicate code in consumer for destroy relayd * Merge duplicate code in consumer for add relayd * Fix: Possible buffer overflows in strncat() usage * Move code out of main.c and fix some issues Changelog 2.1.0-rc1: * Feature: Network Streaming * Add the lttng-relayd binary for network streaming * Support user space tracer filtering * Multiple fixes - Update to version 2.3.1 - Update to version 2.4.0. Changelog for changes between 2.3.0 and 2.4.0 may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=refs/heads/stable-2.4 - Update to version 2.4.1 Changelog: * Fix: don't delete stream from connection recv list * Fix: use after free of a relayd stream * Fix: don't print stream name in error message * Fix: take session list lock when listing tp * Fix: add consumer wake up pipe to avoid race * Fix: don't spawn relayd if URL is provided * Fix: don't ask data pending if session was not started * Fix: missing test file in EXTRA dist * Fix: allow empty URL for live session creation * Fix: missing valid return code when adding an URI to consumer * Fix: syntax error in lttng.1 * Fix: check relayd fd leak in lttng cmdline * Fix: remove unused tp in high-throughput test * Use autoconf AM_MAINTAINER_MODE. * Fix: clang 'constant-out-of-range-compare' warning * Fix: Unchecked session pointer when destroying a connection in relayd - Add dependancy on babeltrace and recommend kmps (bnc#872688) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Add Fix-Crash-when-unregistering-UST-apps-during-shutdow.patch: Fix crash when unregistering UST apps during shutdown (bsc#1230128) - Update to version 2.7.0-rc1 (FATE#319273) Changelog for differences between 2.4.0 and this point may be found at: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=1808007961cfaa7f915e44424f790e616219a361 - Upgrade to release version 2.7.0 (FATE#319273) http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.0 to view changelog from v2.7.0-rc1 to v2.7.0 - Update to bugfix release 2.7.1 for SLE12SP2 Changelog: http://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.7.1 - add ppc64/ppc64le in ExclusiveArch - Update to version 3.10 for SLE15 (bsc#1055683) - Adhere to shared library policy (new lib: liblttng-ctl$sover) - Do not package static libraries - Fix typo in package summary - Rectify RPM groups. Remove redundant %clean section. Replace old RPM macros. - Add lttng-tools-fix-pkgconfig.patch: Add missing dependencies to lttng-ctl.pc. - Build for aarch64. - Spec cleanup. - Update to version 2.10.2: * Do not flag consumer as disabled on relayd comm failure. * Cleanup inactive FDs in the consumer polling thread. * man: Document dead-peer detection for lttng-relayd. * lttng-relayd: Use the TCP keep-alive mechanism to detect a dead-peer. * Tests: race between consumer pause and trace start/stop. * Fix notification thread being not notified of channel creation on application error. * Fix using putenv() and free()-ing the value is invalid. * Fix unknown consumer type considered a libc error. * Fix that consumerd(64/32)_lib_dir can be NULL. * Fix a nonsensical message printed by lttng track/untrack. * Fix O_CLOEXEC being erroneously used on pipe creation. * Fix a wrong parameter to fcntl in pipe_set_flag. * Use lttng_clock_gettime instead of clock_gettime. * Close channel monitor pipe after killing the metadata_timer_thread. * Use file based synchronisation for python logging test. * Test: Add file based synchronisation point for the Python test application. * Fix wrong use of the relay_streams_sent in snapshot. * Fix the return code of lttcomm_send_unix_sock signed. * Fix a src/bin/lttng/utils.c: cast incompatible pointer warning. * Fix: src/common/pipe.h: include <sys/types.h> for ssize_t and mode_t. * Fix detect dlmopen() and disable corresponding tests if not available. * Use tmpdir for intermediary files. * Fix include scripts for distribution. * Fix a typo in lttng-consumerd file default. * Fix missing NULL checks in logging statements. * Test: Kernel testing for notification. * Kernel consumerd sock paths need rundir substitution. * Create lttng run dir regardless of user privilege. * Make version.h generation work with dash. * lttng-enable-event(1): filtering: Specify that `$ctx.cpu_id` is available. * Centralise sessiond config option handling. * Fix buffer overflow warning in python bindings. * Tests fix: BT2 does not output the metadata of a trace collection. - Update to version 2.10.4 (changes since 2.10.2): * Fix: Set errno with value from SO_ERROR on error. * Fix: Missing value handling for lttng_event_context_type. * Fix: Use SOL_SOCKET level for SO_KEEPALIVE on all platform. * Fix: Error out on leftover arguments. * Fix: Reply to version check even on protocol mismatch. * Fix: Error handling on relay version check. * Document add-context limitation for started session. * Fix: add-context cannot be performed after a session has been started. * Fix: Duplicated kernel consumer socket locking. * Fix: Remove unused event types in MI XML schema. * Tests: Cleanly exit from test apps on reception of SIGTERM. * Document consumer socket locking assumptions. * Fix: Consumer socket lock not held during snapshot record. * Fix: set_relayd_for_snapshot does not acquire the consumer socket lock. * Fix: send_channel_monitor_pipe does not take the consumer socket lock. * Document the locking assumptions of consumerd-relayd socket passing. * Assert that the consumer lock is held while sending FDs to consumerd. * Assert that the consumer socket lock is taken during communication. * Tests: Refuse to run test suite if lttng processes are present. * Fix: Metadata channel leak when using the snapshot tracing mode. * Fix build: in_git_repo is used before being set. * Add DBG statement for TCP keep-alive options. * Fix: Unprivilieged sessiond agent port clashes with root sessiond. * Fix: Erroneous use of extern keyword. * Fix: Failure to launch agent thread is not reported. * Fix: Agent may not be ready on launch. * Fix: Checking for existing session daemon is done after daemonising. * Fix: lttng logs nanoseconds. * Fix: stream_per_chan_id_ht should allow duplicates. * Fix: relayd send_command() util not logging on failure. * Fix: Create_output_path() relayd util is not const-correct. * Fix: Kernel snapshot handling of EAGAIN. * Fix validate_trace_empty test check. * Fix: Circular inclusion of lttng.h results in warning. * Fix: Channel lock must be taken to check for pending notifications. * Fix: Quiet option is not set in sessiond-config. * Fix: Hold consumer socket lock for consumer_send_msg. * Fix: Use off_t type for lseek function return value to avoid overflow. * Fix: Double similar condition. - Use tarball signing. - Update to version 2.10.5: * Fix: missing context enum values in session xml schema. * Tests: add session auto-loading test cases. * Bash completion: ignore namespace for xmllint parsing. * Typo in ust consumer log message (channek -> channel). * Fix: use signed variable for refcounting of consumer_relayd_sock_pair. * Fix: warning due to hash_key_str() being not const-correct. * Print consumerd32/64/kernel configuration. * Fix: calling ht_{hash, match}_enum with wrong argument. * Fix: probes should be compared strictly by events metadata. * Fix: test_ust-dl is generated at configure-time. * Fix: cmd line options overwrite env variable config options. * Fix: perform the initialization memory barrier out of loop body. * Port: fix format warnings on Cygwin. * Add missing include for ssize_t on Cygwin. * Fix: sessions with agent channels fail to load. * Fix: don't wait for the load thread before serving client commands. * Fix: sessiond fails to launch on --without-ust configuration. * Fix: agent thread poll set creation failure results in deadlock. * Fix: test uses sizeof() on the wrong operand of strncpy. * Fix: ret may be used uninitialized in sample_channel_positions(). - Add gpl-2.0.txt and lgpl-2.1.txt to the library packages with the %license tag. - Update to version 2.11.2: * See /usr/share/doc/packages/lttng-tools/ChangeLog - Drop support for old openSUSE versions. - Update to version 2.12.2 Changelog: https://git.lttng.org/?p=lttng-tools.git;a=blob_plain;f=ChangeLog;hb=v2.12.2 - Add signed bz2 support (keyring) - Add Fix-ust-UST-communication-can-return-EAGAIN.patch: Fix UST communication when -EAGAIN is returned which leads to lttng-sessiond abort (bsc#1218508) - Add Fix-Crash-when-unregistering-UST-apps-during-shutdow.patch: Fix crash when unregistering UST apps during shutdown (bsc#1230128) - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - LVM2 mirror attached to another node couldn't be converted into linear LV (bsc#1231796) + bug-1231796_lvconvert-fix-lvconvert-m-0-for-in-sync-legs.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - comment out lvm.conf item preferred_names by default (bsc#1179738) - comment out preferred_names - back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319) + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch + bug-1181319_05-cov-check-sscanf-result.patch - revert commit which caused a regression: lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) - change lvm.conf item external_device_info_source from none to udev - Add metadata-based autoactivation property for VG and LV (bsc#1178680) + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - LVM cannot be disabled on boot (bsc#1184687) + bug-1184687_Add-nolvm-for-kernel-cmdline.patch - Update patch for avoiding apply warning message + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch - Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190) + bug-1185190_01-pvscan-support-disabled-event_activation.patch + bug-1185190_02-config-improve-description-for-event_activation.patch - Link test as position independent executable (bsc#1184124). + bug-1184124-link-tests-as-PIE.patch - vgextend crash when extending VG with missing PV (bsc#1191019) + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905) + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - LVM vgimportclone on hardware snapshot does not work (bsc#1193181) + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - udev: create symlinks and watch even in suspended state (bsc#1195231) + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691) + change lvm.conf item external_device_info_source from none to udev + bug-1179691_config-set-external_device_info_source-none.patch - lvm reports udev database has incomplete information on devices (bsc#1202011) + bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - Upgrade lvm2 from LVM2.2.03.05 to LVM2.2.03.16 (bsc#1201616) - device-mapper version upgrade to 1.02.185 (bsc#1199074) - Drop patches that have been merged into upstream - bug-1122666_devices-drop-open-error-message.patch - bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch - bug-1149408_Fix-rounding-writes-up-to-sector-size.patch - bug-1149408_vgcreate-vgextend-restrict-PVs-with-mixed-block-size.patch - bug-1152378-md-component-detection-for-differing-PV-and-device-s.patch - bug-1152378-pvscan-fix-PV-online-when-device-has-a-different-siz.patch - jcs-SLE5498_pvscan-allow-use-of-noudevsync-option.patch - bug-1154655_udev-remove-unsupported-OPTIONS-event_timeout-rule.patch - bug-1158628_01-tests-replaces-grep-q-usage.patch - bug-1158628_02-tests-fix-ra-checking.patch - bug-1158628_03-tests-simplify-some-var-settings.patch - bug-1158628_04-pvmove-correcting-read_ahead-setting.patch - bug-1158628_05-activation-add-synchronization-point.patch - bug-1158628_06-pvmove-add-missing-synchronization.patch - bug-1158628_07-activation-extend-handling-of-pending_delete.patch - bug-1158628_08-lv_manip-add-synchronizations.patch - bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch - bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch - bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch - bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch - bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch - bug-1158628_14-tests-add-extra-settle.patch - bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch - bug-1158861_01-config-remove-filter-typo.patch - bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch - bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch - bug-1158861_04-fix-duplicate-pv-size-check.patch - bug-1158861_05-hints-fix-copy-of-filter.patch - bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch - bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch - bug-1158861_08-hints-fix-mem-leaking-buffers.patch - bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch - bug-1150021_02-bcache-add-bcache_abort.patch - bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch - bug-1150021_04-bcache-add-unit-test.patch - bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch - bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch - bug-1157736-add-suggestion-message-for-mirror-LVs.patch - bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch - bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch - bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch - bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch - bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch - bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch - bug-1181319_03-lvmlockctl-use-inline-initilizers.patch - bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch - bug-1181319_05-cov-check-sscanf-result.patch - bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch - bug-1185190_01-pvscan-support-disabled-event_activation.patch - bug-1185190_02-config-improve-description-for-event_activation.patch - bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch - bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch - bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch - bug-1202011_vgchange-monitor-don-t-use-udev-info.patch - bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch - bug-1179691_config-set-external_device_info_source-none.patch - Update patch - fate-309425_display-dm-name-for-lv-name.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - replace exist patch with fixed bug patches - (remove) fate-31841_fsadm-add-support-for-btrfs.patch - (add) fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch - (add) fate-31841-02_man-add-support-for-btrfs.patch - (add) fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Add upstream patch - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - update lvm2.spec - indent some lines for easy read - add new binraries: lvmdevices lvm_import_vdo vgimportdevices dmfilemapd - remove config item '--enable-cmirrord', which was obsoleted. - remove config item '--enable-realtime', which became default setting. - add config item "--with-cluster=internal" for cluster test - add config item "--enable-dmfilemapd" for new daemon dmfilemapd - add new man: lvmautoactivation.7 lvmdevices.8 lvm_import_vdo.8 dmfilemapd.8 - remove lvm2-activation-generator & lvm2-activation-generator.8 - remove lvm2-pvscan@.service - replace 69-dm-lvm-metad.rules with 69-dm-lvm.rules - change %post behaviour, only do deleting job for non-link folder (bsc#1198523) - lvm.conf - follow upstream style, comment out default value (bsc#1179739) - lvmlockd is not supporting sanlock (bsc#1203482) - set 1 for _supportsanlock in lvm2.spec for enabling sanlock. - lvm.conf should re-enable commented out option use_lvmlockd (bsc#1204219) - re-enable "use_lvmlockd = 0" in lvm.conf - dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074) - in lvm2.spec, change device_mapper_version from 1.02.185 to %{lvm2_version}_1.02.185 - killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216) - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - multipath_component_detection = 0 in lvm.conf does not have any effect (bsc#1212613) - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - blkdeactivate calls wrong mountpoint cmd (bsc#1214071) + bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch - Update lvm2 from LVM2.2.03.16 to LVM2.2.03.22 (jsc#PED-6753) - device-mapper version upgrade to 1.02.196 - Drop patches that have been merged into upstream - 0001-devices-file-move-clean-up-after-command-is-run.patch - 0002-devices-file-fail-if-devicesfile-filename-doesn-t-ex.patch - 0003-filter-mpath-handle-other-wwid-types-in-blacklist.patch - 0004-filter-mpath-get-wwids-from-sysfs-vpd_pg83.patch - 0005-pvdisplay-restore-reportformat-option.patch - 0006-exit-with-error-when-devicesfile-name-doesn-t-exist.patch - 0007-report-fix-pe_start-column-type-from-NUM-to-SIZ.patch - 0008-_vg_read_raw_area-fix-segfault-caused-by-using-null-.patch - 0009-mm-remove-libaio-from-being-skipped.patch - 0010-dmsetup-check-also-for-ouf-of-range-value.patch - 0011-devices-drop-double-from-sysfs-path.patch - 0012-devices-file-fix-pvcreate-uuid-matching-pvid-entry-w.patch - 0013-vgimportdevices-change-result-when-devices-are-not-a.patch - 0014-vgimportdevices-fix-locking-when-creating-devices-fi.patch - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch - bug-1212613_apply-multipath_component_detection-0-to-duplicate-P.patch - Add upstream patch + 0001-lvconvert-swapmetadata-fix-lvmlockd-locking.patch + 0002-lvconvert-fix-ret-values-fro-integrity-remove.patch + 0003-lvconvert-fix-regresion-from-integrity-check.patch + 0004-gcc-cleanup-warnings.patch + 0005-lvmlockd-fix-thick-to-thin-lv-conversion.patch + 0006-lvmlockd-let-lockd_init_lv_args-set-lock_args.patch + 0007-lvmlockd-fix-lvconvert-to-thin-pool.patch + 0008-lvconvert-run-error-path-code-only-for-shared-VG.patch + 0009-vgchange-acquire-an-exclusive-VG-lock-for-refresh.patch + 0010-lvmlockd-client-mutex-ordering.patch + 0011-filesystem-move-stat-after-open-check.patch + 0012-tests-check-for-writecache.patch + 0013-lvresize-fix-32-bit-overflow-in-size-calculation.patch + 0014-gcc-fix-warnings-for-x32-architecture.patch + 0015-gcc-warning-missing-braces-around-initializer.patch + 0016-test-improve-aux-teardown.patch + 0017-tests-aux-try-with-extra-sleep.patch + 0018-tests-aux-using-singl-lvmconf-call.patch + 0019-tests-missing-to-check-for-writecache-support.patch + 0020-tests-pvmove-large-disk-area.patch + 0021-tests-enforce-full-fs-check.patch + 0022-tests-update-for-work-in-fake-dev-environment.patch + 0023-tests-skip-test-when-lvmdbusd-runs-on-the-system.patch + 0024-tests-better-slowdown.patch - Update patch - bug-1037309_Makefile-skip-compliling-daemons-lvmlockd-directory.patch - bug-1184124-link-tests-as-PIE.patch - bug-1184687_Add-nolvm-for-kernel-cmdline.patch - fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch - Rename & Update patch - bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-rules.patch - update lvm2.spec - change upstream_device_mapper_version to 1.02.196 - change device_mapper_version to %{lvm2_version}_1.02.196 - add config item "-with-libexecdir=%{_libexecdir}" to fix libexec path since commit a2d33cdf - add new binary "%{_libexecdir}/lvresize_fs_helper" to lvm2 package - Build with -DOPENSSL_NO_SSL_INTERN asserting that this package does not (and should not) use openSSL internals that are subject to binary incompatible changes. - Add patches 0001-outof-Introduce-expandaddr-flag.patch 0002-unpack-Disable-option-processing-for-email-addresses.patch 0003-fio.c-Unconditionally-require-wordexp-support.patch 0004-globname-Invoke-wordexp-with-WRDE_NOCMD-CVE-2004-277.patch to fix bsc#909208 -- CVE-2004-2771, CVE-2014-7844: mailx: shell command injection via crafted email addresses - Modify patch mailx-12.5-mime.dif to allow Form Feed as valid characters within mail messages (bsc#922543) - Correct parenthese expansion to fulfill natural order (bnc#974561) - call gzip -n and drop CreationDate from manual.ps to make build fully reproducible - Add patch mailx-12.5-openssl-1.1.0f.patch Avoid deprecated/unavailable openSSL client methods (boo#1042663) - Remove redundant %clean section. - Replace old $RPM_* shell vars by macros. - Updates to mailx-12.5-openssl-1.1.0f.patch * If the openssl RNG is already seeded (on linux it always is) skip snake-oil reeseeding from file. Update man page accordingly. * Update man page with information that ssl2 and ssl3 are not only deprecated but currently unavailable and that tls1 forces TLS 1.0 but not later versions. * RAND_EGD is also unavailable, not just unused. * set SSL_OP_NO_TICKET, many servers accept session tickets, but almost never rotate them properly, TLS 1.3 session tickets are not affected by this flag. * When using client certificates, check if the cert and key match each other. - fix-sendmail-name.patch: fix name argument when calling /usr/sbin/sendmail [bsc#1180355]. - Add patch mailx-12.5-systemd.patch to add description how to avoid bugs like bsc#1192916 -- mailx does not send mails unless run via strace or in verbose mode - Build with -DOPENSSL_NO_SSL_INTERN asserting that this package does not (and should not) use openSSL internals that are subject to binary incompatible changes. - Add patches 0001-outof-Introduce-expandaddr-flag.patch 0002-unpack-Disable-option-processing-for-email-addresses.patch 0003-fio.c-Unconditionally-require-wordexp-support.patch 0004-globname-Invoke-wordexp-with-WRDE_NOCMD-CVE-2004-277.patch to fix bsc#909208 -- CVE-2004-2771, CVE-2014-7844: mailx: shell command injection via crafted email addresses - Modify patch mailx-12.5-mime.dif to allow Form Feed as valid characters within mail messages (bsc#922543) - Correct parenthese expansion to fulfill natural order (bnc#974561) - call gzip -n and drop CreationDate from manual.ps to make build fully reproducible - Add patch mailx-12.5-openssl-1.1.0f.patch Avoid deprecated/unavailable openSSL client methods (boo#1042663) - Remove redundant %clean section. - Replace old $RPM_* shell vars by macros. - Updates to mailx-12.5-openssl-1.1.0f.patch * If the openssl RNG is already seeded (on linux it always is) skip snake-oil reeseeding from file. Update man page accordingly. * Update man page with information that ssl2 and ssl3 are not only deprecated but currently unavailable and that tls1 forces TLS 1.0 but not later versions. * RAND_EGD is also unavailable, not just unused. * set SSL_OP_NO_TICKET, many servers accept session tickets, but almost never rotate them properly, TLS 1.3 session tickets are not affected by this flag. * When using client certificates, check if the cert and key match each other. - fix-sendmail-name.patch: fix name argument when calling /usr/sbin/sendmail [bsc#1180355]. - Add patch mailx-12.5-systemd.patch to add description how to avoid bugs like bsc#1192916 -- mailx does not send mails unless run via strace or in verbose mode - Build with -DOPENSSL_NO_SSL_INTERN asserting that this package does not (and should not) use openSSL internals that are subject to binary incompatible changes. - Add patches 0001-outof-Introduce-expandaddr-flag.patch 0002-unpack-Disable-option-processing-for-email-addresses.patch 0003-fio.c-Unconditionally-require-wordexp-support.patch 0004-globname-Invoke-wordexp-with-WRDE_NOCMD-CVE-2004-277.patch to fix bsc#909208 -- CVE-2004-2771, CVE-2014-7844: mailx: shell command injection via crafted email addresses - Modify patch mailx-12.5-mime.dif to allow Form Feed as valid characters within mail messages (bsc#922543) - Correct parenthese expansion to fulfill natural order (bnc#974561) - call gzip -n and drop CreationDate from manual.ps to make build fully reproducible - Add patch mailx-12.5-openssl-1.1.0f.patch Avoid deprecated/unavailable openSSL client methods (boo#1042663) - Remove redundant %clean section. - Replace old $RPM_* shell vars by macros. - Updates to mailx-12.5-openssl-1.1.0f.patch * If the openssl RNG is already seeded (on linux it always is) skip snake-oil reeseeding from file. Update man page accordingly. * Update man page with information that ssl2 and ssl3 are not only deprecated but currently unavailable and that tls1 forces TLS 1.0 but not later versions. * RAND_EGD is also unavailable, not just unused. * set SSL_OP_NO_TICKET, many servers accept session tickets, but almost never rotate them properly, TLS 1.3 session tickets are not affected by this flag. * When using client certificates, check if the cert and key match each other. - fix-sendmail-name.patch: fix name argument when calling /usr/sbin/sendmail [bsc#1180355]. - Add patch mailx-12.5-systemd.patch to add description how to avoid bugs like bsc#1192916 -- mailx does not send mails unless run via strace or in verbose mode - Update to heirloom mailx 12.5 * Better detection of base64 encoded text if acrossed a line * A null pointer dereference that lead to a segmentation fault when the user hit return at a yes/no question has been fixed * When both standard input and standard output refer to a terminal, ignore SIGPIPE * With the "-E" command line option or if the "skipemptybody" variable is set, outgoing messages that contain no text in their first or only part are not sent but silently discarded. * When an attachment that would have a "text/something" content type contains illegal byte sequences, it is now reliably sent out with the "application/octet-stream" content type instead * Fixed a bug that caused messages to be truncated with IMAP servers that use LF as line ending in message data, such as Google Mail (reported by Matthew L. Shobe). * Do not run filename expansion for IMAP or POP3 mailboxes names, making it possible to select mailboxes that contain both brackets and spaces in their names (reported by Matthew L. Shobe). * Fixed the format of the timezone in "Date" header fields for zones in the Western Hemisphere whose offsets are not an integral number of hours (patch by Matthew Fischer). * Fixed a message corruption that occurred when the "inc" command was used with a mbox format mailbox after encrypted messages had been viewed (reported by Martin Neitzel). * Fixed a condition that caused mailx to hang when looking at a message, copying that message, and issuing a "z" command evaluating an uncached portion of an IMAP folder. * Make it compile with OpenSSL 1.0.0-beta2 * For RFC 2047 MIME "encoded-word" parts in headers, assume that the end of each word resets the conversion state (Yedidyah Bar-David). * When the ORGANIZATION variable has an empty value, do not generate an "Organization:" header field. Previously, this condition resulted in mailx refusing to send mail - Fix my Reply-To patch found by milli - Try to support not only UTF-8 but also latin text encodings (bnc#753340) - Avoid header rewrite in case of specified ttycharset in wrong locale but subject in ttycharset (bnc#753340) - Add BuildRequires on man to fix build for Factory - license update: BSD-4-Clause and MPL-1.1 See COPYING. Fedora also uses this license designation - buildrequire groff explicitly - Do not pseudo detect Latin nor UTF-8 in binary attachments (bnc#827010) - Add patch mailx-12.5-parentheses.dif, that is try to tranquilize gcc due warning about parentheses (please check!) - Add patch mailx-12.5-ipv6.dif to enable mailx to parse IPv6 addresses including a port. We do only support the [ipv6]:port syntax (bnc#853246) - Crop off the brackets of an ipv6 addresse if found (bnc#853246) - Correct comment in spec file - Build with -DOPENSSL_NO_SSL_INTERN asserting that this package does not (and should not) use openSSL internals that are subject to binary incompatible changes. - Add patches 0001-outof-Introduce-expandaddr-flag.patch 0002-unpack-Disable-option-processing-for-email-addresses.patch 0003-fio.c-Unconditionally-require-wordexp-support.patch 0004-globname-Invoke-wordexp-with-WRDE_NOCMD-CVE-2004-277.patch to fix bsc#909208 -- CVE-2004-2771, CVE-2014-7844: mailx: shell command injection via crafted email addresses - Modify patch mailx-12.5-mime.dif to allow Form Feed as valid characters within mail messages (bsc#922543) - Correct parenthese expansion to fulfill natural order (bnc#974561) - call gzip -n and drop CreationDate from manual.ps to make build fully reproducible - Add patch mailx-12.5-openssl-1.1.0f.patch Avoid deprecated/unavailable openSSL client methods (boo#1042663) - Remove redundant %clean section. - Replace old $RPM_* shell vars by macros. - Updates to mailx-12.5-openssl-1.1.0f.patch * If the openssl RNG is already seeded (on linux it always is) skip snake-oil reeseeding from file. Update man page accordingly. * Update man page with information that ssl2 and ssl3 are not only deprecated but currently unavailable and that tls1 forces TLS 1.0 but not later versions. * RAND_EGD is also unavailable, not just unused. * set SSL_OP_NO_TICKET, many servers accept session tickets, but almost never rotate them properly, TLS 1.3 session tickets are not affected by this flag. * When using client certificates, check if the cert and key match each other. - fix-sendmail-name.patch: fix name argument when calling /usr/sbin/sendmail [bsc#1180355]. - Add patch mailx-12.5-systemd.patch to add description how to avoid bugs like bsc#1192916 -- mailx does not send mails unless run via strace or in verbose mode - Build with -DOPENSSL_NO_SSL_INTERN asserting that this package does not (and should not) use openSSL internals that are subject to binary incompatible changes. - Add patches 0001-outof-Introduce-expandaddr-flag.patch 0002-unpack-Disable-option-processing-for-email-addresses.patch 0003-fio.c-Unconditionally-require-wordexp-support.patch 0004-globname-Invoke-wordexp-with-WRDE_NOCMD-CVE-2004-277.patch to fix bsc#909208 -- CVE-2004-2771, CVE-2014-7844: mailx: shell command injection via crafted email addresses - Modify patch mailx-12.5-mime.dif to allow Form Feed as valid characters within mail messages (bsc#922543) - Correct parenthese expansion to fulfill natural order (bnc#974561) - call gzip -n and drop CreationDate from manual.ps to make build fully reproducible - Add patch mailx-12.5-openssl-1.1.0f.patch Avoid deprecated/unavailable openSSL client methods (boo#1042663) - Remove redundant %clean section. - Replace old $RPM_* shell vars by macros. - Updates to mailx-12.5-openssl-1.1.0f.patch * If the openssl RNG is already seeded (on linux it always is) skip snake-oil reeseeding from file. Update man page accordingly. * Update man page with information that ssl2 and ssl3 are not only deprecated but currently unavailable and that tls1 forces TLS 1.0 but not later versions. * RAND_EGD is also unavailable, not just unused. * set SSL_OP_NO_TICKET, many servers accept session tickets, but almost never rotate them properly, TLS 1.3 session tickets are not affected by this flag. * When using client certificates, check if the cert and key match each other. - fix-sendmail-name.patch: fix name argument when calling /usr/sbin/sendmail [bsc#1180355]. - Add patch mailx-12.5-systemd.patch to add description how to avoid bugs like bsc#1192916 -- mailx does not send mails unless run via strace or in verbose mode - Incremental: Remove redundant spare movement logic (jsc#SLE-13700, bsc#1180220) 0112-Incremental-Remove-redundant-spare-movement-logic.patch - Dump: get stat from a wrong metadata file when restoring metadata (jsc#SLE-13700) 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - cluster-md/mdadm : avoid useless re-sync (bsc#1181341) 0114-super1-fix-Floating-point-exception.patch 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - imsm: nvme multipath support (bsc#1175758) 0116-imsm-nvme-multipath-support.patch - Grow: be careful of corrupt dev_roles list (bsc#1181619) 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - Remove Spare drives line from details for external metadata (bsc#1180661, bsc#1182642) 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - Don't associate spares with other arrays during RAID Examine (bsc#1180661, bsc#1182642) 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - Install mdadm in _sbindir rather than /sbin. This is more appropriate now that we have a merged-/usr. (bsc#1191076) - Use %{_sbindir} for prerequisite of mkinitrd to work with usrmerge of dracut-mkinitrd-deprecated - skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054) * Add 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158) 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: support for third Sata controller (bsc#1201297) 0121-imsm-support-for-third-Sata-controller.patch - mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297) 1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch - mdadm.spec: add EXTRAVERSION string to make command line (jsc#SLE-24761, bsc#1193566) - Update mdadm package to latest mdadm since mdadm-4.2 (jsc#PED-1009, jsc#PED-947) * Only patches directly change runtime programs included, - Unify error message. 0001-Unify-error-message.patch - mdadm: Fix double free 0002-mdadm-Fix-double-free.patch - Grow_reshape: Add r0 grow size error message and update 0003-Grow_reshape-Add-r0-grow-size-error-message-and-upda.patch - udev: adapt rules to systemd v247 0004-udev-adapt-rules-to-systemd-v247.patch - Replace error prone signal() with sigaction() 0005-Replace-error-prone-signal-with-sigaction.patch - mdadm: Respect config file location in man 0006-mdadm-Respect-config-file-location-in-man.patch - mdadm: Update ReadMe 0007-mdadm-Update-ReadMe.patch - mdadm: Update config man regarding default files and 0008-mdadm-Update-config-man-regarding-default-files-and-.patch - mdadm: Update config manual 0009-mdadm-Update-config-manual.patch - Create, Build: use default_layout() 0010-Create-Build-use-default_layout.patch - mdadm: add map_num_s() 0011-mdadm-add-map_num_s.patch - mdmon: Stop parsing duplicate options 0012-mdmon-Stop-parsing-duplicate-options.patch - Grow: block -n on external volumes. 0013-Grow-block-n-on-external-volumes.patch - Incremental: Fix possible memory and resource leaks 0014-Incremental-Fix-possible-memory-and-resource-leaks.patch - Mdmonitor: Fix segfault 0015-Mdmonitor-Fix-segfault.patch - Mdmonitor: Improve logging method 0016-Mdmonitor-Improve-logging-method.patch - Fix possible NULL ptr dereferences and memory leaks 0017-Fix-possible-NULL-ptr-dereferences-and-memory-leaks.patch - imsm: Remove possibility for get_imsm_dev to return 0018-imsm-Remove-possibility-for-get_imsm_dev-to-return-N.patch - Revert "mdadm: fix coredump of mdadm --monitor -r" 0019-Revert-mdadm-fix-coredump-of-mdadm-monitor-r.patch - util: replace ioctl use with function 0020-util-replace-ioctl-use-with-function.patch - mdadm/super1: restore commit 45a87c2f31335 to fix 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: introduce get_disk_slot_in_dev() 0022-imsm-introduce-get_disk_slot_in_dev.patch - imsm: use same slot across container 0023-imsm-use-same-slot-across-container.patch - imsm: block changing slots during creation 0024-imsm-block-changing-slots-during-creation.patch - mdadm: block update=ppl for non raid456 levels 0025-mdadm-block-update-ppl-for-non-raid456-levels.patch - mdadm: Fix array size mismatch after grow 0026-mdadm-Fix-array-size-mismatch-after-grow.patch - mdadm: Remove dead code in imsm_fix_size_mismatch 0027-mdadm-Remove-dead-code-in-imsm_fix_size_mismatch.patch - Monitor: use devname as char array instead of pointer 0028-Monitor-use-devname-as-char-array-instead-of-pointer.patch - Monitor: use snprintf to fill device name 0029-Monitor-use-snprintf-to-fill-device-name.patch - Makefile: Don't build static build with everything and 0030-Makefile-Don-t-build-static-build-with-everything-an.patch - DDF: Cleanup validate_geometry_ddf_container() 0031-DDF-Cleanup-validate_geometry_ddf_container.patch - DDF: Fix NULL pointer dereference in 0032-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch - mdadm/Grow: Fix use after close bug by closing after 0033-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch - monitor: Avoid segfault when calling NULL 0034-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch - mdadm: Fix mdadm -r remove option regression 0035-mdadm-Fix-mdadm-r-remove-option-regression.patch - mdadm: Fix optional --write-behind parameter 0036-mdadm-Fix-optional-write-behind-parameter.patch - mdadm: Replace obsolete usleep with nanosleep 0037-mdadm-Replace-obsolete-usleep-with-nanosleep.patch - mdadm: remove symlink option 0038-mdadm-remove-symlink-option.patch - mdadm: move data_offset to struct shape 0039-mdadm-move-data_offset-to-struct-shape.patch - mdadm: Don't open md device for CREATE and ASSEMBLE 0040-mdadm-Don-t-open-md-device-for-CREATE-and-ASSEMBLE.patch - Grow: Split Grow_reshape into helper function 0041-Grow-Split-Grow_reshape-into-helper-function.patch - Assemble: check if device is container before 0042-Assemble-check-if-device-is-container-before-schedul.patch - super1: report truncated device 0043-super1-report-truncated-device.patch - mdadm: Correct typos, punctuation and grammar in man 0044-mdadm-Correct-typos-punctuation-and-grammar-in-man.patch - Manage: Block unsafe member failing 0045-Manage-Block-unsafe-member-failing.patch - Monitor: Fix statelist memory leaks 0046-Monitor-Fix-statelist-memory-leaks.patch - mdadm: added support for Intel Alderlake RST on VMD 0047-mdadm-added-support-for-Intel-Alderlake-RST-on-VMD-p.patch - mdadm: Add Documentation entries to systemd services 0048-mdadm-Add-Documentation-entries-to-systemd-services.patch - ReadMe: fix command-line help 0049-ReadMe-fix-command-line-help.patch - mdadm: replace container level checking with inline 0050-mdadm-replace-container-level-checking-with-inline.patch - Mdmonitor: Omit non-md devices 0051-Mdmonitor-Omit-non-md-devices.patch - Remove the following in house patch 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch because upstream merged version added in as 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - Rename 0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch to 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Update mdadm package to mdadm-4.2 (jsc#PED-1009, jsc#PED-947) All important modifications since previous update to mdadm-4.2 are listed here. * The patches about Intel Matrix Storage Manager (including VROC support), - super-intel.c: Handle errors from calls to get_dev_sector_size() - imsm: change wrong size verification - imsm: add generic method to resolve "device" links - imsm: add devpath_to_char method - imsm: Limit support to the lowest namespace - imsm: correct offset for 4k disks in --examine output - imsm: Fix possible memory leaks and refactor freeing struct dl - imsm: fix num_data_stripes after raid0 takeover - imsm: introduce helpers to manage file descriptors - imsm: free allocated memory in imsm_fix_size_mismatch - imsm: assert if there is migration but prev_map doesn't exist * The patches to fix program issues, - mdadm/super1: It needs to specify int32 for bitmap_offset - Fix memory leak after "mdadm --detail" - Utils: Change sprintf to snprintf - mdadm: fix coredump of mdadm --monitor -r - Fix error message when creating raid 4, 5 and 10 - Fix buffer size warning for strcp - Fix potential overlap dest buffer - Correct checking if file descriptors are valid - Monitor: print message before quit for no array to monitor * Improvement or bug fixes for mdadm itself, - Assemble: skip devices that don't match uuid instead of aborting the assembly. - Assemble: apply sysfs rules - Assemble: start dirty and degraded array. - Incremental: Close unclosed mdfd in IncrementalScan() - Monitor: make libudev dependency optional - Manage: Call validate_geometry when adding drive to external container - Remove Spare drives line from details for external metadata - Don't associate spares with other arrays during RAID Examine - Add error handling for chunk size in RAID1 - Add monitor delay parameter to mdadm.conf - disallow create or grow clustered bitmap with writemostly set - mdadm/Detail: Can't show container name correctly when unpluging disks - mdadm: block creation with long names - mdadm: fix growing containers - Remove the following patches because they are all included in mdadm-4.2, - 0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch - 0002-Document-PART-POLICY-lines.patch - 0003-policy-support-devices-with-multiple-paths.patch - 0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch - 0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch - 0006-imsm-update-metadata-correctly-while-raid10-double-d.patch - 0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch - 0008-Grow-avoid-overflow-in-compute_backup_blocks.patch - 0009-Grow-report-correct-new-chunk-size.patch - 0010-policy.c-prevent-NULL-pointer-referencing.patch - 0012-policy.c-Fix-for-compiler-error.patch - 0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch - 0014-imsm-fix-reshape-for-2TB-drives.patch - 0015-Fix-spelling-typos.patch - 0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch - 0018-Fix-reshape-for-decreasing-data-offset.patch - 0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch - 0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch - 0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch - 0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch - 0023-add-missing-units-to-examine.patch - 0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch - 0025-Create-Block-rounding-size-to-max.patch - 0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch - 0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch - 0028-Enable-probe_roms-to-scan-more-than-6-roms.patch - 0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch - 0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch - 0031-super-intel-Use-put_unaligned-in-split_ull.patch - 0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch - 0033-mdadm.h-include-sysmacros.h-unconditionally.patch - 0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch - 0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch - 0036-imsm-close-removed-drive-fd.patch - 0037-mdadm-check-value-returned-by-snprintf-against-error.patch - 0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch - 0039-mdadm-force-a-uuid-swap-on-big-endian.patch - 0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch - 0041-Init-devlist-as-an-array.patch - 0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch - 0043-udev-allow-for-udev-attribute-reading-bug.patch - 0044-imsm-save-current_vol-number.patch - 0045-imsm-allow-to-specify-second-volume-size.patch - 0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch - 0050-mdcheck-use-to-pass-variable-to-mdcheck.patch - 0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch - 0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch - 0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch - 0054-Remove-last-traces-of-HOT_ADD_DISK.patch - 0055-Fix-up-a-few-formatting-issues.patch - 0056-Remove-unused-code.patch - 0057-imsm-return-correct-uuid-for-volume-in-detail.patch - 0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch - 0059-Create-add-support-for-RAID0-layouts.patch - 0060-Assemble-add-support-for-RAID0-layouts.patch - 0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch - 0062-Change-warning-message.patch - 0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch - 0064-imsm-Update-grow-manual.patch - 0065-Add-support-for-Tebibytes.patch - 0066-imsm-fill-working_disks-according-to-metadata.patch - 0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch - 0068-Remove-the-legacy-whitespace.patch - 0069-imsm-pass-subarray-id-to-kill_subarray-function.patch - 0070-imsm-Remove-dump-restore-implementation.patch - 0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch - 0072-Detail-adding-sync-status-for-cluster-device.patch - 0073-imsm-Correct-minimal-device-size.patch - 0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch - 0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch - 0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch - 0077-udev-Ignore-change-event-for-imsm.patch - 0078-Manage-imsm-Write-metadata-before-add.patch - 0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch - 0080-clean-up-meaning-of-small-typo.patch - 0081-Assemble.c-respect-force-flag.patch - 0082-mdcheck-Log-when-done.patch - 0083-Makefile-add-EXTRAVERSION-support.patch - 0084-uuid.c-split-uuid-stuffs-from-util.c.patch - 0085-Include-count-for-0-character-when-using-strncpy-to-.patch - 0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch - 0087-Block-overwriting-existing-links-while-manual-assemb.patch - 0088-Detect-too-small-device-error-rather-than-underflow-.patch - 0089-Use-more-secure-HTTPS-URLs.patch - 0090-Update-link-to-Intel-page-for-IMSM.patch - 0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch - 0092-Specify-nodes-number-when-updating-cluster-nodes.patch - 0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch - 0094-manual-update-examine-badblocks.patch - 0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch - 0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch - 0097-Monitor-refresh-mdstat-fd-after-select.patch - 0098-Monitor-stop-notifing-about-containers.patch - 0099-mdmonitor-set-small-delay-once.patch - 0100-Check-if-other-Monitor-instance-running-before-fork.patch - 0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch - 0102-Detail-fix-segfault-during-IMSM-raid-creation.patch - 0103-Create.c-close-mdfd-and-generate-uevent.patch - 0104-imsm-update-num_data_stripes-according-to-dev_size.patch - 0105-imsm-remove-redundant-calls-to-imsm_get_map.patch - 0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch - 0107-imsm-limit-support-to-first-NVMe-namespace.patch - 0108-mdadm-Unify-forks-behaviour.patch - 0109-mdadm-Detail-show-correct-state-for-clustered-array.patch - 0110-Make-target-to-install-binaries-only.patch - 0111-udev-start-grow-service-automatically.patch - 0112-Incremental-Remove-redundant-spare-movement-logic.patch - 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - 0114-super1-fix-Floating-point-exception.patch - 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - 0116-imsm-nvme-multipath-support.patch - 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - 0121-imsm-support-for-third-Sata-controller.patch - The patch from SLE15-SP4 is removed because it is in mdadm-4.2 upstream already, - Monitor: print message before quit for no array to monitor (bsc#1183229) 0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch - mdadm.spec: remove "PreReq: %{_sbindir}/mkinitrd" as it is unnecessary now. (bsc#1202352) - Call mdadm_env.sh from /usr/libexec/mdadm (bsc#1111960, bsc#1202090) 1004-call-mdadm_env.sh-from-usr-libexec-mdadm.patch - The patch (bsc#1111960) which fixed rpm check failure is replaced by the above patch, 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Drop the patch which is reported as regression by upstream developer (bsc#1206139) 0045-Manage-Block-unsafe-member-failing.patch - Add jsc#PED-947 together with jsc#PED-1009 in mdadm.changes, they are both the requirement to update mdadm to latest upstream state via different requestors. - mdadm.spec: create the following symbolic link in /sbin for compatibility, /sbin/mdadm -> /usr/sbin/mdadm /sbin/mdmon -> /usr/sbin/mdmon (jsc#PED-1009, jsc#PED-947) - sysconfig.mdadm: Remove ServiceRestart line to mdadm since there is not such systemd service. (bsc#1203491) - Fixes for mdmon to ensure it run at the right time in the fight mount namespace. This fixes various problems with IMSM raid arrays in 15-SP4 (bsc#1205493, bsc#1205830) - mdmon: fix segfault 0052-mdmon-fix-segfault.patch - util: remove obsolete code from get_md_name 0053-util-remove-obsolete-code-from-get_md_name.patch - mdmon: don't test both 'all' and 'container_name'. 0054-mdmon-don-t-test-both-all-and-container_name.patch - mdmon: change systemd unit file to use --foreground 0055-mdmon-change-systemd-unit-file-to-use-foreground.patch - mdmon: Remove need for KillMode=none 0056-mdmon-Remove-need-for-KillMode-none.patch - mdmon: Improve switchroot interactions. 0057-mdmon-Improve-switchroot-interactions.patch - mdopen: always try create_named_array() 0058-mdopen-always-try-create_named_array.patch - Improvements for IMSM_NO_PLATFORM testing 0059-Improvements-for-IMSM_NO_PLATFORM-testing.patch - Grow: fix possible memory leak (bsc#1208618) 0060-Grow-fix-possible-memory-leak.patch - Grow: fix can't change bitmap type from none to clustered (bsc#1208618) 0061-Grow-fix-can-t-change-bitmap-type-from-none-to-clustered.patch - Use source code mdadm-4.2.tar.xz from kernel.org version for checksum - mdadm-4.2.tar.xz - mdadm: define DEV_MD_DIR (bsc#1226413) 0062-mdadm-define-DEV_MD_DIR.patch - mdadm: refactor ident->name handling (bsc#1226413) 0063-mdadm-refactor-ident-name-handling.patch - mdadm: Follow POSIX Portable Character Set (bsc#1226413) 0064-mdadm-Follow-POSIX-Portable-Character-Set.patch - Detail: remove duplicated code (bsc#1226413) 0065-Detail-remove-duplicated-code.patch - mdadm: Fix native --detail --export (bsc#1226413) 0066-mdadm-Fix-native-detail-export.patch - Incremental: Remove redundant spare movement logic (jsc#SLE-13700, bsc#1180220) 0112-Incremental-Remove-redundant-spare-movement-logic.patch - Dump: get stat from a wrong metadata file when restoring metadata (jsc#SLE-13700) 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - cluster-md/mdadm : avoid useless re-sync (bsc#1181341) 0114-super1-fix-Floating-point-exception.patch 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - imsm: nvme multipath support (bsc#1175758) 0116-imsm-nvme-multipath-support.patch - Grow: be careful of corrupt dev_roles list (bsc#1181619) 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - Remove Spare drives line from details for external metadata (bsc#1180661, bsc#1182642) 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - Don't associate spares with other arrays during RAID Examine (bsc#1180661, bsc#1182642) 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - Install mdadm in _sbindir rather than /sbin. This is more appropriate now that we have a merged-/usr. (bsc#1191076) - Use %{_sbindir} for prerequisite of mkinitrd to work with usrmerge of dracut-mkinitrd-deprecated - skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054) * Add 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158) 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: support for third Sata controller (bsc#1201297) 0121-imsm-support-for-third-Sata-controller.patch - mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297) 1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch - mdadm.spec: add EXTRAVERSION string to make command line (jsc#SLE-24761, bsc#1193566) - Update mdadm package to latest mdadm since mdadm-4.2 (jsc#PED-1009, jsc#PED-947) * Only patches directly change runtime programs included, - Unify error message. 0001-Unify-error-message.patch - mdadm: Fix double free 0002-mdadm-Fix-double-free.patch - Grow_reshape: Add r0 grow size error message and update 0003-Grow_reshape-Add-r0-grow-size-error-message-and-upda.patch - udev: adapt rules to systemd v247 0004-udev-adapt-rules-to-systemd-v247.patch - Replace error prone signal() with sigaction() 0005-Replace-error-prone-signal-with-sigaction.patch - mdadm: Respect config file location in man 0006-mdadm-Respect-config-file-location-in-man.patch - mdadm: Update ReadMe 0007-mdadm-Update-ReadMe.patch - mdadm: Update config man regarding default files and 0008-mdadm-Update-config-man-regarding-default-files-and-.patch - mdadm: Update config manual 0009-mdadm-Update-config-manual.patch - Create, Build: use default_layout() 0010-Create-Build-use-default_layout.patch - mdadm: add map_num_s() 0011-mdadm-add-map_num_s.patch - mdmon: Stop parsing duplicate options 0012-mdmon-Stop-parsing-duplicate-options.patch - Grow: block -n on external volumes. 0013-Grow-block-n-on-external-volumes.patch - Incremental: Fix possible memory and resource leaks 0014-Incremental-Fix-possible-memory-and-resource-leaks.patch - Mdmonitor: Fix segfault 0015-Mdmonitor-Fix-segfault.patch - Mdmonitor: Improve logging method 0016-Mdmonitor-Improve-logging-method.patch - Fix possible NULL ptr dereferences and memory leaks 0017-Fix-possible-NULL-ptr-dereferences-and-memory-leaks.patch - imsm: Remove possibility for get_imsm_dev to return 0018-imsm-Remove-possibility-for-get_imsm_dev-to-return-N.patch - Revert "mdadm: fix coredump of mdadm --monitor -r" 0019-Revert-mdadm-fix-coredump-of-mdadm-monitor-r.patch - util: replace ioctl use with function 0020-util-replace-ioctl-use-with-function.patch - mdadm/super1: restore commit 45a87c2f31335 to fix 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: introduce get_disk_slot_in_dev() 0022-imsm-introduce-get_disk_slot_in_dev.patch - imsm: use same slot across container 0023-imsm-use-same-slot-across-container.patch - imsm: block changing slots during creation 0024-imsm-block-changing-slots-during-creation.patch - mdadm: block update=ppl for non raid456 levels 0025-mdadm-block-update-ppl-for-non-raid456-levels.patch - mdadm: Fix array size mismatch after grow 0026-mdadm-Fix-array-size-mismatch-after-grow.patch - mdadm: Remove dead code in imsm_fix_size_mismatch 0027-mdadm-Remove-dead-code-in-imsm_fix_size_mismatch.patch - Monitor: use devname as char array instead of pointer 0028-Monitor-use-devname-as-char-array-instead-of-pointer.patch - Monitor: use snprintf to fill device name 0029-Monitor-use-snprintf-to-fill-device-name.patch - Makefile: Don't build static build with everything and 0030-Makefile-Don-t-build-static-build-with-everything-an.patch - DDF: Cleanup validate_geometry_ddf_container() 0031-DDF-Cleanup-validate_geometry_ddf_container.patch - DDF: Fix NULL pointer dereference in 0032-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch - mdadm/Grow: Fix use after close bug by closing after 0033-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch - monitor: Avoid segfault when calling NULL 0034-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch - mdadm: Fix mdadm -r remove option regression 0035-mdadm-Fix-mdadm-r-remove-option-regression.patch - mdadm: Fix optional --write-behind parameter 0036-mdadm-Fix-optional-write-behind-parameter.patch - mdadm: Replace obsolete usleep with nanosleep 0037-mdadm-Replace-obsolete-usleep-with-nanosleep.patch - mdadm: remove symlink option 0038-mdadm-remove-symlink-option.patch - mdadm: move data_offset to struct shape 0039-mdadm-move-data_offset-to-struct-shape.patch - mdadm: Don't open md device for CREATE and ASSEMBLE 0040-mdadm-Don-t-open-md-device-for-CREATE-and-ASSEMBLE.patch - Grow: Split Grow_reshape into helper function 0041-Grow-Split-Grow_reshape-into-helper-function.patch - Assemble: check if device is container before 0042-Assemble-check-if-device-is-container-before-schedul.patch - super1: report truncated device 0043-super1-report-truncated-device.patch - mdadm: Correct typos, punctuation and grammar in man 0044-mdadm-Correct-typos-punctuation-and-grammar-in-man.patch - Manage: Block unsafe member failing 0045-Manage-Block-unsafe-member-failing.patch - Monitor: Fix statelist memory leaks 0046-Monitor-Fix-statelist-memory-leaks.patch - mdadm: added support for Intel Alderlake RST on VMD 0047-mdadm-added-support-for-Intel-Alderlake-RST-on-VMD-p.patch - mdadm: Add Documentation entries to systemd services 0048-mdadm-Add-Documentation-entries-to-systemd-services.patch - ReadMe: fix command-line help 0049-ReadMe-fix-command-line-help.patch - mdadm: replace container level checking with inline 0050-mdadm-replace-container-level-checking-with-inline.patch - Mdmonitor: Omit non-md devices 0051-Mdmonitor-Omit-non-md-devices.patch - Remove the following in house patch 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch because upstream merged version added in as 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - Rename 0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch to 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Update mdadm package to mdadm-4.2 (jsc#PED-1009, jsc#PED-947) All important modifications since previous update to mdadm-4.2 are listed here. * The patches about Intel Matrix Storage Manager (including VROC support), - super-intel.c: Handle errors from calls to get_dev_sector_size() - imsm: change wrong size verification - imsm: add generic method to resolve "device" links - imsm: add devpath_to_char method - imsm: Limit support to the lowest namespace - imsm: correct offset for 4k disks in --examine output - imsm: Fix possible memory leaks and refactor freeing struct dl - imsm: fix num_data_stripes after raid0 takeover - imsm: introduce helpers to manage file descriptors - imsm: free allocated memory in imsm_fix_size_mismatch - imsm: assert if there is migration but prev_map doesn't exist * The patches to fix program issues, - mdadm/super1: It needs to specify int32 for bitmap_offset - Fix memory leak after "mdadm --detail" - Utils: Change sprintf to snprintf - mdadm: fix coredump of mdadm --monitor -r - Fix error message when creating raid 4, 5 and 10 - Fix buffer size warning for strcp - Fix potential overlap dest buffer - Correct checking if file descriptors are valid - Monitor: print message before quit for no array to monitor * Improvement or bug fixes for mdadm itself, - Assemble: skip devices that don't match uuid instead of aborting the assembly. - Assemble: apply sysfs rules - Assemble: start dirty and degraded array. - Incremental: Close unclosed mdfd in IncrementalScan() - Monitor: make libudev dependency optional - Manage: Call validate_geometry when adding drive to external container - Remove Spare drives line from details for external metadata - Don't associate spares with other arrays during RAID Examine - Add error handling for chunk size in RAID1 - Add monitor delay parameter to mdadm.conf - disallow create or grow clustered bitmap with writemostly set - mdadm/Detail: Can't show container name correctly when unpluging disks - mdadm: block creation with long names - mdadm: fix growing containers - Remove the following patches because they are all included in mdadm-4.2, - 0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch - 0002-Document-PART-POLICY-lines.patch - 0003-policy-support-devices-with-multiple-paths.patch - 0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch - 0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch - 0006-imsm-update-metadata-correctly-while-raid10-double-d.patch - 0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch - 0008-Grow-avoid-overflow-in-compute_backup_blocks.patch - 0009-Grow-report-correct-new-chunk-size.patch - 0010-policy.c-prevent-NULL-pointer-referencing.patch - 0012-policy.c-Fix-for-compiler-error.patch - 0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch - 0014-imsm-fix-reshape-for-2TB-drives.patch - 0015-Fix-spelling-typos.patch - 0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch - 0018-Fix-reshape-for-decreasing-data-offset.patch - 0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch - 0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch - 0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch - 0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch - 0023-add-missing-units-to-examine.patch - 0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch - 0025-Create-Block-rounding-size-to-max.patch - 0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch - 0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch - 0028-Enable-probe_roms-to-scan-more-than-6-roms.patch - 0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch - 0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch - 0031-super-intel-Use-put_unaligned-in-split_ull.patch - 0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch - 0033-mdadm.h-include-sysmacros.h-unconditionally.patch - 0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch - 0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch - 0036-imsm-close-removed-drive-fd.patch - 0037-mdadm-check-value-returned-by-snprintf-against-error.patch - 0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch - 0039-mdadm-force-a-uuid-swap-on-big-endian.patch - 0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch - 0041-Init-devlist-as-an-array.patch - 0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch - 0043-udev-allow-for-udev-attribute-reading-bug.patch - 0044-imsm-save-current_vol-number.patch - 0045-imsm-allow-to-specify-second-volume-size.patch - 0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch - 0050-mdcheck-use-to-pass-variable-to-mdcheck.patch - 0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch - 0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch - 0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch - 0054-Remove-last-traces-of-HOT_ADD_DISK.patch - 0055-Fix-up-a-few-formatting-issues.patch - 0056-Remove-unused-code.patch - 0057-imsm-return-correct-uuid-for-volume-in-detail.patch - 0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch - 0059-Create-add-support-for-RAID0-layouts.patch - 0060-Assemble-add-support-for-RAID0-layouts.patch - 0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch - 0062-Change-warning-message.patch - 0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch - 0064-imsm-Update-grow-manual.patch - 0065-Add-support-for-Tebibytes.patch - 0066-imsm-fill-working_disks-according-to-metadata.patch - 0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch - 0068-Remove-the-legacy-whitespace.patch - 0069-imsm-pass-subarray-id-to-kill_subarray-function.patch - 0070-imsm-Remove-dump-restore-implementation.patch - 0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch - 0072-Detail-adding-sync-status-for-cluster-device.patch - 0073-imsm-Correct-minimal-device-size.patch - 0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch - 0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch - 0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch - 0077-udev-Ignore-change-event-for-imsm.patch - 0078-Manage-imsm-Write-metadata-before-add.patch - 0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch - 0080-clean-up-meaning-of-small-typo.patch - 0081-Assemble.c-respect-force-flag.patch - 0082-mdcheck-Log-when-done.patch - 0083-Makefile-add-EXTRAVERSION-support.patch - 0084-uuid.c-split-uuid-stuffs-from-util.c.patch - 0085-Include-count-for-0-character-when-using-strncpy-to-.patch - 0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch - 0087-Block-overwriting-existing-links-while-manual-assemb.patch - 0088-Detect-too-small-device-error-rather-than-underflow-.patch - 0089-Use-more-secure-HTTPS-URLs.patch - 0090-Update-link-to-Intel-page-for-IMSM.patch - 0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch - 0092-Specify-nodes-number-when-updating-cluster-nodes.patch - 0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch - 0094-manual-update-examine-badblocks.patch - 0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch - 0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch - 0097-Monitor-refresh-mdstat-fd-after-select.patch - 0098-Monitor-stop-notifing-about-containers.patch - 0099-mdmonitor-set-small-delay-once.patch - 0100-Check-if-other-Monitor-instance-running-before-fork.patch - 0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch - 0102-Detail-fix-segfault-during-IMSM-raid-creation.patch - 0103-Create.c-close-mdfd-and-generate-uevent.patch - 0104-imsm-update-num_data_stripes-according-to-dev_size.patch - 0105-imsm-remove-redundant-calls-to-imsm_get_map.patch - 0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch - 0107-imsm-limit-support-to-first-NVMe-namespace.patch - 0108-mdadm-Unify-forks-behaviour.patch - 0109-mdadm-Detail-show-correct-state-for-clustered-array.patch - 0110-Make-target-to-install-binaries-only.patch - 0111-udev-start-grow-service-automatically.patch - 0112-Incremental-Remove-redundant-spare-movement-logic.patch - 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - 0114-super1-fix-Floating-point-exception.patch - 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - 0116-imsm-nvme-multipath-support.patch - 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - 0121-imsm-support-for-third-Sata-controller.patch - The patch from SLE15-SP4 is removed because it is in mdadm-4.2 upstream already, - Monitor: print message before quit for no array to monitor (bsc#1183229) 0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch - mdadm.spec: remove "PreReq: %{_sbindir}/mkinitrd" as it is unnecessary now. (bsc#1202352) - Call mdadm_env.sh from /usr/libexec/mdadm (bsc#1111960, bsc#1202090) 1004-call-mdadm_env.sh-from-usr-libexec-mdadm.patch - The patch (bsc#1111960) which fixed rpm check failure is replaced by the above patch, 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Drop the patch which is reported as regression by upstream developer (bsc#1206139) 0045-Manage-Block-unsafe-member-failing.patch - Add jsc#PED-947 together with jsc#PED-1009 in mdadm.changes, they are both the requirement to update mdadm to latest upstream state via different requestors. - mdadm.spec: create the following symbolic link in /sbin for compatibility, /sbin/mdadm -> /usr/sbin/mdadm /sbin/mdmon -> /usr/sbin/mdmon (jsc#PED-1009, jsc#PED-947) - sysconfig.mdadm: Remove ServiceRestart line to mdadm since there is not such systemd service. (bsc#1203491) - Fixes for mdmon to ensure it run at the right time in the fight mount namespace. This fixes various problems with IMSM raid arrays in 15-SP4 (bsc#1205493, bsc#1205830) - mdmon: fix segfault 0052-mdmon-fix-segfault.patch - util: remove obsolete code from get_md_name 0053-util-remove-obsolete-code-from-get_md_name.patch - mdmon: don't test both 'all' and 'container_name'. 0054-mdmon-don-t-test-both-all-and-container_name.patch - mdmon: change systemd unit file to use --foreground 0055-mdmon-change-systemd-unit-file-to-use-foreground.patch - mdmon: Remove need for KillMode=none 0056-mdmon-Remove-need-for-KillMode-none.patch - mdmon: Improve switchroot interactions. 0057-mdmon-Improve-switchroot-interactions.patch - mdopen: always try create_named_array() 0058-mdopen-always-try-create_named_array.patch - Improvements for IMSM_NO_PLATFORM testing 0059-Improvements-for-IMSM_NO_PLATFORM-testing.patch - Grow: fix possible memory leak (bsc#1208618) 0060-Grow-fix-possible-memory-leak.patch - Grow: fix can't change bitmap type from none to clustered (bsc#1208618) 0061-Grow-fix-can-t-change-bitmap-type-from-none-to-clustered.patch - Use source code mdadm-4.2.tar.xz from kernel.org version for checksum - mdadm-4.2.tar.xz - mdadm: define DEV_MD_DIR (bsc#1226413) 0062-mdadm-define-DEV_MD_DIR.patch - mdadm: refactor ident->name handling (bsc#1226413) 0063-mdadm-refactor-ident-name-handling.patch - mdadm: Follow POSIX Portable Character Set (bsc#1226413) 0064-mdadm-Follow-POSIX-Portable-Character-Set.patch - Detail: remove duplicated code (bsc#1226413) 0065-Detail-remove-duplicated-code.patch - mdadm: Fix native --detail --export (bsc#1226413) 0066-mdadm-Fix-native-detail-export.patch - Incremental: Remove redundant spare movement logic (jsc#SLE-13700, bsc#1180220) 0112-Incremental-Remove-redundant-spare-movement-logic.patch - Dump: get stat from a wrong metadata file when restoring metadata (jsc#SLE-13700) 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - cluster-md/mdadm : avoid useless re-sync (bsc#1181341) 0114-super1-fix-Floating-point-exception.patch 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - imsm: nvme multipath support (bsc#1175758) 0116-imsm-nvme-multipath-support.patch - Grow: be careful of corrupt dev_roles list (bsc#1181619) 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - Remove Spare drives line from details for external metadata (bsc#1180661, bsc#1182642) 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - Don't associate spares with other arrays during RAID Examine (bsc#1180661, bsc#1182642) 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - Install mdadm in _sbindir rather than /sbin. This is more appropriate now that we have a merged-/usr. (bsc#1191076) - Use %{_sbindir} for prerequisite of mkinitrd to work with usrmerge of dracut-mkinitrd-deprecated - skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054) * Add 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158) 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: support for third Sata controller (bsc#1201297) 0121-imsm-support-for-third-Sata-controller.patch - mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297) 1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch - mdadm.spec: add EXTRAVERSION string to make command line (jsc#SLE-24761, bsc#1193566) - Update mdadm package to latest mdadm since mdadm-4.2 (jsc#PED-1009, jsc#PED-947) * Only patches directly change runtime programs included, - Unify error message. 0001-Unify-error-message.patch - mdadm: Fix double free 0002-mdadm-Fix-double-free.patch - Grow_reshape: Add r0 grow size error message and update 0003-Grow_reshape-Add-r0-grow-size-error-message-and-upda.patch - udev: adapt rules to systemd v247 0004-udev-adapt-rules-to-systemd-v247.patch - Replace error prone signal() with sigaction() 0005-Replace-error-prone-signal-with-sigaction.patch - mdadm: Respect config file location in man 0006-mdadm-Respect-config-file-location-in-man.patch - mdadm: Update ReadMe 0007-mdadm-Update-ReadMe.patch - mdadm: Update config man regarding default files and 0008-mdadm-Update-config-man-regarding-default-files-and-.patch - mdadm: Update config manual 0009-mdadm-Update-config-manual.patch - Create, Build: use default_layout() 0010-Create-Build-use-default_layout.patch - mdadm: add map_num_s() 0011-mdadm-add-map_num_s.patch - mdmon: Stop parsing duplicate options 0012-mdmon-Stop-parsing-duplicate-options.patch - Grow: block -n on external volumes. 0013-Grow-block-n-on-external-volumes.patch - Incremental: Fix possible memory and resource leaks 0014-Incremental-Fix-possible-memory-and-resource-leaks.patch - Mdmonitor: Fix segfault 0015-Mdmonitor-Fix-segfault.patch - Mdmonitor: Improve logging method 0016-Mdmonitor-Improve-logging-method.patch - Fix possible NULL ptr dereferences and memory leaks 0017-Fix-possible-NULL-ptr-dereferences-and-memory-leaks.patch - imsm: Remove possibility for get_imsm_dev to return 0018-imsm-Remove-possibility-for-get_imsm_dev-to-return-N.patch - Revert "mdadm: fix coredump of mdadm --monitor -r" 0019-Revert-mdadm-fix-coredump-of-mdadm-monitor-r.patch - util: replace ioctl use with function 0020-util-replace-ioctl-use-with-function.patch - mdadm/super1: restore commit 45a87c2f31335 to fix 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: introduce get_disk_slot_in_dev() 0022-imsm-introduce-get_disk_slot_in_dev.patch - imsm: use same slot across container 0023-imsm-use-same-slot-across-container.patch - imsm: block changing slots during creation 0024-imsm-block-changing-slots-during-creation.patch - mdadm: block update=ppl for non raid456 levels 0025-mdadm-block-update-ppl-for-non-raid456-levels.patch - mdadm: Fix array size mismatch after grow 0026-mdadm-Fix-array-size-mismatch-after-grow.patch - mdadm: Remove dead code in imsm_fix_size_mismatch 0027-mdadm-Remove-dead-code-in-imsm_fix_size_mismatch.patch - Monitor: use devname as char array instead of pointer 0028-Monitor-use-devname-as-char-array-instead-of-pointer.patch - Monitor: use snprintf to fill device name 0029-Monitor-use-snprintf-to-fill-device-name.patch - Makefile: Don't build static build with everything and 0030-Makefile-Don-t-build-static-build-with-everything-an.patch - DDF: Cleanup validate_geometry_ddf_container() 0031-DDF-Cleanup-validate_geometry_ddf_container.patch - DDF: Fix NULL pointer dereference in 0032-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch - mdadm/Grow: Fix use after close bug by closing after 0033-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch - monitor: Avoid segfault when calling NULL 0034-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch - mdadm: Fix mdadm -r remove option regression 0035-mdadm-Fix-mdadm-r-remove-option-regression.patch - mdadm: Fix optional --write-behind parameter 0036-mdadm-Fix-optional-write-behind-parameter.patch - mdadm: Replace obsolete usleep with nanosleep 0037-mdadm-Replace-obsolete-usleep-with-nanosleep.patch - mdadm: remove symlink option 0038-mdadm-remove-symlink-option.patch - mdadm: move data_offset to struct shape 0039-mdadm-move-data_offset-to-struct-shape.patch - mdadm: Don't open md device for CREATE and ASSEMBLE 0040-mdadm-Don-t-open-md-device-for-CREATE-and-ASSEMBLE.patch - Grow: Split Grow_reshape into helper function 0041-Grow-Split-Grow_reshape-into-helper-function.patch - Assemble: check if device is container before 0042-Assemble-check-if-device-is-container-before-schedul.patch - super1: report truncated device 0043-super1-report-truncated-device.patch - mdadm: Correct typos, punctuation and grammar in man 0044-mdadm-Correct-typos-punctuation-and-grammar-in-man.patch - Manage: Block unsafe member failing 0045-Manage-Block-unsafe-member-failing.patch - Monitor: Fix statelist memory leaks 0046-Monitor-Fix-statelist-memory-leaks.patch - mdadm: added support for Intel Alderlake RST on VMD 0047-mdadm-added-support-for-Intel-Alderlake-RST-on-VMD-p.patch - mdadm: Add Documentation entries to systemd services 0048-mdadm-Add-Documentation-entries-to-systemd-services.patch - ReadMe: fix command-line help 0049-ReadMe-fix-command-line-help.patch - mdadm: replace container level checking with inline 0050-mdadm-replace-container-level-checking-with-inline.patch - Mdmonitor: Omit non-md devices 0051-Mdmonitor-Omit-non-md-devices.patch - Remove the following in house patch 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch because upstream merged version added in as 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - Rename 0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch to 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Update mdadm package to mdadm-4.2 (jsc#PED-1009, jsc#PED-947) All important modifications since previous update to mdadm-4.2 are listed here. * The patches about Intel Matrix Storage Manager (including VROC support), - super-intel.c: Handle errors from calls to get_dev_sector_size() - imsm: change wrong size verification - imsm: add generic method to resolve "device" links - imsm: add devpath_to_char method - imsm: Limit support to the lowest namespace - imsm: correct offset for 4k disks in --examine output - imsm: Fix possible memory leaks and refactor freeing struct dl - imsm: fix num_data_stripes after raid0 takeover - imsm: introduce helpers to manage file descriptors - imsm: free allocated memory in imsm_fix_size_mismatch - imsm: assert if there is migration but prev_map doesn't exist * The patches to fix program issues, - mdadm/super1: It needs to specify int32 for bitmap_offset - Fix memory leak after "mdadm --detail" - Utils: Change sprintf to snprintf - mdadm: fix coredump of mdadm --monitor -r - Fix error message when creating raid 4, 5 and 10 - Fix buffer size warning for strcp - Fix potential overlap dest buffer - Correct checking if file descriptors are valid - Monitor: print message before quit for no array to monitor * Improvement or bug fixes for mdadm itself, - Assemble: skip devices that don't match uuid instead of aborting the assembly. - Assemble: apply sysfs rules - Assemble: start dirty and degraded array. - Incremental: Close unclosed mdfd in IncrementalScan() - Monitor: make libudev dependency optional - Manage: Call validate_geometry when adding drive to external container - Remove Spare drives line from details for external metadata - Don't associate spares with other arrays during RAID Examine - Add error handling for chunk size in RAID1 - Add monitor delay parameter to mdadm.conf - disallow create or grow clustered bitmap with writemostly set - mdadm/Detail: Can't show container name correctly when unpluging disks - mdadm: block creation with long names - mdadm: fix growing containers - Remove the following patches because they are all included in mdadm-4.2, - 0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch - 0002-Document-PART-POLICY-lines.patch - 0003-policy-support-devices-with-multiple-paths.patch - 0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch - 0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch - 0006-imsm-update-metadata-correctly-while-raid10-double-d.patch - 0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch - 0008-Grow-avoid-overflow-in-compute_backup_blocks.patch - 0009-Grow-report-correct-new-chunk-size.patch - 0010-policy.c-prevent-NULL-pointer-referencing.patch - 0012-policy.c-Fix-for-compiler-error.patch - 0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch - 0014-imsm-fix-reshape-for-2TB-drives.patch - 0015-Fix-spelling-typos.patch - 0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch - 0018-Fix-reshape-for-decreasing-data-offset.patch - 0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch - 0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch - 0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch - 0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch - 0023-add-missing-units-to-examine.patch - 0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch - 0025-Create-Block-rounding-size-to-max.patch - 0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch - 0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch - 0028-Enable-probe_roms-to-scan-more-than-6-roms.patch - 0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch - 0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch - 0031-super-intel-Use-put_unaligned-in-split_ull.patch - 0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch - 0033-mdadm.h-include-sysmacros.h-unconditionally.patch - 0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch - 0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch - 0036-imsm-close-removed-drive-fd.patch - 0037-mdadm-check-value-returned-by-snprintf-against-error.patch - 0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch - 0039-mdadm-force-a-uuid-swap-on-big-endian.patch - 0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch - 0041-Init-devlist-as-an-array.patch - 0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch - 0043-udev-allow-for-udev-attribute-reading-bug.patch - 0044-imsm-save-current_vol-number.patch - 0045-imsm-allow-to-specify-second-volume-size.patch - 0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch - 0050-mdcheck-use-to-pass-variable-to-mdcheck.patch - 0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch - 0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch - 0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch - 0054-Remove-last-traces-of-HOT_ADD_DISK.patch - 0055-Fix-up-a-few-formatting-issues.patch - 0056-Remove-unused-code.patch - 0057-imsm-return-correct-uuid-for-volume-in-detail.patch - 0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch - 0059-Create-add-support-for-RAID0-layouts.patch - 0060-Assemble-add-support-for-RAID0-layouts.patch - 0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch - 0062-Change-warning-message.patch - 0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch - 0064-imsm-Update-grow-manual.patch - 0065-Add-support-for-Tebibytes.patch - 0066-imsm-fill-working_disks-according-to-metadata.patch - 0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch - 0068-Remove-the-legacy-whitespace.patch - 0069-imsm-pass-subarray-id-to-kill_subarray-function.patch - 0070-imsm-Remove-dump-restore-implementation.patch - 0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch - 0072-Detail-adding-sync-status-for-cluster-device.patch - 0073-imsm-Correct-minimal-device-size.patch - 0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch - 0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch - 0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch - 0077-udev-Ignore-change-event-for-imsm.patch - 0078-Manage-imsm-Write-metadata-before-add.patch - 0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch - 0080-clean-up-meaning-of-small-typo.patch - 0081-Assemble.c-respect-force-flag.patch - 0082-mdcheck-Log-when-done.patch - 0083-Makefile-add-EXTRAVERSION-support.patch - 0084-uuid.c-split-uuid-stuffs-from-util.c.patch - 0085-Include-count-for-0-character-when-using-strncpy-to-.patch - 0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch - 0087-Block-overwriting-existing-links-while-manual-assemb.patch - 0088-Detect-too-small-device-error-rather-than-underflow-.patch - 0089-Use-more-secure-HTTPS-URLs.patch - 0090-Update-link-to-Intel-page-for-IMSM.patch - 0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch - 0092-Specify-nodes-number-when-updating-cluster-nodes.patch - 0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch - 0094-manual-update-examine-badblocks.patch - 0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch - 0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch - 0097-Monitor-refresh-mdstat-fd-after-select.patch - 0098-Monitor-stop-notifing-about-containers.patch - 0099-mdmonitor-set-small-delay-once.patch - 0100-Check-if-other-Monitor-instance-running-before-fork.patch - 0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch - 0102-Detail-fix-segfault-during-IMSM-raid-creation.patch - 0103-Create.c-close-mdfd-and-generate-uevent.patch - 0104-imsm-update-num_data_stripes-according-to-dev_size.patch - 0105-imsm-remove-redundant-calls-to-imsm_get_map.patch - 0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch - 0107-imsm-limit-support-to-first-NVMe-namespace.patch - 0108-mdadm-Unify-forks-behaviour.patch - 0109-mdadm-Detail-show-correct-state-for-clustered-array.patch - 0110-Make-target-to-install-binaries-only.patch - 0111-udev-start-grow-service-automatically.patch - 0112-Incremental-Remove-redundant-spare-movement-logic.patch - 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - 0114-super1-fix-Floating-point-exception.patch - 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - 0116-imsm-nvme-multipath-support.patch - 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - 0121-imsm-support-for-third-Sata-controller.patch - The patch from SLE15-SP4 is removed because it is in mdadm-4.2 upstream already, - Monitor: print message before quit for no array to monitor (bsc#1183229) 0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch - mdadm.spec: remove "PreReq: %{_sbindir}/mkinitrd" as it is unnecessary now. (bsc#1202352) - Call mdadm_env.sh from /usr/libexec/mdadm (bsc#1111960, bsc#1202090) 1004-call-mdadm_env.sh-from-usr-libexec-mdadm.patch - The patch (bsc#1111960) which fixed rpm check failure is replaced by the above patch, 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Drop the patch which is reported as regression by upstream developer (bsc#1206139) 0045-Manage-Block-unsafe-member-failing.patch - Add jsc#PED-947 together with jsc#PED-1009 in mdadm.changes, they are both the requirement to update mdadm to latest upstream state via different requestors. - mdadm.spec: create the following symbolic link in /sbin for compatibility, /sbin/mdadm -> /usr/sbin/mdadm /sbin/mdmon -> /usr/sbin/mdmon (jsc#PED-1009, jsc#PED-947) - sysconfig.mdadm: Remove ServiceRestart line to mdadm since there is not such systemd service. (bsc#1203491) - Fixes for mdmon to ensure it run at the right time in the fight mount namespace. This fixes various problems with IMSM raid arrays in 15-SP4 (bsc#1205493, bsc#1205830) - mdmon: fix segfault 0052-mdmon-fix-segfault.patch - util: remove obsolete code from get_md_name 0053-util-remove-obsolete-code-from-get_md_name.patch - mdmon: don't test both 'all' and 'container_name'. 0054-mdmon-don-t-test-both-all-and-container_name.patch - mdmon: change systemd unit file to use --foreground 0055-mdmon-change-systemd-unit-file-to-use-foreground.patch - mdmon: Remove need for KillMode=none 0056-mdmon-Remove-need-for-KillMode-none.patch - mdmon: Improve switchroot interactions. 0057-mdmon-Improve-switchroot-interactions.patch - mdopen: always try create_named_array() 0058-mdopen-always-try-create_named_array.patch - Improvements for IMSM_NO_PLATFORM testing 0059-Improvements-for-IMSM_NO_PLATFORM-testing.patch - Grow: fix possible memory leak (bsc#1208618) 0060-Grow-fix-possible-memory-leak.patch - Grow: fix can't change bitmap type from none to clustered (bsc#1208618) 0061-Grow-fix-can-t-change-bitmap-type-from-none-to-clustered.patch - Use source code mdadm-4.2.tar.xz from kernel.org version for checksum - mdadm-4.2.tar.xz - mdadm: define DEV_MD_DIR (bsc#1226413) 0062-mdadm-define-DEV_MD_DIR.patch - mdadm: refactor ident->name handling (bsc#1226413) 0063-mdadm-refactor-ident-name-handling.patch - mdadm: Follow POSIX Portable Character Set (bsc#1226413) 0064-mdadm-Follow-POSIX-Portable-Character-Set.patch - Detail: remove duplicated code (bsc#1226413) 0065-Detail-remove-duplicated-code.patch - mdadm: Fix native --detail --export (bsc#1226413) 0066-mdadm-Fix-native-detail-export.patch - Incremental: Remove redundant spare movement logic (jsc#SLE-13700, bsc#1180220) 0112-Incremental-Remove-redundant-spare-movement-logic.patch - Dump: get stat from a wrong metadata file when restoring metadata (jsc#SLE-13700) 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - cluster-md/mdadm : avoid useless re-sync (bsc#1181341) 0114-super1-fix-Floating-point-exception.patch 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - imsm: nvme multipath support (bsc#1175758) 0116-imsm-nvme-multipath-support.patch - Grow: be careful of corrupt dev_roles list (bsc#1181619) 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - Remove Spare drives line from details for external metadata (bsc#1180661, bsc#1182642) 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - Don't associate spares with other arrays during RAID Examine (bsc#1180661, bsc#1182642) 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - Install mdadm in _sbindir rather than /sbin. This is more appropriate now that we have a merged-/usr. (bsc#1191076) - Use %{_sbindir} for prerequisite of mkinitrd to work with usrmerge of dracut-mkinitrd-deprecated - skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054) * Add 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158) 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: support for third Sata controller (bsc#1201297) 0121-imsm-support-for-third-Sata-controller.patch - mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297) 1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch - mdadm.spec: add EXTRAVERSION string to make command line (jsc#SLE-24761, bsc#1193566) - Update mdadm package to latest mdadm since mdadm-4.2 (jsc#PED-1009, jsc#PED-947) * Only patches directly change runtime programs included, - Unify error message. 0001-Unify-error-message.patch - mdadm: Fix double free 0002-mdadm-Fix-double-free.patch - Grow_reshape: Add r0 grow size error message and update 0003-Grow_reshape-Add-r0-grow-size-error-message-and-upda.patch - udev: adapt rules to systemd v247 0004-udev-adapt-rules-to-systemd-v247.patch - Replace error prone signal() with sigaction() 0005-Replace-error-prone-signal-with-sigaction.patch - mdadm: Respect config file location in man 0006-mdadm-Respect-config-file-location-in-man.patch - mdadm: Update ReadMe 0007-mdadm-Update-ReadMe.patch - mdadm: Update config man regarding default files and 0008-mdadm-Update-config-man-regarding-default-files-and-.patch - mdadm: Update config manual 0009-mdadm-Update-config-manual.patch - Create, Build: use default_layout() 0010-Create-Build-use-default_layout.patch - mdadm: add map_num_s() 0011-mdadm-add-map_num_s.patch - mdmon: Stop parsing duplicate options 0012-mdmon-Stop-parsing-duplicate-options.patch - Grow: block -n on external volumes. 0013-Grow-block-n-on-external-volumes.patch - Incremental: Fix possible memory and resource leaks 0014-Incremental-Fix-possible-memory-and-resource-leaks.patch - Mdmonitor: Fix segfault 0015-Mdmonitor-Fix-segfault.patch - Mdmonitor: Improve logging method 0016-Mdmonitor-Improve-logging-method.patch - Fix possible NULL ptr dereferences and memory leaks 0017-Fix-possible-NULL-ptr-dereferences-and-memory-leaks.patch - imsm: Remove possibility for get_imsm_dev to return 0018-imsm-Remove-possibility-for-get_imsm_dev-to-return-N.patch - Revert "mdadm: fix coredump of mdadm --monitor -r" 0019-Revert-mdadm-fix-coredump-of-mdadm-monitor-r.patch - util: replace ioctl use with function 0020-util-replace-ioctl-use-with-function.patch - mdadm/super1: restore commit 45a87c2f31335 to fix 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - imsm: introduce get_disk_slot_in_dev() 0022-imsm-introduce-get_disk_slot_in_dev.patch - imsm: use same slot across container 0023-imsm-use-same-slot-across-container.patch - imsm: block changing slots during creation 0024-imsm-block-changing-slots-during-creation.patch - mdadm: block update=ppl for non raid456 levels 0025-mdadm-block-update-ppl-for-non-raid456-levels.patch - mdadm: Fix array size mismatch after grow 0026-mdadm-Fix-array-size-mismatch-after-grow.patch - mdadm: Remove dead code in imsm_fix_size_mismatch 0027-mdadm-Remove-dead-code-in-imsm_fix_size_mismatch.patch - Monitor: use devname as char array instead of pointer 0028-Monitor-use-devname-as-char-array-instead-of-pointer.patch - Monitor: use snprintf to fill device name 0029-Monitor-use-snprintf-to-fill-device-name.patch - Makefile: Don't build static build with everything and 0030-Makefile-Don-t-build-static-build-with-everything-an.patch - DDF: Cleanup validate_geometry_ddf_container() 0031-DDF-Cleanup-validate_geometry_ddf_container.patch - DDF: Fix NULL pointer dereference in 0032-DDF-Fix-NULL-pointer-dereference-in-validate_geometr.patch - mdadm/Grow: Fix use after close bug by closing after 0033-mdadm-Grow-Fix-use-after-close-bug-by-closing-after-.patch - monitor: Avoid segfault when calling NULL 0034-monitor-Avoid-segfault-when-calling-NULL-get_bad_blo.patch - mdadm: Fix mdadm -r remove option regression 0035-mdadm-Fix-mdadm-r-remove-option-regression.patch - mdadm: Fix optional --write-behind parameter 0036-mdadm-Fix-optional-write-behind-parameter.patch - mdadm: Replace obsolete usleep with nanosleep 0037-mdadm-Replace-obsolete-usleep-with-nanosleep.patch - mdadm: remove symlink option 0038-mdadm-remove-symlink-option.patch - mdadm: move data_offset to struct shape 0039-mdadm-move-data_offset-to-struct-shape.patch - mdadm: Don't open md device for CREATE and ASSEMBLE 0040-mdadm-Don-t-open-md-device-for-CREATE-and-ASSEMBLE.patch - Grow: Split Grow_reshape into helper function 0041-Grow-Split-Grow_reshape-into-helper-function.patch - Assemble: check if device is container before 0042-Assemble-check-if-device-is-container-before-schedul.patch - super1: report truncated device 0043-super1-report-truncated-device.patch - mdadm: Correct typos, punctuation and grammar in man 0044-mdadm-Correct-typos-punctuation-and-grammar-in-man.patch - Manage: Block unsafe member failing 0045-Manage-Block-unsafe-member-failing.patch - Monitor: Fix statelist memory leaks 0046-Monitor-Fix-statelist-memory-leaks.patch - mdadm: added support for Intel Alderlake RST on VMD 0047-mdadm-added-support-for-Intel-Alderlake-RST-on-VMD-p.patch - mdadm: Add Documentation entries to systemd services 0048-mdadm-Add-Documentation-entries-to-systemd-services.patch - ReadMe: fix command-line help 0049-ReadMe-fix-command-line-help.patch - mdadm: replace container level checking with inline 0050-mdadm-replace-container-level-checking-with-inline.patch - Mdmonitor: Omit non-md devices 0051-Mdmonitor-Omit-non-md-devices.patch - Remove the following in house patch 1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch because upstream merged version added in as 0021-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch - Rename 0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch to 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Update mdadm package to mdadm-4.2 (jsc#PED-1009, jsc#PED-947) All important modifications since previous update to mdadm-4.2 are listed here. * The patches about Intel Matrix Storage Manager (including VROC support), - super-intel.c: Handle errors from calls to get_dev_sector_size() - imsm: change wrong size verification - imsm: add generic method to resolve "device" links - imsm: add devpath_to_char method - imsm: Limit support to the lowest namespace - imsm: correct offset for 4k disks in --examine output - imsm: Fix possible memory leaks and refactor freeing struct dl - imsm: fix num_data_stripes after raid0 takeover - imsm: introduce helpers to manage file descriptors - imsm: free allocated memory in imsm_fix_size_mismatch - imsm: assert if there is migration but prev_map doesn't exist * The patches to fix program issues, - mdadm/super1: It needs to specify int32 for bitmap_offset - Fix memory leak after "mdadm --detail" - Utils: Change sprintf to snprintf - mdadm: fix coredump of mdadm --monitor -r - Fix error message when creating raid 4, 5 and 10 - Fix buffer size warning for strcp - Fix potential overlap dest buffer - Correct checking if file descriptors are valid - Monitor: print message before quit for no array to monitor * Improvement or bug fixes for mdadm itself, - Assemble: skip devices that don't match uuid instead of aborting the assembly. - Assemble: apply sysfs rules - Assemble: start dirty and degraded array. - Incremental: Close unclosed mdfd in IncrementalScan() - Monitor: make libudev dependency optional - Manage: Call validate_geometry when adding drive to external container - Remove Spare drives line from details for external metadata - Don't associate spares with other arrays during RAID Examine - Add error handling for chunk size in RAID1 - Add monitor delay parameter to mdadm.conf - disallow create or grow clustered bitmap with writemostly set - mdadm/Detail: Can't show container name correctly when unpluging disks - mdadm: block creation with long names - mdadm: fix growing containers - Remove the following patches because they are all included in mdadm-4.2, - 0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch - 0002-Document-PART-POLICY-lines.patch - 0003-policy-support-devices-with-multiple-paths.patch - 0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch - 0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch - 0006-imsm-update-metadata-correctly-while-raid10-double-d.patch - 0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch - 0008-Grow-avoid-overflow-in-compute_backup_blocks.patch - 0009-Grow-report-correct-new-chunk-size.patch - 0010-policy.c-prevent-NULL-pointer-referencing.patch - 0012-policy.c-Fix-for-compiler-error.patch - 0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch - 0014-imsm-fix-reshape-for-2TB-drives.patch - 0015-Fix-spelling-typos.patch - 0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch - 0018-Fix-reshape-for-decreasing-data-offset.patch - 0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch - 0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch - 0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch - 0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch - 0023-add-missing-units-to-examine.patch - 0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch - 0025-Create-Block-rounding-size-to-max.patch - 0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch - 0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch - 0028-Enable-probe_roms-to-scan-more-than-6-roms.patch - 0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch - 0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch - 0031-super-intel-Use-put_unaligned-in-split_ull.patch - 0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch - 0033-mdadm.h-include-sysmacros.h-unconditionally.patch - 0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch - 0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch - 0036-imsm-close-removed-drive-fd.patch - 0037-mdadm-check-value-returned-by-snprintf-against-error.patch - 0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch - 0039-mdadm-force-a-uuid-swap-on-big-endian.patch - 0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch - 0041-Init-devlist-as-an-array.patch - 0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch - 0043-udev-allow-for-udev-attribute-reading-bug.patch - 0044-imsm-save-current_vol-number.patch - 0045-imsm-allow-to-specify-second-volume-size.patch - 0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch - 0050-mdcheck-use-to-pass-variable-to-mdcheck.patch - 0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch - 0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch - 0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch - 0054-Remove-last-traces-of-HOT_ADD_DISK.patch - 0055-Fix-up-a-few-formatting-issues.patch - 0056-Remove-unused-code.patch - 0057-imsm-return-correct-uuid-for-volume-in-detail.patch - 0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch - 0059-Create-add-support-for-RAID0-layouts.patch - 0060-Assemble-add-support-for-RAID0-layouts.patch - 0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch - 0062-Change-warning-message.patch - 0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch - 0064-imsm-Update-grow-manual.patch - 0065-Add-support-for-Tebibytes.patch - 0066-imsm-fill-working_disks-according-to-metadata.patch - 0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch - 0068-Remove-the-legacy-whitespace.patch - 0069-imsm-pass-subarray-id-to-kill_subarray-function.patch - 0070-imsm-Remove-dump-restore-implementation.patch - 0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch - 0072-Detail-adding-sync-status-for-cluster-device.patch - 0073-imsm-Correct-minimal-device-size.patch - 0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch - 0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch - 0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch - 0077-udev-Ignore-change-event-for-imsm.patch - 0078-Manage-imsm-Write-metadata-before-add.patch - 0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch - 0080-clean-up-meaning-of-small-typo.patch - 0081-Assemble.c-respect-force-flag.patch - 0082-mdcheck-Log-when-done.patch - 0083-Makefile-add-EXTRAVERSION-support.patch - 0084-uuid.c-split-uuid-stuffs-from-util.c.patch - 0085-Include-count-for-0-character-when-using-strncpy-to-.patch - 0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch - 0087-Block-overwriting-existing-links-while-manual-assemb.patch - 0088-Detect-too-small-device-error-rather-than-underflow-.patch - 0089-Use-more-secure-HTTPS-URLs.patch - 0090-Update-link-to-Intel-page-for-IMSM.patch - 0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch - 0092-Specify-nodes-number-when-updating-cluster-nodes.patch - 0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch - 0094-manual-update-examine-badblocks.patch - 0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch - 0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch - 0097-Monitor-refresh-mdstat-fd-after-select.patch - 0098-Monitor-stop-notifing-about-containers.patch - 0099-mdmonitor-set-small-delay-once.patch - 0100-Check-if-other-Monitor-instance-running-before-fork.patch - 0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch - 0102-Detail-fix-segfault-during-IMSM-raid-creation.patch - 0103-Create.c-close-mdfd-and-generate-uevent.patch - 0104-imsm-update-num_data_stripes-according-to-dev_size.patch - 0105-imsm-remove-redundant-calls-to-imsm_get_map.patch - 0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch - 0107-imsm-limit-support-to-first-NVMe-namespace.patch - 0108-mdadm-Unify-forks-behaviour.patch - 0109-mdadm-Detail-show-correct-state-for-clustered-array.patch - 0110-Make-target-to-install-binaries-only.patch - 0111-udev-start-grow-service-automatically.patch - 0112-Incremental-Remove-redundant-spare-movement-logic.patch - 0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch - 0114-super1-fix-Floating-point-exception.patch - 0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch - 0116-imsm-nvme-multipath-support.patch - 0117-Grow-be-careful-of-corrupt-dev_roles-list.patch - 0118-Remove-Spare-drives-line-from-details-for-external-m.patch - 0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch - 0120-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch - 0121-imsm-support-for-third-Sata-controller.patch - The patch from SLE15-SP4 is removed because it is in mdadm-4.2 upstream already, - Monitor: print message before quit for no array to monitor (bsc#1183229) 0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch - mdadm.spec: remove "PreReq: %{_sbindir}/mkinitrd" as it is unnecessary now. (bsc#1202352) - Call mdadm_env.sh from /usr/libexec/mdadm (bsc#1111960, bsc#1202090) 1004-call-mdadm_env.sh-from-usr-libexec-mdadm.patch - The patch (bsc#1111960) which fixed rpm check failure is replaced by the above patch, 1004-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch. - Drop the patch which is reported as regression by upstream developer (bsc#1206139) 0045-Manage-Block-unsafe-member-failing.patch - Add jsc#PED-947 together with jsc#PED-1009 in mdadm.changes, they are both the requirement to update mdadm to latest upstream state via different requestors. - mdadm.spec: create the following symbolic link in /sbin for compatibility, /sbin/mdadm -> /usr/sbin/mdadm /sbin/mdmon -> /usr/sbin/mdmon (jsc#PED-1009, jsc#PED-947) - sysconfig.mdadm: Remove ServiceRestart line to mdadm since there is not such systemd service. (bsc#1203491) - Fixes for mdmon to ensure it run at the right time in the fight mount namespace. This fixes various problems with IMSM raid arrays in 15-SP4 (bsc#1205493, bsc#1205830) - mdmon: fix segfault 0052-mdmon-fix-segfault.patch - util: remove obsolete code from get_md_name 0053-util-remove-obsolete-code-from-get_md_name.patch - mdmon: don't test both 'all' and 'container_name'. 0054-mdmon-don-t-test-both-all-and-container_name.patch - mdmon: change systemd unit file to use --foreground 0055-mdmon-change-systemd-unit-file-to-use-foreground.patch - mdmon: Remove need for KillMode=none 0056-mdmon-Remove-need-for-KillMode-none.patch - mdmon: Improve switchroot interactions. 0057-mdmon-Improve-switchroot-interactions.patch - mdopen: always try create_named_array() 0058-mdopen-always-try-create_named_array.patch - Improvements for IMSM_NO_PLATFORM testing 0059-Improvements-for-IMSM_NO_PLATFORM-testing.patch - Grow: fix possible memory leak (bsc#1208618) 0060-Grow-fix-possible-memory-leak.patch - Grow: fix can't change bitmap type from none to clustered (bsc#1208618) 0061-Grow-fix-can-t-change-bitmap-type-from-none-to-clustered.patch - Use source code mdadm-4.2.tar.xz from kernel.org version for checksum - mdadm-4.2.tar.xz - mdadm: define DEV_MD_DIR (bsc#1226413) 0062-mdadm-define-DEV_MD_DIR.patch - mdadm: refactor ident->name handling (bsc#1226413) 0063-mdadm-refactor-ident-name-handling.patch - mdadm: Follow POSIX Portable Character Set (bsc#1226413) 0064-mdadm-Follow-POSIX-Portable-Character-Set.patch - Detail: remove duplicated code (bsc#1226413) 0065-Detail-remove-duplicated-code.patch - mdadm: Fix native --detail --export (bsc#1226413) 0066-mdadm-Fix-native-detail-export.patch - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Added "Provides: nss" so other RPMs that require 'nss' can be installed (jira PED-6358). - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox when using FIPS-mode (bsc#1223724). - update to NSS 3.90.3 * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. * bmo#1748105 - clean up escape handling. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1836925 - Disable ASM support for Curve25519. * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64. - remove upstreamed nss-fix-bmo1836925.patch - update to NSS 3.101.1 * bmo#1901932 - missing sqlite header. * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME. - update to NSS 3.101 * bmo#1900413 - add diagnostic assertions for SFTKObject refcount. * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed * bmo#1899883 - fix formatting issues. * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS. * bmo#1899593 - remove invalid acvp fuzz test vectors. * bmo#1898830 - pad short P-384 and P-521 signatures gtests. * bmo#1898627 - remove unused FreeBL ECC code. * bmo#1898830 - pad short P-384 and P-521 signatures. * bmo#1898825 - be less strict about ECDSA private key length. * bmo#1854439 - Integrate HACL* P-521. * bmo#1854438 - Integrate HACL* P-384. * bmo#1898074 - memory leak in create_objects_from_handles. * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1748105 - clean up escape handling * bmo#1896353 - Use lib::pkix as default validator instead of the old-one * bmo#1827444 - Need to add high level support for PQ signing. * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects * bmo#1793811 - Implement support for PBMAC1 in PKCS#12 * bmo#1897487 - disable VLA warnings for fuzz builds. * bmo#1895032 - remove redundant AllocItem implementation. * bmo#1893334 - add PK11_ReadDistrustAfterAttribute. * bmo#215997 - Clang-formatting of SEC_GetMgfTypeByOidTag update * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile. * bmo#1830415 - Switch to the mozillareleases/image_builder image - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain) - Remove part of nss-fips-zeroization.patch that got removed upstream - update to NSS 3.100 - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for faster Xyber operations. - bmo#1893752 - remove ckcapi. - bmo#1893162 - avoid a potential PK11GenericObject memory leak. - bmo#671060 - Remove incomplete ESDH code. - bmo#215997 - Decrypt RSA OAEP encrypted messages. - bmo#1887996 - Fix certutil CRLDP URI code. - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys. - bmo#676118 - Add ability to encrypt and decrypt CMS messages using ECDH. - bmo#676100 - Correct Templates for key agreement in smime/cmsasn.c. - bmo#1548723 - Moving the decodedCert allocation to NSS. - bmo#1885404 - Allow developers to speed up repeated local execution of NSS tests that depend on certificates. - update to NSS 3.99 * Removing check for message len in ed25519 (bmo#1325335) * add ed25519 to SECU_ecName2params. (bmo#1884276) * add EdDSA wycheproof tests. (bmo#1325335) * nss/lib layer code for EDDSA. (bmo#1325335) * Adding EdDSA implementation. (bmo#1325335) * Exporting Certificate Compression types (bmo#1881027) * Updating ACVP docker to rust 1.74 (bmo#1880857) * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335) * Add NSS_CMSRecipient_IsSupported. (bmo#1877730) - update to NSS 3.98 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS * bmo#1879513 - Certificate Compression: enabling the check that the compression was advertised * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha * bmo#1879945 - Remove Email trust bit from OISTE WISeKey Global Root GC CA * bmo#1877344 - Replace `distutils.spawn.find_executable` with `shutil.which` within `mach` in `nss` * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to support Certificate compression * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation * bmo#1875356 - Add valgrind annotations to freebl kyber operations for constant-time execution tests * bmo#1870673 - Set nssckbi version number to 2.66 * bmo#1874017 - Add Telekom Security roots * bmo#1873095 - Add D-Trust 2022 S/MIME roots * bmo#1865450 - Remove expired Security Communication RootCA1 root * bmo#1876179 - move keys to a slot that supports concatenation in PK11_ConcatSymKeys * bmo#1876800 - remove unmaintained tls-interop tests * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim flags * bmo#1874937 - bogo: add support for the -curves shim flag and update Kyber expectations * bmo#1874937 - bogo: adjust expectation for a key usage bit test * bmo#1757758 - mozpkix: add option to ignore invalid subject alternative names * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value * bmo#1876390 - take ownership of ecckilla shims * bmo#1874458 - add valgrind annotations to freebl/ec.c * bmo#864039 - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip * bmo#1875965 - Update zlib to 1.3.1 - Use %patch -P N instead of deprecated %patchN. - update to NSS 3.97 * bmo#1875506 - make Xyber768d00 opt-in by policy * bmo#1871631 - add libssl support for xyber768d00 * bmo#1871630 - add PK11_ConcatSymKeys * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken * bmo#1871152 - add a FreeBL API for Kyber * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo * bmo#1835828 - Removing the calls to RSA Blind from loader.* * bmo#1874111 - fix worker type for level3 mac tasks * bmo#1835828 - RSA Blind implementation * bmo#1869642 - Remove DSA selftests * bmo#1873296 - read KWP testvectors from JSON * bmo#1822450 - Backed out changeset dcb174139e4f * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation * bmo#1871219 - Wrap CC shell commands in gyp expansions - update to NSS 3.96.1 * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups) * bmo#1867408 - add a defensive check for large ssl_DefSend return values * bmo#1869378 - Add dependency to the taskcluster script for Darwin * bmo#1869378 - Upgrade version of the MacOS worker for the CI - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with explicit default trust flags" test needs longer than the allowed 6 seconds on s390x - update to NSS 3.95 * bmo#1842932 - Bump builtins version number. * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion Firmaprofesional CIF A62634068 root cert. * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS. * bmo#1850982 - Remove Camerfirma root certificates from NSS. * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional Certificate. * bmo#1860670 - Add four Commscope root certificates to NSS. * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates. * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL* * bmo#1861728 - Include P-256 Scalar Validation from HACL*. * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes 256 ECC without DER wrapping at the softoken level * bmo#1837987 - Add means to provide library parameters to C_Initialize * bmo#1573097 - clang format * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber * bmo#1573097 - Fix Invalid casts in instance.c - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test - Update to NSS 3.93: * bmo#1849471 - Update zlib in NSS to 1.3. * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs. * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980). - Rebase nss-fips-pct-pubkeys.patch. - update to NSS 3.92 * bmo#1822935 - Set nssckbi version number to 2.62 * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS * bmo#1839992 - Add 4 SSL.com Root CA certificates * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates * bmo#1840437 - Add LAWtrust Root CA2 (4096) * bmo#1822936 - Remove E-Tugra Certification Authority root * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root. * bmo#1840505 - Remove Hongkong Post Root CA 1 * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3 * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux - update to NSS 3.91 * bmo#1837431 - Implementation of the HW support check for ADX instruction * bmo#1836925 - Removing the support of Curve25519 * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData * bmo#1839327 - Adding args to enable-legacy-db build * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit default trust flags" * bmo#1837617 - Initialize flags in slot structures * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow * bmo#1829112 - Followup Fixes * bmo#1784253 - avoid processing unexpected inputs by checking for m_exptmod base sign * bmo#1826652 - add a limit check on order_k to avoid infinite loop * bmo#1834851 - Update HACL* to commit 5f6051d2 * bmo#1753026 - add SHA3 to cryptohi and softoken * bmo#1753026 - HACL SHA3 * bmo#1836781 - Disabling ASM C25519 for A but X86_64 - removed upstreamed patch nss-fix-bmo1836925.patch - Added nss-fips-safe-memset.patch, fixing bsc#1222811. - Removed some dead code from nss-fips-constructor-self-tests.patch. - Rebased nss-fips-approved-crypto-non-ec.patch on above changes. - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813, bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118. - Updated nss-fips-approved-crypto-non-ec.patch and nss-fips-constructor-self-tests.patch, fixing bsc#1222807, bsc#1222828, bsc#1222834. - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804, bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116. - update to NSS 3.101.2 * bmo#1905691 - ChaChaXor to return after the function - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh depends on it and will create a broken, empty config, if sed is missing (bsc#1227918) - Updated nss-fips-approved-crypto-non-ec.patch to enforce approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113). - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to prevent sessions from getting flagged as non-FIPS (bsc#1191546). - Mark DSA keygen unapproved (bsc#1191546, bsc#1201298). - Enable nss-fips-drbg-libjitter.patch now that we have a patched libjitter to build with (bsc#1202870). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update nss-fips-approved-crypto-non-ec.patch to allow the use of longer symmetric keys via the service level indicator (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to hopefully export sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to allow the use of DSA keys (verification only) (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to add sftk_FIPSRepeatIntegrityCheck() to softoken's .def file (bsc#1198980). - Add nss-allow-slow-tests.patch, which allows a timed test to run longer than 1s. This avoids turning slow builds into broken builds. - update to NSS 3.79.2 (bsc#1204729) * bmo#1785846 - Bump minimum NSPR version to 4.34.1. * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity. - Require libjitter only for SLE15-SP4 and greater - Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA keygen mechs (bsc#1191546). - Update nss-fips-constructor-self-tests.patch to ensure abort() is called when the repeat integrity check fails (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to disapprove the creation of DSA keys, i.e. mark them as not-fips (bsc#1201298) - update to NSS 3.79.3 (bsc#1207038) * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates (CVE-2022-23491) - Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479 (bsc#1204272) - update to NSS 3.79.4 (bsc#1208138) * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types. (CVE-2023-0767) - Add manpages to mozilla-nss-tools (bsc#1208242) - Add nss-fips-pct-pubkeys.patch (bsc#1207209) for pairwise consistency checks. Thanks to Martin for the DHKey parts. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546). - Update nss-fips-approved-crypto-non-ec.patch (bsc#1191546) to update session->lastOpWasFIPS before destroying the key after derivation in the CKM_TLS12_KEY_AND_MAC_DERIVE, CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256, CKM_TLS_KEY_AND_MAC_DERIVE and CKM_SSL3_KEY_AND_MAC_DERIVE cases. - Update nss-fips-pct-pubkeys.patch (bsc#1207209) to remove some excess code. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) to validate extra PBKDF2 parameters according to FIPS 140-3. - Update nss-fips-approved-crypto-non-ec.patch (bsc#1208999) with fixes to PBKDF2 parameter validation. - update to NSS 3.90 * bmo#1623338 - ride along: remove a duplicated doc page * bmo#1623338 - remove a reference to IRC * bmo#1831983 - clang-format lib/freebl/stubs.c * bmo#1831983 - Add a constant time select function * bmo#1774657 - Updating an old dbm with lots of certs with keys to sql results in a database that is slow to access. * bmo#1830973 - output early build errors by default * bmo#1804505 - Update the technical constraints for KamuSM * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates * bmo#1790763 - Enable default UBSan Checks * bmo#1786018 - Add explicit handling of zero length records * bmo#1829391 - Tidy up DTLS ACK Error Handling Path * bmo#1786018 - Refactor zero length record tests * bmo#1829112 - Fix compiler warning via correct assert * bmo#1755267 - run linux tests on nss-t/t-linux-xlarge-gcp * bmo#1806496 - In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator * bmo#1784163 - Fix reading raw negative numbers * bmo#1748237 - Repairing unreachable code in clang built with gyp * bmo#1783647 - Integrate Vale Curve25519 * bmo#1799468 - Removing unused flags for Hacl* * bmo#1748237 - Adding a better error message * bmo#1727555 - Update HACL* till 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6 * bmo#1782980 - Fall back to the softokn when writing certificate trust * bmo#1806010 - FIPS-104-3 requires we restart post programmatically * bmo#1826650 - cmd/ecperf: fix dangling pointer warning on gcc 13 * bmo#1818766 - Update ACVP dockerfile for compatibility with debian package changes * bmo#1815796 - Add a CI task for tracking ECCKiila code status, update whitespace in ECCKiila files * bmo#1819958 - Removed deprecated sprintf function and replaced with snprintf * bmo#1822076 - fix rst warnings in nss doc * bmo#1821997 - Fix incorrect pygment style * bmo#1821292 - Change GYP directive to apply across platforms * Add libsmime3 abi-check exception for NSS_CMSSignerInfo_GetDigestAlgTag - Add nss-fix-bmo1836925.patch to fix build-errors - Merge the libfreebl3-hmac and libsoftokn3-hmac packages into the respective libraries. (bsc#1185116) - update to NSS 3.89.1 * bmo#1804505 - Update the technical constraints for KamuSM. * bmo#1822921 - Add BJCA Global Root CA1 and CA2 root certificates. - update to NSS 3.89 * bmo#1820834 - revert freebl/softoken RSA_MIN_MODULUS_BITS increase * bmo#1820175 - PR_STATIC_ASSERT is cursed * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1820175 - Fix unreachable code warning in fuzz builds * bmo#1820175 - Fix various compiler warnings in NSS * bmo#1820175 - Enable various compiler warnings for clang builds * bmo#1815136 - set PORT error after sftk_HMACCmp failure * bmo#1767883 - Need to add policy control to keys lengths for signatures * bmo#1804662 - remove data length assertion in sec_PKCS7Decrypt * bmo#1804660 - Make high tag number assertion failure an error * bmo#1817513 - CKM_SHA384_KEY_DERIVATION correction maximum key length from 284 to 384 * bmo#1815167 - Tolerate certificate_authorities xtn in ClientHello * bmo#1789436 - Fix build failure on Windows * bmo#1811337 - migrate Win 2012 tasks to Azure * bmo#1810702 - fix title length in doc * bmo#1570615 - Add interop tests for HRR and PSK to GREASE suite * bmo#1570615 - Add presence/absence tests for TLS GREASE * bmo#1804688 - Correct addition of GREASE value to ALPN xtn * bmo#1789436 - CH extension permutation * bmo#1570615 - TLS GREASE (RFC8701) * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 - update to NSS 3.88.1 * bmo#1804640 - improve handling of unknown PKCS#12 safe bag types - update to NSS 3.88 * bmo#1815870 - use a different treeherder symbol for each docker image build task * bmo#1815868 - pin an older version of the ubuntu:18.04 and 20.04 docker images * bmo#1810702 - remove nested table in rst doc * bmo#1815246 - Export NSS_CMSSignerInfo_GetDigestAlgTag. * bmo#1812671 - build failure while implicitly casting SECStatus to PRUInt32 * bmo#1212915 - Add check for ClientHello SID max length * bmo#1771100 - Added EarlyData ALPN test support to BoGo shim * bmo#1790357 - ECH client - Discard resumption TLS < 1.3 Session(IDs|Tickets) if ECH configs are setup * bmo#1714245 - On HRR skip PSK incompatible with negotiated ciphersuites hash algorithm * bmo#1789410 - ECH client: Send ech_required alert on server negotiating TLS 1.2. Fixed misleading Gtest, enabled corresponding BoGo test * bmo#1771100 - Added Bogo ECH rejection test support * bmo#1771100 - Added ECH 0Rtt support to BoGo shim * bmo#1747957 - RSA OAEP Wycheproof JSON * bmo#1747957 - RSA decrypt Wycheproof JSON * bmo#1747957 - ECDSA Wycheproof JSON * bmo#1747957 - ECDH Wycheproof JSON * bmo#1747957 - PKCS#1v1.5 wycheproof json * bmo#1747957 - Use X25519 wycheproof json * bmo#1766767 - Move scripts to python3 * bmo#1809627 - Properly link FuzzingEngine for oss-fuzz. * bmo#1805907 - Extending RSA-PSS bltest test coverage (Adding SHA-256 and SHA-384) * bmo#1804091 - NSS needs to move off of DSA for integrity checks * bmo#1805815 - Add initial testing with ACVP vector sets using acvp-rust * bmo#1806369 - Don't clone libFuzzer, rely on clang instead - update to NSS 3.87 * bmo#1803226 - NULL password encoding incorrect * bmo#1804071 - Fix rng stub signature for fuzzing builds * bmo#1803595 - Updating the compiler parsing for build * bmo#1749030 - Modification of supported compilers * bmo#1774654 - tstclnt crashes when accessing gnutls server without a user cert in the database. * bmo#1751707 - Add configuration option to enable source-based coverage sanitizer * bmo#1751705 - Update ECCKiila generated files. * bmo#1730353 - Add support for the LoongArch 64-bit architecture * bmo#1798823 - add checks for zero-length RSA modulus to avoid memory errors and failed assertions later * bmo#1798823 - Additional zero-length RSA modulus checks - Remove nss-fix-bmo1774654.patch which is now upstream - update to NSS 3.86 * bmo#1803190 - conscious language removal in NSS * bmo#1794506 - Set nssckbi version number to 2.60 * bmo#1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates * bmo#1799038 - Remove Staat der Nederlanden EV Root CA from NSS * bmo#1797559 - Remove EC-ACC root cert from NSS * bmo#1794507 - Remove SwissSign Platinum CA - G2 from NSS * bmo#1794495 - Remove Network Solutions Certificate Authority * bmo#1802331 - compress docker image artifact with zstd * bmo#1799315 - Migrate nss from AWS to GCP * bmo#1800989 - Enable static builds in the CI * bmo#1765759 - Removing SAW docker from the NSS build system * bmo#1783231 - Initialising variables in the rsa blinding code * bmo#320582 - Implementation of the double-signing of the message for ECDSA * bmo#1783231 - Adding exponent blinding for RSA. - update to NSS 3.85 * bmo#1792821 - Modification of the primes.c and dhe-params.c in order to have better looking tables * bmo#1796815 - Update zlib in NSS to 1.2.13 * bmo#1796504 - Skip building modutil and shlibsign when building in Firefox * bmo#1796504 - Use __STDC_VERSION__ rather than __STDC__ as a guard * bmo#1796407 - Fix -Wunused-but-set-variable warning from clang 15 * bmo#1796308 - Fix -Wtautological-constant-out-of-range-compare and -Wtype-limits warnings * bmo#1796281 - Followup: add missing stdint.h include * bmo#1796281 - Fix -Wint-to-void-pointer-cast warnings * bmo#1796280 - Fix -Wunused-{function,variable,but-set-variable} warnings on Windows * bmo#1796079 - Fix -Wstring-conversion warnings * bmo#1796075 - Fix -Wempty-body warnings * bmo#1795242 - Fix unused-but-set-parameter warning * bmo#1795241 - Fix unreachable-code warnings * bmo#1795222 - Mark _nss_version_c unused on clang-cl * bmo#1795668 - Remove redundant variable definitions in lowhashtest * Add note about python executable to build instructions. - update to NSS 3.84 * bmo#1791699 - Bump minimum NSPR version to 4.35 * bmo#1792103 - Add a flag to disable building libnssckbi. - update to NSS 3.83 * bmo#1788875 - Remove set-but-unused variables from SEC_PKCS12DecoderValidateBags * bmo#1563221 - remove older oses that are unused part3/ BeOS * bmo#1563221 - remove older unix support in NSS part 3 Irix * bmo#1563221 - remove support for older unix in NSS part 2 DGUX * bmo#1563221 - remove support for older unix in NSS part 1 OSF * bmo#1778413 - Set nssckbi version number to 2.58 * bmp#1785297 - Add two SECOM root certificates to NSS * bmo#1787075 - Add two DigitalSign root certificates to NSS * bmo#1778412 - Remove Camerfirma Global Chambersign Root from NSS * bmo#1771100 - Added bug reference and description to disabled UnsolicitedServerNameAck bogo ECH test * bmo#1779361 - Removed skipping of ECH on equality of private and public server name * bmo#1779357 - Added comment and bug reference to ECHRandomHRRExtension bogo test * bmo#1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR * bmo#1779234 - Added check for server only sending ECH extension with retry configs in EncryptedExtensions and if not accepting ECH. Changed config setting behavior to skip configs with unsupported mandatory extensions instead of failing * bmo# 1771100 - Added ECH client support to BoGo shim. Changed CHInner creation to skip TLS 1.2 only extensions to comply with BoGo * bmo#1771100 - Added ECH server support to BoGo shim. Fixed NSS ECH server accept_confirmation bugs * bmo#1771100 - Update BoGo tests to recent BoringSSL version * bmo#1785846 - Bump minimum NSPR version to 4.34.1 - update to NSS 3.82 * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state * bmo#1735925 - QuickDER: Forbid NULL tags with non-zero length * bmo#1784724 - Initialize local variables in TlsConnectTestBase::ConnectAndCheckCipherSuite * bmo#1784191 - Cast the result of GetProcAddress * bmo#1681099 - pk11wrap: Tighten certificate lookup based on PKCS #11 URI. - update to NSS 3.81 * bmo#1762831 - Enable aarch64 hardware crypto support on OpenBSD * bmo#1775359 - make NSS_SecureMemcmp 0/1 valued * bmo#1779285 - Add no_application_protocol alert handler and test client error code is set * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity * required for Firefox 104 - raised NSPR requirement to 4.34.1 - changing some Requires from (pre) to generic as (pre) is not sufficient (boo#1202118) - update to NSS 3.80 * bmo#1774720 - Fix SEC_ERROR_ALGORITHM_MISMATCH entry in SECerrs.h. * bmo#1617956 - Add support for asynchronous client auth hooks. * bmo#1497537 - nss-policy-check: make unknown keyword check optional. * bmo#1765383 - GatherBuffer: Reduced plaintext buffer allocations by allocating it on initialization. Replaced redundant code with assert. Debug builds: Added buffer freeing/allocation for each record. * bmo#1773022 - Mark 3.79 as an ESR release. * bmo#1764206 - Bump nssckbi version number for June. * bmo#1759815 - Remove Hellenic Academic 2011 Root. * bmo#1770267 - Add E-Tugra Roots. * bmo#1768970 - Add Certainly Roots. * bmo#1764392 - Add DigitCert Roots. * bmo#1759794 - Protect SFTKSlot needLogin with slotLock. * bmo#1366464 - Compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771497 - Uninitialized value in cert_VerifyCertChainOld. * bmo#1771495 - Unchecked return code in sec_DecodeSigAlg. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1760998 - Avoid data race on primary password change. * bmo#1769063 - Replace ppc64 dcbzl intrinisic. * bmo#1771036 - Allow LDFLAGS override in makefile builds. - Add nss-fix-bmo1813401.patch to fix bsc#1214980 - update to NSS 3.90.1 * bmo#1813401 - regenerate NameConstraints test certificates. * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection. - Remove nss-fix-bmo1813401.patch which is now upstream. - update to NSS 3.90.2 * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption in TLS. (bsc#1216198) * bmo#1867408 - add a defensive check for large ssl_DefSend return values. - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.9.4+117+suse.87f2634 - Backport of earlier bugfixes: * Fix activation of LVM volume groups during coldplug (bsc#1219142) * avoid changing SCSI timeouts in "multipath -d" (bsc#1213809) * fix dev_loss_tmo even if not set in configuration (bsc#1212440) - Backport of upstream bug fixes (bsc#1220374): * avoid setting queue_if_no_path on multipath maps for which the no_path_retry timeout has expired * fixed memory and error handling for code using aio (marginal path code, directio path checker) * libmultipath: fix max_sectors_kb on adding path * fix warnings reported by udevadm verify * libmultipath: use directio checker for LIO targets (gh#opensvc/multipath-tools#54) * multipathd.service: remove "Also=multipathd.socket" (gh#opensvc/multipath-tools#65) * libmultipathd: Avoid parsing errors due to unsupported designators * libmultipath: return 'pending' state when port is in transition * multipath.rules: fix "smart" bug with failed valid path check * libmpathpersist: fix resource leak in update_map_pr() * libmultipath: keep renames from stopping other multipath actions * pass EXTRAVERSION to build - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Update to version 0.8.8+60+suse.4c5922cb: * multipathd: add suppport for FC Fabric Performance Impact Notifications (FPIN) (bsc#1195506) - Update to version 0.8.8+64+suse.f265f7e0: * libmultipath: fix printing native nvme multipath topology (bsc#1196011) * libmultipath: add %L path wildcard for 64-bit hex LUN * libmultipath: support host adapter name lookup for s390x ccw bus - If multipath-tools is newly installed, load dm-multipath (bsc#1196898) - Update to version 0.8.9+42+suse.45974f11: * Logging improvements * Fix busy loop with delayed_reconfigure (bsc#1199342) * multipathd: use remove_map_callback for delayed reconfigure * multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) * Fix handling of path addition in read-only arrays on NVMe * Updates of built-in hardware database - Update to upstream 0.8.9 * libmultipath: only warn once about unsupported dev_loss_tmo * Otherwise code-identical to 0.8.8+64 - Update to version 0.8.9+85+suse.a9da21c: * This is a pre-release of multipath-tools 0.9.0 * multipath.conf: add "protocol" subsection in "overrides" section This allows to set "dev_loss_tmo", "fast_io_fail_tmo", and "eh_deadline" on a per-protocol basis rather than per storage * multipath.conf: drop support for deprecated options: getuid_callout, pg_timeout, config_dir, multipath_dir * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) * multipathd: avoid delays during uevent processing (bsc#1199347) * Fixes for minor issues reported by coverity * Fix for memory leak with uid_attrs * Fix possibility to redefine -D_FORTIFY_SOURCE macro. * Updates for built in hardware db - Update to version 0.8.9+87+suse.a1eb122: * add ability to autodetect support for -D_FORTIFY_SOURCE=3 - Update to version 0.8.9+90+suse.71a70fb: * support overriding -D_FORTIFY_SOURCE in OPTFLAGS * add -U_FORTIFY_SOURCE to optflags to avoid compilation errors on old distros - Update to version 0.9.0+33+suse.fdc6686 * multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. * Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout * hwable fixes and additions * multipath.conf(5): add disclaimer about vendor support * libmultipath, kpartx: fix callers of dm_get_next_target() * Change built-in defaults for NVMe: group by prio, and immediate failback * Allow compilation with -D_FORTIFY_SOURCE=3 - Update to version 0.9.0+39+suse.51a2ab1: Upstream bug fixes: * libmultipath: fix find_multipaths_timeout for unknown hardware (boo#1201483) * multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (boo#1201483) - Update to version 0.9.0+55+suse.33d8854: * Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - Update to version 0.9.0+134+suse.dbf2e2d: * Add multipathc command under GPL3.0, and split off libmpathutil (bsc#1202616) * Fix command completion in interactive mode (bsc#1201483) * multipathd: fix use-after-free in handle_path_wwid_change() (bsc#1201483) * Improve startup time for very large multipath.conf (bsc#1200523) * Avoid checker blocking event handling for huge number of devices (boo#1203085) * Cleanup sysfs accessors in libmultipath * Minor upstream bug fixes * Spelling fixes * Documentation: add ALUA info to README.md, delete README.alua - Update to version 0.9.1+48+suse.9c6c435: * Upstream version update * kpartx_id: remove bashism * Doc: add multipathc.8 manual page - Update to version 0.9.1+52+suse.be8809e: * Code-identical to 0.9.1+48+suse.9c6c435 (merge in git repo to preserve history; fix revision in _service file). - Update to version 0.9.2+57+suse.cf3c1e9: * Fix multipathd authorization bypass and symlink attack (bsc#1202739 CVE-2022-41973 CVE-2022-41974) * add multipath-dracut.conf: dracut config file to install tmpfiles.d/multipath.conf in initramfs * Use "queue_mode bio" for NVMeoF/TCP devices * Upstream bug fixes and hwtable updates - Drop recompress.service, it just slows down build - Update to version 0.9.2+59+suse.ac8942d: * Fix segfault in "multipath -t" command (boo#1204731) - Fix "rpm --verify" (bsc#1207232) - Update to version 0.9.4+68+suse.98559ea: * libmultipath: bump ABI version to 18.0.0 * libmultipath: pathinfo: don't fail for devices lacking INQUIRY properties (gh#opensvc/multipath-tools#56) * libmpathpersist: use conf->timeout for updating persistent reservations (gh#opensvc/multipath-tools#45) * libmultipath: is_path_valid(): check if device is in use (bsc#1203141) (added libmount dependency) * libmultipath: orphan paths if coalesce_paths frees newmp (bsc#1207546) * multipathd: handle no active paths in update_map_pr (bsc#1207546) * multipathd: make pr registration consistent (bsc#1207546) * libmultipath: don't leak memory on invalid strings (bsc#1207546) * multipath.conf(5): improve documentation of dev_loss_tmo (bsc#1207546) * libmpathpersist: fix command keyword ordering (bsc#1207546, bsc#1209345) * libmultipath: fix 'show paths format' failure * minor bugfixes * hwtable fixes * Build system rework * spec file: adapt make command line to changes in build system * spec file: use make -Orecurse (better readable output) * spec file: use verbose build - Update to version 0.9.4+71+suse.c648a77: * libmultipath: avoid grouping paths wrongly with "find_multipaths smart" (bsc#1209623) * fix multipath-tools build with liburcu 0.14.0 - Update to version 0.9.4+73+suse.a5414a6: * libmultipath: ignore nvme devices if nvme native multipath is enabled (bsc#1212854) * libmultipath: fix dev_loss_tmo even if not set in configuration (bsc#1212440) Note: this changes user-visible behavior. multipathd will not grab any nvme devices for dm-multipath if nvme native multipathing is on (which is the default on SLE and openSUSE). - Update to version 0.9.4+77+suse.1f7a63b: * fix ANA prioritizer enablement logic (bsc#1218326) - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - Update to version 1.10.3: * v1.10.3 * fix netavark update to not start a new aardvark-dns - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * Update release notes for 1.11.0 * update netlink-packet-route to 0.20.0 * run cargo update * fix: remove extra / in make install and uninstall * chore(deps): update dependency containers/automation_images to v20240529 * fix(deps): update rust crate nix to 0.29.0 * fix(deps): update rust crate nispor to 1.2.19 * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate anyhow to 1.0.85 * [skip-ci] Packit: do not create dup jobs on podman-next * fix(deps): update rust crate anyhow to 1.0.84 * [skip-ci] RPM: use default __cargo macro across all envs * [skip-ci] RPM: switch default firewall to nftables on EL10+ * chore(deps): update dependency containers/automation_images to v20240513 * Add conditional compilation of default firewall driver * fix(deps): update rust crate serde_json to 1.0.117 * fix new clippy warnings * Update CI image to fedora 40 * fix ncat sctp tests * fix(deps): update rust crate anyhow to 1.0.83 * build(deps): bump h2 from 0.3.25 to 0.3.26 * [skip-ci] Packit: distinct `-rhel` packages value * [skip-ci] Packit: enable c10s downstream sync * fix(deps): update rust crate libc to 0.2.154 * fix(deps): update rust crate ipnet to 2.9.0 * fix(deps): update rust crate tower to 0.4.13 * fix(deps): update rust crate tokio-stream to 0.1.15 * fix(deps): update rust crate prost to 0.12.4 * fix(deps): update rust crate iptables to 0.5.1 * [skip-ci] Packit: remove el8 jobs * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate serde to 1.0.199 * Add suffix to Aardvark internal network filenames * fix port forward with strict RPF and multi networks * renovate: stop rebasing PRs automatically * chore(deps): update rust crate chrono to 0.4.38 * fix(deps): update rust crate serde_json to 1.0.116 * fix(deps): update rust crate netlink-sys to 0.8.6 * nftables: only dump netavark table rules * update nftables to 0.4 * fix aardvark-dns netns check * fix(deps): update rust crate tokio to 1.37 * fix(deps): update rust crate netlink-packet-route to 0.19.0 * Update to nix-0.28.0 * fix(deps): update rust crate mozim to 0.2.3 * fix(deps): update rust crate nispor to 1.2.18 * Update chrono * fix(deps): update rust crate serde_json to 1.0.115 * build(deps): bump mio from 0.8.9 to 0.8.11 * [skip-ci] rpm: aardvark-dns is a hard dep across the board * Update Rust crate env_logger to 0.11.3 * Update Rust crate serde to 1.0.197 * Update Rust crate tempfile to 3.10.1 * Update Rust crate log to 0.4.21 * Update Rust crate zbus to 3.15.2 * Update Rust crate serde_json to 1.0.114 * Update Rust crate env_logger to 0.11.2 * Update Rust crate chrono to 0.4.34 * Update Rust crate tonic-build to 0.11 * Update Rust crate tonic to 0.11 * fix netavark update to not start a new aardvark-dns * Update Rust crate tempfile to 3.10.0 * Update Rust crate zbus to 3.15.0 * Update Rust crate tokio to 1.36 * Update Rust crate chrono to 0.4.33 * Do not perform network namespace detection on AV update * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Update Rust crate serde_json to 1.0.113 * Update Rust crate serde_json to 1.0.112 * Update Rust crate env_logger to 0.11.1 * update README with nftables support * Bump to v1.11.0-dev * perf-netavark: accept fw driver as argument * perf-netavark: fix missing --config arg - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - Update to version 1.10.3: * v1.10.3 * fix netavark update to not start a new aardvark-dns - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * Update release notes for 1.11.0 * update netlink-packet-route to 0.20.0 * run cargo update * fix: remove extra / in make install and uninstall * chore(deps): update dependency containers/automation_images to v20240529 * fix(deps): update rust crate nix to 0.29.0 * fix(deps): update rust crate nispor to 1.2.19 * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate anyhow to 1.0.85 * [skip-ci] Packit: do not create dup jobs on podman-next * fix(deps): update rust crate anyhow to 1.0.84 * [skip-ci] RPM: use default __cargo macro across all envs * [skip-ci] RPM: switch default firewall to nftables on EL10+ * chore(deps): update dependency containers/automation_images to v20240513 * Add conditional compilation of default firewall driver * fix(deps): update rust crate serde_json to 1.0.117 * fix new clippy warnings * Update CI image to fedora 40 * fix ncat sctp tests * fix(deps): update rust crate anyhow to 1.0.83 * build(deps): bump h2 from 0.3.25 to 0.3.26 * [skip-ci] Packit: distinct `-rhel` packages value * [skip-ci] Packit: enable c10s downstream sync * fix(deps): update rust crate libc to 0.2.154 * fix(deps): update rust crate ipnet to 2.9.0 * fix(deps): update rust crate tower to 0.4.13 * fix(deps): update rust crate tokio-stream to 0.1.15 * fix(deps): update rust crate prost to 0.12.4 * fix(deps): update rust crate iptables to 0.5.1 * [skip-ci] Packit: remove el8 jobs * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate serde to 1.0.199 * Add suffix to Aardvark internal network filenames * fix port forward with strict RPF and multi networks * renovate: stop rebasing PRs automatically * chore(deps): update rust crate chrono to 0.4.38 * fix(deps): update rust crate serde_json to 1.0.116 * fix(deps): update rust crate netlink-sys to 0.8.6 * nftables: only dump netavark table rules * update nftables to 0.4 * fix aardvark-dns netns check * fix(deps): update rust crate tokio to 1.37 * fix(deps): update rust crate netlink-packet-route to 0.19.0 * Update to nix-0.28.0 * fix(deps): update rust crate mozim to 0.2.3 * fix(deps): update rust crate nispor to 1.2.18 * Update chrono * fix(deps): update rust crate serde_json to 1.0.115 * build(deps): bump mio from 0.8.9 to 0.8.11 * [skip-ci] rpm: aardvark-dns is a hard dep across the board * Update Rust crate env_logger to 0.11.3 * Update Rust crate serde to 1.0.197 * Update Rust crate tempfile to 3.10.1 * Update Rust crate log to 0.4.21 * Update Rust crate zbus to 3.15.2 * Update Rust crate serde_json to 1.0.114 * Update Rust crate env_logger to 0.11.2 * Update Rust crate chrono to 0.4.34 * Update Rust crate tonic-build to 0.11 * Update Rust crate tonic to 0.11 * fix netavark update to not start a new aardvark-dns * Update Rust crate tempfile to 3.10.0 * Update Rust crate zbus to 3.15.0 * Update Rust crate tokio to 1.36 * Update Rust crate chrono to 0.4.33 * Do not perform network namespace detection on AV update * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Update Rust crate serde_json to 1.0.113 * Update Rust crate serde_json to 1.0.112 * Update Rust crate env_logger to 0.11.1 * update README with nftables support * Bump to v1.11.0-dev * perf-netavark: accept fw driver as argument * perf-netavark: fix missing --config arg - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - Update to version 1.10.3: * v1.10.3 * fix netavark update to not start a new aardvark-dns - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * Update release notes for 1.11.0 * update netlink-packet-route to 0.20.0 * run cargo update * fix: remove extra / in make install and uninstall * chore(deps): update dependency containers/automation_images to v20240529 * fix(deps): update rust crate nix to 0.29.0 * fix(deps): update rust crate nispor to 1.2.19 * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate anyhow to 1.0.85 * [skip-ci] Packit: do not create dup jobs on podman-next * fix(deps): update rust crate anyhow to 1.0.84 * [skip-ci] RPM: use default __cargo macro across all envs * [skip-ci] RPM: switch default firewall to nftables on EL10+ * chore(deps): update dependency containers/automation_images to v20240513 * Add conditional compilation of default firewall driver * fix(deps): update rust crate serde_json to 1.0.117 * fix new clippy warnings * Update CI image to fedora 40 * fix ncat sctp tests * fix(deps): update rust crate anyhow to 1.0.83 * build(deps): bump h2 from 0.3.25 to 0.3.26 * [skip-ci] Packit: distinct `-rhel` packages value * [skip-ci] Packit: enable c10s downstream sync * fix(deps): update rust crate libc to 0.2.154 * fix(deps): update rust crate ipnet to 2.9.0 * fix(deps): update rust crate tower to 0.4.13 * fix(deps): update rust crate tokio-stream to 0.1.15 * fix(deps): update rust crate prost to 0.12.4 * fix(deps): update rust crate iptables to 0.5.1 * [skip-ci] Packit: remove el8 jobs * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate serde to 1.0.199 * Add suffix to Aardvark internal network filenames * fix port forward with strict RPF and multi networks * renovate: stop rebasing PRs automatically * chore(deps): update rust crate chrono to 0.4.38 * fix(deps): update rust crate serde_json to 1.0.116 * fix(deps): update rust crate netlink-sys to 0.8.6 * nftables: only dump netavark table rules * update nftables to 0.4 * fix aardvark-dns netns check * fix(deps): update rust crate tokio to 1.37 * fix(deps): update rust crate netlink-packet-route to 0.19.0 * Update to nix-0.28.0 * fix(deps): update rust crate mozim to 0.2.3 * fix(deps): update rust crate nispor to 1.2.18 * Update chrono * fix(deps): update rust crate serde_json to 1.0.115 * build(deps): bump mio from 0.8.9 to 0.8.11 * [skip-ci] rpm: aardvark-dns is a hard dep across the board * Update Rust crate env_logger to 0.11.3 * Update Rust crate serde to 1.0.197 * Update Rust crate tempfile to 3.10.1 * Update Rust crate log to 0.4.21 * Update Rust crate zbus to 3.15.2 * Update Rust crate serde_json to 1.0.114 * Update Rust crate env_logger to 0.11.2 * Update Rust crate chrono to 0.4.34 * Update Rust crate tonic-build to 0.11 * Update Rust crate tonic to 0.11 * fix netavark update to not start a new aardvark-dns * Update Rust crate tempfile to 3.10.0 * Update Rust crate zbus to 3.15.0 * Update Rust crate tokio to 1.36 * Update Rust crate chrono to 0.4.33 * Do not perform network namespace detection on AV update * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Update Rust crate serde_json to 1.0.113 * Update Rust crate serde_json to 1.0.112 * Update Rust crate env_logger to 0.11.1 * update README with nftables support * Bump to v1.11.0-dev * perf-netavark: accept fw driver as argument * perf-netavark: fix missing --config arg - First version of netavark - Bump required rust version & fix libexecdir - Update to version 1.6.0: * v1.6.0 release * Update release notes for v1.6.0 * dhcp-proxy: fix typo for --activity-timeout * chore(deps): update dependency containers/automation_images to v20230405 * dhcp-proxy: use better error when connection fails * add documentation for netavark plugins * add stderr example plugin to test stderr passthrough * add netavark plugin driver * add example error plugin * add host-device example plugin * plugin: add simple plugin interface * netlink: add dump_addresses * netlink: add set_link_ns * dhcp-proxy: correctly exit > 0 on errors * fix(deps): update rust crate tonic to 0.9 * fix(deps): update rust crate mozim to 0.2.2 * fix(deps): update rust crate serde to 1.0.159 * fix(deps): update rust crate netlink-sys to 0.8.5 * dhcp-proxy: create socket directory only when used * dhcp-proxy: do not remove socket when running under systemd * Makefile: netavark-dhcp-proxy.service use correct path * fix(deps): update rust crate http to 0.2.9 * chore(deps): update rust crate once_cell to 1.17.1 * fix(deps): update rust-futures monorepo to 0.3.28 * fix(deps): update rust crate serde_json to 1.0.95 * chore(deps): update dependency containers/automation_images to v20230330 * Disable Dependabot in favor of Renovate * chore(deps): update rust crate chrono to 0.4.24 * build(deps): bump ipnet from 2.7.1 to 2.7.2 * build(deps): bump serde from 1.0.158 to 1.0.159 * build(deps): bump serde_json from 1.0.94 to 1.0.95 * update,main: dont write empty space when no network_dns_servers is given * fix(deps): update rust crate tokio to 1.27 * Quit Leasing when Client disconnects * build(deps): bump mozim from 0.2.1 to 0.2.2 * iptables: fix incorrect debug statement * build(deps): bump serde from 1.0.156 to 1.0.158 * iptables: port fw handle wildcard address correctly * chore(deps): update dependency containers/automation_images to v20230320 * build(deps): bump zbus from 3.11.0 to 3.11.1 * build(deps): bump anyhow from 1.0.69 to 1.0.70 * [CI:BUILD] Packit: trigger builds on commit to main branch * Cirrus: Invalidate v2 bin cache * Include Systemd Files in RPM Package * Cirrus: Fix success failing on artifact extraction * fix lint issue with new rust version 1.68 * Cirrus: Update to newer CI VM images * build(deps): bump serde from 1.0.152 to 1.0.156 * combine dhcp-proxy and netavark into one binary * update: should allow empty network_dns_servers * build(deps): bump libc from 0.2.139 to 0.2.140 * fix aarch64 ncat flake * update to mozim 0.2.1 * build(deps): bump zbus from 3.10.0 to 3.11.0 * packit: Update build release tag correctly * test: move proto option into run_nc_test() * test: add netns pid param to port checks * test: import podman code to check for ports * cirrus.yaml: add new binaries in art_prep_script * fix netavark-dhcp-proxy binary in system unit * import netavark-proxy-dhcp tests * add build_proxy_client target * add netavark-dhcp-proxy to rpm * Fix dhcp-proxy build * Merge nv-dhcp-proxy into nv * fix default route metric test name * build(deps): bump tokio from 1.25.0 to 1.26.0 * Support none parameter on NETAVARK_FW * build(deps): bump anyhow from 1.0.68 to 1.0.69 * Fix typos * update netlink-packet-{route,core} to 0.15 and 0.5 * build(deps): bump serde_json from 1.0.92 to 1.0.93 * build(deps): bump zbus from 3.8.0 to 3.10.0 * [CI:BUILD] Packit: initial enablement * Allow custom cargo binary path * build(deps): bump serde_json from 1.0.91 to 1.0.92 * Cirrus: Reduce requested CPUs for compile-tasks * bump to version 1.0.6-dev * build(deps): bump netlink-sys from 0.8.3 to 0.8.4 * Add renovate.json5 - Add aardvark-dns as Requires for netavark - Update to version 1.7.0: * release v1.7.0 * Update release notes for v1.7.0 * fix(deps): update rust crate tokio to 1.29 * netavark: make --config required for dns * fix(deps): update rust crate serde_json to 1.0.99 * fix(deps): update rust crate clap to 4.3.8 * [CI:BUILD] Packit: add Fedora downstream tasks * run cargo update * fix(deps): update rust crate serde_json to 1.0.97 * fix(deps): update rust crate sha2 to 0.10.7 * fix(deps): update rust crate clap to 4.3.4 * chore(deps): update dependency containers/automation_images to v20230614 * fix(deps): update rust crate clap to 4.3.3 * fix(deps): update rust crate log to 0.4.19 * aardvark: fix missleading dns disabled log * firewall: add NETAVARK_ISOLATION_3 chain for strict isolation * docs: fix link to getting started * fix(deps): update rust crate serde to 1.0.164 * netlink: fix incorrect info log for del_route * dhcp-proxy: apply new ip address/gateway * test-dhcp: fix broekn has_ip() check * dhcp-proxy: actually implement renewing leases * dhcp-proxy: simplify code * dhcp-proxy: drop macaddr dependency * dhcp-proxy: remove some unused traits * fix(deps): update rust crate zbus to 3.13.1 * fix(deps): update rust crate clap to 4.3.2 * chore(deps): update rust crate once_cell to 1.18.0 * fix(deps): update rust crate url to 2.4.0 * fix(deps): update rust crate clap to 4.3.1 * chore(deps): update dependency containers/automation_images to v20230601 * chore(deps): update rust crate chrono to 0.4.26 * chore(deps): update rust crate chrono to 0.4.25 * fix(deps): update rust crate log to 0.4.18 * chore(deps): update rust crate once_cell to 1.17.2 * macvlan: add bclim option * parse_option(): return option instead of default * add no_default_gateway option * fix(deps): update rust crate clap to 4.3.0 * chore(deps): update dependency containers/automation_images to v20230517 * fix(deps): update rust crate serde to 1.0.163 * Add ability to add static route * fix(deps): update rust crate serde to 1.0.162 * Cirrus: Update fedora name to match image * fix(deps): update rust crate clap to 4.2.7 * chore(deps): update dependency containers/automation_images to v20230426 * correct typo in Makefile * simplify path printing * fix(deps): update rust crate tokio to 1.28 * aardvark-dns pid: return better errors * fix comment in Subnet definition * aardvark: no error when aardvark config is not there * fix(deps): update rust crate zbus to 3.12.0 * fix(deps): update rust crate clap to 4.2.4 * fix(deps): update rust crate clap to 4.2.2 * fix(deps): update rust crate serde_json to 1.0.96 * update clap to v4 * fix(deps): update rust crate serde to 1.0.160 * bump to v1.7.0-dev - Disable restricting builds only for tier1 platforms i.e. only for x86_64 and aarch64 and enable for all. - Update to version 1.8.0: * Release v1.8.0 * update release notes for v1.8.0 * run cargo update * Add vrf support for bridges * Packit: switch to @containers/packit-build team for copr failure notification comments * fix(deps): update rust crate nispor to 1.2.14 * [CI:BUILD] Packit: tag @lsm5 on copr build failures * chore(deps): update rust crate chrono to 0.4.31 * fix(deps): update rust crate serde_json to 1.0.107 * rust io safety: convert RawFd to BorrowedFd<> * bump nix to 0.27.1 * chore(deps): update rust crate chrono to 0.4.30 * fix(deps): update rust crate serde_json to 1.0.106 * chore(deps): update rust crate chrono to 0.4.29 * fix(deps): update rust crate netlink-packet-route to 0.17.1 * Bump tonic and prost * Update container image to F38 * Add ACCEPT rules in firewall for bridge network with internal dns. * chore(deps): update rust crate tonic-build to 0.10 * fix(deps): update rust crate nispor to 1.2.13 * fix(deps): update rust crate serde to 1.0.188 * Fix clippy warnings about formatting * update chrono crate * fix(deps): update rust crate url to 2.4.1 * Add protoc dependency to README * [CI:BUILD] rpm: spdx compatible license field * fix(deps): update rust crate tokio to 1.32 * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update rust crate serde_json to 1.0.105 * fix(deps): update rust crate tokio to 1.31 * fix(deps): update rust crate log to 0.4.20 * run cargo update * update tonic-build to 0.9.2 * bump rust edition to 2021 * iptables: drop invalid packages * fix(deps): update rust crate tokio to 1.30 * docs: Convert markdown with go-md2man instead of mandown * fix(deps): update rust crate clap to 4.3.21 * packit: Build PRs into default packit COPRs * chore(deps): update dependency containers/automation_images to v20230807 * fix(deps): update rust crate serde to 1.0.183 * fix(deps): update rust crate serde to 1.0.181 * fix(deps): update rust crate serde to 1.0.180 * fix(deps): update rust crate serde_json to 1.0.104 * fix(deps): update rust crate serde to 1.0.179 * fix(deps): update rust crate serde to 1.0.176 * fix(deps): update rust crate clap to 4.3.19 * fix(deps): update rust crate serde to 1.0.175 * fix(deps): update rust crate clap to 4.3.17 * fix(deps): update rust crate clap to 4.3.15 * fix(deps): update rust crate clap to 4.3.12 * fix(deps): update rust crate serde_json to 1.0.103 * [CI:BUILD] Packit: remove pre-sync action * fix(deps): update rust crate serde_json to 1.0.102 * fix(deps): update rust crate nispor to 1.2.12 * macvlan: use netlink type for bclim * bump netlink deps * fix(deps): update rust crate serde to 1.0.171 * fix(deps): update rust crate serde to 1.0.167 * fix(deps): update rust crate clap to 4.3.11 * fix(deps): update rust crate serde to 1.0.166 * fix(deps): update rust crate serde_json to 1.0.100 * iptables: improve error when ip6?tables commands are missing * fix(deps): update rust crate clap to 4.3.10 * fix(deps): update rust crate zbus to 3.14.1 * [CI:BUILD] RPM: Fix ELN build and cleanup spec * bump to v1.8.0-dev - Update to version 1.9.0: * v1.9.0 Release * v1.9.0 Release notes * test: fix syntax problem in helpers.bash * run cargo update * use OsString/Path over String for file paths * chore(deps): update dependency containers/automation_images to v20231116 * firewalld-reload: fix CI tests * firewalld-reload: prevent race which could leak fw rules * fix(deps): update rust crate clap to ~4.4.8 * CI: skip broken firewalld test * fix(deps): update rust crate http to 0.2.11 * rpm: add netavark-firewalld-reload.service to spec * firewalld-reload: add integration tests * firewall/state: make sure to ignore enoent on read * firewall-reload: integrate actual logic to reload rules * firewall/state: improve error messages * firewall: add state functions to serialize configs * firewalld: fix lint errors with rust v1.73 * firewall: do not use full Network in NetworkStruct * firewall: add dns_port to SetupNetwork * add firewalld-reload subcommand * fix(deps): update rust crate http to 0.2.10 * fix(deps): update rust crate env_logger to 0.10.1 * fix(deps): update rust crate tokio to 1.34 * Update rust container build files * bridge: force static mac on bridge interface * fix(deps): update rust crate futures-core to 0.3.29 * fix(deps): update rust crate serde to 1.0.190 * fix(deps): update rust crate serde_json to 1.0.108 * fix(deps): update rust crate sysctl to 0.5.5 * fix(deps): update rust-futures monorepo to 0.3.29 * CI: Drop CI VM distro name * chore(deps): update dependency containers/automation_images to v20231004 * fix(deps): update rust crate tokio to 1.33 * build-sys: Filter to tier 2 Linux declaratively * fix(deps): update rust crate sha2 to 0.10.8 * fix podman.io community link * Bump to v1.9.0-dev - Update to version 1.10.2: * Release v1.10.2 * Release notes for v1.10.2 * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Do not perform network namespace detection on AV update * Release v1.10.1 * Updated release notes for v1.10.1 * update to nftables release 0.3 from crates.io * DISTRO_PACKAGE: fix incorrect vendored tar archive URL * Bump to 1.11.0-dev * Release 1.10.0 * Release notes for 1.10.0 * RPM: update .cargo/config before building * Add support for isolation to the nftables driver * build(deps): bump h2 from 0.3.22 to 0.3.24 * chore(deps): update rust crate chrono to 0.4.32 * fix(deps): update rust crate env_logger to 0.11.0 * chore(deps): update dependency containers/automation_images to v20240102 * Bump nftables-rs to latest commit * Netavark: nftables support * fix(deps): update rust crate serde_json to 1.0.111 * feat: added the --firewall-driver option * Document how to generate a code coverage report for netavark * fix(deps): update rust crate clap to ~4.4.12 * fix(deps): update rust crate serde_json to 1.0.110 * fix(deps): update rust-futures monorepo to 0.3.30 * fix(deps): update rust crate nispor to 1.2.16 * chore(deps): update rust crate tempfile to 3.9.0 * Use tonic::transport::Uri instead of HTTP * chore(deps): update dependency containers/automation_images to v20231208 * fix(deps): update rust crate tokio to 1.35 * dhcp-proxy: return actual error instead of generic one * dhcp-proxy: skip set gateway if missing * bump netlink-packet-route to 0.18.1 * chore(deps): update rust crate once_cell to 1.19.0 * fix(deps): update rust crate nispor to 1.2.15 * fix(deps): update rust crate serde to 1.0.193 * fix(deps): update rust crate clap to ~4.4.10 * aardvark: show error if process is in wrong netns * aardvark: remove unessesary unlock lockfile calls * fix(deps): update rust crate url to 2.5.0 * Bump working version to v1.10.0-dev - Rely only on <major>.<minor> for aardvark-dns requires, even though it is released in sync with netavark, relying on patch version is brittle. - Update to version 1.10.3: * v1.10.3 * fix netavark update to not start a new aardvark-dns - Remove redundant source: cargo_config - Update to version 1.11.0: * Release v1.11.0 * Update release notes for 1.11.0 * update netlink-packet-route to 0.20.0 * run cargo update * fix: remove extra / in make install and uninstall * chore(deps): update dependency containers/automation_images to v20240529 * fix(deps): update rust crate nix to 0.29.0 * fix(deps): update rust crate nispor to 1.2.19 * fix(deps): update rust crate anyhow to 1.0.86 * fix(deps): update rust crate anyhow to 1.0.85 * [skip-ci] Packit: do not create dup jobs on podman-next * fix(deps): update rust crate anyhow to 1.0.84 * [skip-ci] RPM: use default __cargo macro across all envs * [skip-ci] RPM: switch default firewall to nftables on EL10+ * chore(deps): update dependency containers/automation_images to v20240513 * Add conditional compilation of default firewall driver * fix(deps): update rust crate serde_json to 1.0.117 * fix new clippy warnings * Update CI image to fedora 40 * fix ncat sctp tests * fix(deps): update rust crate anyhow to 1.0.83 * build(deps): bump h2 from 0.3.25 to 0.3.26 * [skip-ci] Packit: distinct `-rhel` packages value * [skip-ci] Packit: enable c10s downstream sync * fix(deps): update rust crate libc to 0.2.154 * fix(deps): update rust crate ipnet to 2.9.0 * fix(deps): update rust crate tower to 0.4.13 * fix(deps): update rust crate tokio-stream to 0.1.15 * fix(deps): update rust crate prost to 0.12.4 * fix(deps): update rust crate iptables to 0.5.1 * [skip-ci] Packit: remove el8 jobs * fix(deps): update rust crate anyhow to 1.0.82 * fix(deps): update rust crate serde to 1.0.199 * Add suffix to Aardvark internal network filenames * fix port forward with strict RPF and multi networks * renovate: stop rebasing PRs automatically * chore(deps): update rust crate chrono to 0.4.38 * fix(deps): update rust crate serde_json to 1.0.116 * fix(deps): update rust crate netlink-sys to 0.8.6 * nftables: only dump netavark table rules * update nftables to 0.4 * fix aardvark-dns netns check * fix(deps): update rust crate tokio to 1.37 * fix(deps): update rust crate netlink-packet-route to 0.19.0 * Update to nix-0.28.0 * fix(deps): update rust crate mozim to 0.2.3 * fix(deps): update rust crate nispor to 1.2.18 * Update chrono * fix(deps): update rust crate serde_json to 1.0.115 * build(deps): bump mio from 0.8.9 to 0.8.11 * [skip-ci] rpm: aardvark-dns is a hard dep across the board * Update Rust crate env_logger to 0.11.3 * Update Rust crate serde to 1.0.197 * Update Rust crate tempfile to 3.10.1 * Update Rust crate log to 0.4.21 * Update Rust crate zbus to 3.15.2 * Update Rust crate serde_json to 1.0.114 * Update Rust crate env_logger to 0.11.2 * Update Rust crate chrono to 0.4.34 * Update Rust crate tonic-build to 0.11 * Update Rust crate tonic to 0.11 * fix netavark update to not start a new aardvark-dns * Update Rust crate tempfile to 3.10.0 * Update Rust crate zbus to 3.15.0 * Update Rust crate tokio to 1.36 * Update Rust crate chrono to 0.4.33 * Do not perform network namespace detection on AV update * [CI:BUILD] Packit/rpm: fix aardvark-dns handling * Update Rust crate serde_json to 1.0.113 * Update Rust crate serde_json to 1.0.112 * Update Rust crate env_logger to 0.11.1 * update README with nftables support * Bump to v1.11.0-dev * perf-netavark: accept fw driver as argument * perf-netavark: fix missing --config arg - Drop the scriptlet for the netgroup handling. It was caused by the aaa_base -> netcfg move, which I guess after 12 years is moot - Remove the socket check from the defaultdomain checker as it was always false and thus not needed - Add comment explaining the reason for the code - Redo the HOSTNAME -> hostname migration to support smallest possible step. Thus ensuring the migration is done just once and finished: [#] HOSTNAME migration supported scenarios [bnc#858908]: [#] /etc/HOSTNAME -> /etc/hostname content preservation. [#] If hostname and HOSTNAME both exist HOSTNAME wins. [#] Nothing apart from content of the document is preserved - Solves bnc#858908 and bnc#899506 while moves bnc#887039 to unsupported scenarios. - Spec-cleanify the previous commit. - Keep the condition posix as it is shorter :) - Try different approach to fix failing migration from 13.1. This one is from locilka - Keep /etc/hostname empty and %ghost it. bnc#934056 - Do not ghost the empty /etc/hostname to not break installationimages pkg. - Do not actually replace the hostname if user already has something in there. Thanks to Takashi Iwai for spotting this - Repack services.bz2 with latest from upstream and adjust the script to not add all the names+emails at the bottom bnc#959693 - Update script to generage services to use UTF8 by default bsc#1028305 - Update the services list with latest content - Use %license (boo#1082318) - Include /etc/ethertypes to resolve a conflict between security:netfilter/ebtables and security:netfilter/iptables-nft. This ethertypes version comes from iptables, because it contains an additional entry over the ebtables one. Increased minor version to allow a suitable Requires statement in ebtables/iptables. FATE#320520 - add submissions port number [bsc#1189683] - modified patches % services-suse.diff - Add krb-prop entry, fix for bsc#1211886. - added helper scripts and doc for creating services file to Sources - HOSTNAME renamed to hostname [bnc#858908] - move /etc/HOSTNAME to /etc/hostname during update - resolve some update scenarios [bnc#883999], [bnc#886443] (private) with regard to /etc/HOSTNAME -> /etc/hostname change - fix %pre scriptlet [bnc#899506] (thanks to mls for the fix) - Drop the scriptlet for the netgroup handling. It was caused by the aaa_base -> netcfg move, which I guess after 12 years is moot - Remove the socket check from the defaultdomain checker as it was always false and thus not needed - Add comment explaining the reason for the code - Redo the HOSTNAME -> hostname migration to support smallest possible step. Thus ensuring the migration is done just once and finished: [#] HOSTNAME migration supported scenarios [bnc#858908]: [#] /etc/HOSTNAME -> /etc/hostname content preservation. [#] If hostname and HOSTNAME both exist HOSTNAME wins. [#] Nothing apart from content of the document is preserved - Solves bnc#858908 and bnc#899506 while moves bnc#887039 to unsupported scenarios. - Spec-cleanify the previous commit. - Keep the condition posix as it is shorter :) - Try different approach to fix failing migration from 13.1. This one is from locilka - Keep /etc/hostname empty and %ghost it. bnc#934056 - Do not ghost the empty /etc/hostname to not break installationimages pkg. - Do not actually replace the hostname if user already has something in there. Thanks to Takashi Iwai for spotting this - Repack services.bz2 with latest from upstream and adjust the script to not add all the names+emails at the bottom bnc#959693 - Update script to generage services to use UTF8 by default bsc#1028305 - Update the services list with latest content - Use %license (boo#1082318) - Include /etc/ethertypes to resolve a conflict between security:netfilter/ebtables and security:netfilter/iptables-nft. This ethertypes version comes from iptables, because it contains an additional entry over the ebtables one. Increased minor version to allow a suitable Requires statement in ebtables/iptables. FATE#320520 - add submissions port number [bsc#1189683] - modified patches % services-suse.diff - Add krb-prop entry, fix for bsc#1211886. - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404], [FATE#325524] - 0002-Let-systemd-know-when-rpc.statd-is-needed.patch 0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch Fixes for systemd integration (bsc#1116221) - nfs.conf: spell NFSV4LEASETIME correctly. (bsc#1098532) - Don't make /var/lib/nfs owned by statd. Only sm and sm.bak need to be accessible by statd or sm-notify after they drop privs. Providing they get created, the parent directory can be root-owned. - 0007-statd-user-from-sm Change rpc.statd and sm-notify to take uid from the sm directory. (bsc#1150733 CVE-2019-3689) - 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch Fix bug with concurrent gssd requests arriving from kernel. (bsc#1174260) - 0009-Convert-remaining-python-scripts-to-python3.patch Python is no longer installed by default and these scripts work with python3, so request that explicitly. (bsc#1173104) - Add 0010-gssd-Fix-locking-for-machine-principal-list.patch (bsc#1183194) - Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch (bsc#1181651) - 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch 0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch 0014-mountd-add-logging-for-authentication-results-for-ac.patch 0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch 0116-mountd-make-default-ttl-settable-by-option.patch Improve logging of authentication (bsc#1181540) - Add 0018-Replace-all-var-run-with-run.patch /var/run is long deprecated - switch all relevant paths to /run (bsc#1185170) - Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch A field was modified by multiple threads without locking. This can lead to use-after-free. (bsc#1183194) - Add 0020-mountd-Initialize-logging-early.patch If an error or warning message is produced before closeall() is called, mountd gets confused and doesn't work. (bsc#1194661) - Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch Ensure "sloppy" is added correctly for newer kernels. Particularly required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels. (boo#1197297) - Add 0023-cache.c-removed-a-couple-warning.patch Fix compilation with new glibc (SLE15-SP4) (bsc#1197788) - 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch Ensure sysctl setting work (bsc#1199856) - add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch Fix nfsdcltrack bug that affected non-x86 archs. (bsc#1202627) - 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch Avoid modprobe errors when sysctl is not installed. (bsc#1200710 bsc#1207022 bsc#1206781) - 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch Add "-S scope" option to rpc.nfsd to simplify fail-over cluster config. (bsc#1203746) - Rename all drop-in options.conf files as 10-options.conf This makes it easier for other packages to over-ride with a drop-in with a later sequence number. resource-agents does this. (bsc#1207843) - Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch boo#1157881 - Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch bsc#1209859 - Allow scope to be set in sysconfig: NFSD_SCOPE - Add 0030-systemd-use-correct-modprobe-d-directory SLE15-SP5 an earlier don't use /usr/lib/modprobe.d (bsc#1200710) - Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed - Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch Inconsistencies in /etc/exports shouldn't be fatal. (bsc#1212594) - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - security update - added patches fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack + nghttp2-CVE-2023-44487.patch - security update - added patches fix CVE-2024-28182 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-1.patch fix CVE-2024-28182-2 [bsc#1221399], HTTP/2 CONTINUATION frames can be utilized for DoS attacks + nghttp2-CVE-2024-28182-2.patch - Export PYTHON=/usr/bin/python3 before running configure: allow to build without (comnplete) python2 in the buildroot. In any case we only ship python3-bindings already. - Update to version 1.29.0: * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by GOAWAY * build: Remove SPDY * build: Fix CMAKE_MODULE_PATH * nghttpx: Revert "nghttpx: Use an existing h2 backend connection as much as possible" * nghttpx: Write API request body in temporary file * nghttpx: Increase api-max-request-body * nghttpx: Faster configuration loading with lots of backends * nghttpx: Fix crash with --backend-http-proxy-uri option - Use %license (boo#1082318) - Drop spdylay dependency as it is deprecated since version 1.28.0 and removed from cofnigure.ac since 1.29.0 - Version update to 1.31.0: * lib: Add nghttp2_session_set_user_data() public API function (GH-1137) * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128) * nghttpx: Close listening socket on graceful shutdown * nghttpx: Add an option to accept expired client certificate (GH-1126) * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123) * nghttpx: Fix potential memory leak * lib: Allow PING frame to be sent after GOAWAY (GH-1103) * nghttpx: Fix bug that h1 backend idle timeout expires sooner * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119) * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099) * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094) * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101) - Version umpdate to 1.31.1: * Fix bsc#1088639 CVE-2018-1000168 * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/ - Update to version 1.32.0: * lib: Ignore all input after calling session_terminate_session * lib: Fix treatment of padding * lib: Don't allow 101 HTTP status code because HTTP/2 removes HTTP Upgrade * build: add ENABLE_STATIC_LIB option to build static lib * third-party: Upgrade neverbleed to the latest master * asio: Support client side SNI * src: Compile with libressl 2.7.2 * src: Allow building without NPN * h2load: -r and --duration are mutually exclusive - Update to version 1.33.0: * lib: Tweak nghttp2_session_set_stream_user_data * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS. * lib: Implement ORIGIN frame * asio: support definition of local endpoint for cleartext client session * integration: Remove remaining SPDY code from the integration tests * nghttpx: Fix worker process crash with neverbleed write error * nghttpx: Support per-backend mruby script * nghttpx: Fix stream reset if data from client is arrived before dconn is attached - Update to version 1.34.0: (bsc#1112438, FATE#326776) * lib: Implement RFC 8441 :protocol support * nghttpx: Add read/write-timeout parameters to backend option * nghttpx: Fix mruby parameter validation in backend option * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2 * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues * nghttpx: Update mruby 1.4.1 * nghttpx: Add mruby env.tls_handshake_finished * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options * nghttpx: Add RFC 8470 Early-Data header field support * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support - Update to version 1.35.1: * nghttpx: Fix broken trailing slash handling (GH-1276) - Changes for version 1.35: * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238) * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222) * src: Require C++14 language feature * nghttpx: Write mruby send_info early * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend * h2load: Handle HTTP/1 non-final response (GH-1259) * h2load: Clarify that time for connect includes TLS handshake - Use multibuild to not pull in python3 in first build, nghttp2 is low in the system - Update to 1.36.0 * build: disable shared library if ENABLE_SHARED_LIB is off * third-party: use http-parser to v2.9.0 (GH-1294) * third-party: Update mruby to 2.0.0 * nghttpx: Pool h1 backend connection per address (GH-1292) * nghttpx: Randomize backend address round robin order per thread (GH-1291) * nghttpx: Fix getting long SNs for openssl < 1.1 (GH-1287) * h2load: add an option to write per-request logs (GH-1256) * asio: added access to # of the current server port (GH-1257) - Update to 1.38.0: * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry. * It also fixes the bug that HTTP/1.1 chunked request stalls. * Now nghttpx does not log authorization request header field value with -LINFO. * This release fixes possible backend stall when header and request body are sent in their own packets. * The backend option gets weight parameter to influence backend selection. * This release fixes compile error with BoringSSL. - Add patch from upstream to build with new boost bsc#1134616: * boost170.patch - Update to version 1.39.1: * This release fixes the bug that log-level is not set with cmd-line or configuration file. It also fixes FPE with default backend. - Changes for version 1.39.0: * libnghttp2 now ignores content-length in 200 response to CONNECT request as per RFC 7230. * mruby has been upgraded to 2.0.1. * libnghttp2-asio now supports boost-1.70. * http-parser has been replaced with llhttp. * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT. - Drop no longer needed boost170.patch - Update to version 1.39.2 (bsc#1146184, bsc#1146182): * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513 “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2 frames cause Denial of Service by consuming CPU time. Check out https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for details. For nghttpx, additionally limiting inbound traffic by - -read-rate and --read-burst options is quite effective against this kind of attack. * Add nghttp2_option_set_max_outbound_ack API function * nghttpx: Fix request stall - Require correct library from devel package - boo#1125689 - Conditionally remove dependecy on jemalloc for SLE-12 - Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and cilium-proxy (bsc#1166481) * lib: Add nghttp2_check_authority as public API * lib: Fix the bug that stream is closed with wrong error code * lib: Faster huffman encoding and decoding * build: Avoid filename collision of static and dynamic lib * build: Add new flag ENABLE_STATIC_CRT for Windows * build: cmake: Support building nghttpx with systemd * third-party: Update neverbleed to fix memory leak * nghttpx: Fix bug that mruby is incorrectly shared between backends * nghttpx: Reconnect h1 backend if it lost connection before sending headers * nghttpx: Returns 408 if backend timed out before sending headers * nghttpx: Fix request stal - security update - added patches fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS + nghttp2-CVE-2020-11080.patch - Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. [CVE-2023-35945 bsc#1215713] + nghttp2-CVE-2023-35945.patch - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - no longer use %hardcode_pci_list macro on TW, since the issue with generating wrong PCI ID modaliases for Supplements has been fixed now in pesign-obs-integration package for TW (boo#1207520) - Update to version 525.89.02 - no longer use %hardcode_pci_list macro on sle15/Leap15, since the issue with generating wrong PCI ID modaliases for Supplements has been fixed meanwhile also in pesign-obs-integration package for sle15/Leap15 (boo#1207520) - Update to version 525.105.17 - Update to version 525.116.03 - Update to version 525.116.04 - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - Update to version 525.116.03 - Update to version 525.116.04 - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRMEnableSupporteGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRMEnableSupporteGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - no longer use %hardcode_pci_list macro on TW, since the issue with generating wrong PCI ID modaliases for Supplements has been fixed now in pesign-obs-integration package for TW (boo#1207520) - Update to version 525.89.02 - no longer use %hardcode_pci_list macro on sle15/Leap15, since the issue with generating wrong PCI ID modaliases for Supplements has been fixed meanwhile also in pesign-obs-integration package for sle15/Leap15 (boo#1207520) - Update to version 525.105.17 - Update to version 525.116.03 - Update to version 525.116.04 - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - no longer use %hardcode_pci_list macro on TW, since the issue with generating wrong PCI ID modaliases for Supplements has been fixed now in pesign-obs-integration package for TW (boo#1207520) - Update to version 525.89.02 - no longer use %hardcode_pci_list macro on sle15/Leap15, since the issue with generating wrong PCI ID modaliases for Supplements has been fixed meanwhile also in pesign-obs-integration package for sle15/Leap15 (boo#1207520) - Update to version 525.105.17 - Update to version 525.116.03 - Update to version 525.116.04 - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - Update to version 525.116.03 - Update to version 525.116.04 - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRMEnableSupporteGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRMEnableSupporteGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to version 525.116.03 - Update to version 525.116.04 - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRMEnableSupporteGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRMEnableSupporteGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - Update to version 535.54.03 - _constraints: reserve 4GB of disk space for building in the hope that this will be also sufficient when building for sle15-sp5 - _constraints: 4GB wasn't enough; trying 8GB now ... - Update to version 535.86.05 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - require one-time renamed package kernel-firmware-nvidia-gspx-G06 from now on (boo#1212724) - Update to version 535.104.05 - kmp-post.sh/kmp-postun.sh: * add/remove nosimplefb=1 kernel option in order to fix Linux console also on sle15-sp6/Leap 15.6 kernel, which will come with simpledrm support - Update to version 535.113.01 - preamble: added conflict to nvidia-gfxG05-kmp to prevent users from accidently installing conflicting proprietary kernelspace drivers from CUDA repository - disabled build of nvidia-peermem module; it's no longer needed and never worked anyway (it was only a stub) [boo#1211892] - Add a devel package so other modules can be built against this one. [jira#PED-4964] - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Add a second flavor for building the kernel module versions used by CUDA. The kmp targetting CUDA contains '-cuda' in its name to track its versions separately from the graphics kmp. (bsc#1227417) - Provide the meta package nv-prefer-signed-open-driver to make sure the latest available SUSE-build open driver is installed - independent of the latest available open driver version in he CUDA repository. Rationale: The package cuda-runtime provides the link between CUDA and the kernel driver version through a Requires: cuda-drivers >= %version This implies that a CUDA version will run withany kernel driver version equal or higher than a base version. nvidia-compute-G06 provides the glue layer between CUDA and a specific version of he kernel driver both by providing a set of base libraries and by requiring a specific kernel version. 'cuda-drivers' (provided by nvidia-compute-utils-G06) requires an unversioned nvidia-compute-G06. With this, the resolver will install the latest available and applicable nvidia-compute-G06. nv-prefer-signed-open-driver then represents the latest available open driver version and restricts the nvidia-compute-G06 version to it. (bsc#1227419) - preamble: let the -cuda flavor KMP require the -cuda flavor firmware - To avoid issues with missing dependencies when no CUDA repo is present make the dependecy to nvidia-compute-G06 conditional. - CUDA is not available for Tumbleweed, exclude the build of the cuda flavor. - make buildservice happy; all sources need to be mentioned as such in specfile - Use macro which is set during build but not when running `osc service run download_files` to make sure both source versions are visible for download. This way, only the correct source tarball will be included in the source package of its respective flavor but both can be downloaded (updated) simultaniously. - Update to 550.100 (boo#1227575) * Fixed a bug that caused OpenGL triple buffering to behave like double buffering. - Update to version 555.42.06 for CUDA. This tag has become available in github, now. - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Update to 550.120 (boo#1230779) * Fixed a bug that could cause kernel crashes upon attempting KMS operations through DRM when nvidia_drm was loaded with modeset=0. - aarch64-TW-buildfix.patch * fixes build on aarch64 with latest TW kernel - no longer hard-require kernel firmware package, but install it automatically once nvidia-compute-utils-G06 gets installed - trigger removal of driver modules with non-existing or wrong firmware when (new) firmware gets installed - cuda-flavor: * require kernel-firmware-nvidia-gspx-G06 instead of kernel-firmware-nvidia-gspx-G06-cuda (which provides also kernel-firmware-nvidia-gspx-G06) * trigger removal of driver modules also on kernel-firmware-nvidia-gspx-G06 - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - nv-prefer-signed-open-driver: * no longer require a specific version of nvidia-open-driver-G06-signed-cuda-kmp, so it can select the correct open driver KMP matching the cuda-runtime version - cuda-flavor: * added nvidia-compute-G06 = %version to preconditions for requiring kernel-firmware-nvidia-gspx-G06, since nvidia-compute-utils-G06 does not have a version-specific requires on nvidia-compute-G06 - nv-prefer-signed-open-driver: * added specicic versions of cuda-drivers/cuda-drivers-xxx as preconditions for requiring specific version of nvidia-compute-G06 - latest change hardcoded to 555.42.06; we no longer need this for 560 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cuda-flavor * provide nvidia-open-driver-G06-kmp = %version to workaround broken cuda-drivers - nv-prefer-signed-open-driver * added comments for requirements - For CUDA update version to 560.35.03 - supersedes kernel-6.10.patch - cuda-flavor provide also nvidia-open-driver-G06-kmp-$flavor = %version to workaround broken cuda-drivers - Update to 550.127.05 (boo#1232057) * Fixed a bug which could cause applications using GBM to crash when running with nvidia-drm.modeset=0. - kmp-trigger.sh: * avoid to return with exit code != 0 if no modules are loaded - Update to 550.135 (boo#1233673) - 550.135.patch: * fixes wrong logic for checking supported architectures - Improve handling of conflicts between different flavors (gfx vs. CUDA) (bsc#1233332). - fixed my wrong patch 550.135.patch I introduced right below; it fixed x86_64 build more-or-less accidently but broke aarch64 build completely ... - preamble * resolve self conflicts of -cuda KMP during update by adding obsoletes to older versions (boo#1233332) - Add 'dummy' firmware package on SLE to work around update issues. On SLE, the firmware is installed directly from an NVIDIA-hosted repo. - For CUDA update version to 565.57.01 - preamble: no longer need to provide nvidia-open-driver-G06-kmp because since 565.57.01 to the list of requires of nvidia-compute-G06 the -signed packages has been added - only obsolete 555 CUDA driver/firmware packages - kmp-trigger.sh: * avoid to return with exit code != 0 if modules could not be unloaded for some reason - Make sure the correct FW package is installed on non-CUDA. - obsolete <=560.35.03 -cuda KMPs; mistakenly we released 560.35.03 for SP4 ... - Do not set %{?linux_make_arch} for running make modules/modules-install - supersedes 550.135.patch - for SLE Micro 6.x use '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16 doesn't set %sle_version and SLE Micro 6.x is already SLE16! - Update to 550.142 (boo#1234675) - supersedes 550.135.patch - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch * needed for Kernel 6.12 for 565.57.01 driver; already fixed for 550.142 - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260 - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - cleanup: get rid of possibiliy to hardcode pci list; it's no longer required anyway; secureboot signing has been fixed ... - removed pci-table.patch - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to version 535.129.03 - cleanup; sle12 no longer supported - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Update to 545.29.02 - added fbdev=1 option for nvidia-drm module, which gives us a proper framebuffer console now ... - nosimplefb kernel option no longer needed with usage of nvidia-drm's fbdev=1 option - nvidia's NVreg_OpenRmEnableUnsupportedGpus=1 option no longer needed; GeForce and Workstation GPUs now officially supported - support added for H100/H800 GPUs (Hopper) - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - use different modprobe.d config file to resolve conflict with older driver package (boo#1217370); overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting (disable it), since letting it enabled is supposed to break booting (boo#1215981, comment#23) - no longer try to overwrite NVreg_OpenRmEnableUnsupportedGpus driver option setting; apparently it's ignored by the driver (boo#1215981, comment#26) - Update to 545.29.06 - fix typo in changelog: * NVreg_OpenRMEnableSupporteGpus -> NVreg_OpenRmEnableUnsupportedGpus (boo#1215981, comment#33) - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver - kernel-6.7.patch * fixes build against kernel 6.7 (boo#1219117) - switched from 60-nvidia-$flavor.conf to 61-nvidia-$flavor.conf in modprobe.d to resolve conflict with older package, which can be installed in parallel - mistakenly moved dracut config file from 60-nvidia-%1.conf to 61-nvidia-%1.conf --> reverted! - splitted up 61-nvidia-$flavor.conf to 59-nvidia-$flavor.conf and 61-nvidia-$flavor.conf, because 'install' line cannot be overwritten with higher config number ... - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package - kernel-syms-azure is not available on ALP - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - remove conflicts to nvidia-open-driver-G06-kmp, since it's now provided instead (OMG!); add obsoletes to it as well to make sure it gets replaced (bsc#1220196) - re-enable build of -azure kernel flavor; syntax check was wrong - Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. - supersedes the following patches: * 0001-Don-t-override-INSTALL_MOD_DIR.patch * kernel-6.7.patch - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... - Update to 550.67 - rename pci_ids-unsupported* to pci_ids-supported* files - Update to 550.76 * addresses boo#1222972 - Update to 550.78 * addresses boo#1223454 - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090, CVE-2024-0091, CVE-2024-0092] - Use osc_scm to manage upstream input source. - Fix version string. - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Use osc_scm to manage upstream input source. - Fix version string. - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Use osc_scm to manage upstream input source. - Fix version string. - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Use osc_scm to manage upstream input source. - Fix version string. - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Fix zsh completion package depenedencies. - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Update to version 2.4+32.g2e2531a: * nvme-netapp: add nspath tlv handling (bsc#1220971) - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Update to version 2.4+32.g2e2531a: * nvme-netapp: add nspath tlv handling (bsc#1220971) - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Update to version 2.4+32.g2e2531a: * nvme-netapp: add nspath tlv handling (bsc#1220971) - Update to version 2.0~2: * Adapt to logging API changes in libnvme * Adapt to scan API changes in libnvme * Reworked error message handling * Fix 'list-ns' (bsc#1195151) * Add 'gen-tls-key' and 'check-tls-key' * Add Media Unit Status log page support * Cleanups and build fixes - Fix path to systemctl (bsc#1193699) - Update to version v2.0-rc3: * nvme-print: Fix json output for list-subsys * nvme: Allow --verbose flag to increase log level * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command * nvmf: Remove --matching from systemd service file (bsc#1195665) * nvme: Fix --force flag inversion (bsc#1195637) * nvme: Add support for data area 4 to get-telemetry-log * nvme: Add Supported Capacity Configuration List log page(LID: 0x11) * nvme: Add Enhanced Controller Meta Data(FID: 0x7D) * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string * nvme-print: remove unused nvme_show_id_ctrl function * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095 * nvme: Add NVM Command Set specific identify namespace command * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095 * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns - Include precompiled documentation - Update to version 2.0-rc4: * netapp-nvme: free the nsdescs pointer after use * netapp-nvme: fix ontapdevices segfault in json output * nvme-print: fix 'nvme list -o json' segfault * nvme: get_ns_id command fails on nvme device * wdc: updated products list for telemetry (--type) argument * docs: fix typo in Data Set Management section * Fix ctrlist for attach-ns and detach-ns * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices * wdc: Fix use-after-free access of cbs_data * Fixed regression with 'open namespace exclusive' (bsc#1195945) - Update to version 2.0-rc5: * nvme: passthru bugfix(wrong jump, wrong file descriptor) * nvme-cli: Ignore traddr case (bsc#1194025) * nvme: fix segfault in nvme telemetry-log error handling * fabrics: ensure zero kato for non-persistent controllers * documenation updates - Update to version 2.0-rc6: * nvme: print out ANA state for 'list-subsys' (bsc#1195938) * nvme: Explicit initialize all command line options (bsc#1195945) * nvme: Explicit initialize passthru command line options * nvme: list_ns bug fix (csi option enable) * nvme: nvme write bug fix (no parse for option) * documenation updates - Update to version 2.0-rc7: * netapp-nvme: fix smdevices segfault in json output (bsc#1195937) * fabrics: keep the backward compatibility * nvme: Do not slash escape strings in JSON output (bsc#1195937) * nvme: Print full device path * nvme-print: Make JSON keys consistent with nvme-cli 1.x * nvme-print: print generic device in list command * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061) * connect: Set errno to zero on nvmf_add_ctrl() success * documenation updates - Set path to systemctl via newly introduced config option - Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename - Moved bash completion script to /usr/share/bash-completion/completions/nvme - Fix install conflict caused by new bash completion script location (bsc#1197365). - Update to version 2.0-rc8: * fabrics: Add DIM command * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076) * fabrics: Free non-matching controller during discovery * fabrics: add 'nvme config' command * fabrics: Correctly stringify discovery.conf and config.json paths * nvme-print: Add human readable print for nsattr field * nvme-print: Update Persistent Event log fields * nvme-print: print discovery async event support * nvme-rpmb: Fix spelling for 'Partition' * nvme-copy: add missing field to the command * nvme: add get_mi_cmd_support_effects_log command * nvme: Fixup namespace filtering yet again * nvme: Use type bool for OPT_FLAG * nvme: use filter for 'list-subsys <devname>' (bsc#1195938) * Add lbstm option to create-ns * argconfig: Do not use default value loading by getopt_long_only * argconfig: Rename CFG_NONE to CFG_FLAG * plugins: Use type bool for OPT_FLAG * documenation updates - Drop 'ProtectKernelTunables=true' (bsc#1197076) - Update to version 2.0: * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243) * fabrics: Set KATO for discovery controller when connecting * fabrics: Do no modify default config for discovery controller * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858) * fabrics: Support connect even when no /etc/nvme/hostnqn file exists * nvme: update to nvme_scan_filter_t modifications (bsc#1195938) * plugins/intel: make 'buckets' a json array * plugins: Update WDC capabilities command with new commmands * plugins: Add OCP plugin - fabrics: Already connected uses a different error code (bsc#1199994) * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch - fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994) * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch - nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990) * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch - fabrics: Honor config file for connect-all (bsc#1199504) * add 0005-fabrics-Honor-config-file-for-connect-all.patch - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701) * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch - Fabrics related bug fixes * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Update to version 2.2.1 (jsc#ped-553): * Added parsing for Solidigm telemetry observable data. * Revert "udev: re-read the discovery log page when a discovery controller reconnected" * add item ddr_ecc_err_cnt in smart-log-add * build and install fixes/improvements * build: Add minimum build requirement on libnvme * build: Drop dependency on libuuid * build: Extend release script to support micro version releases * build: Fix endian check for cross build * build: Remove unused uuid.wrap file * build: Remove unusned uuid.h include * build: Update release version rules * build: Update version before regenerating docs * completions: Add show-topology tab completion * documentation fixes * fabrics: Avoid nvme_scan_ctrl when disconnecting * fabrics: Honor JSON config file in connect-all command * fabrics: Remove dhchap-ctrl-secret from discover/connect-all * fabrics: Trigger auto connect if config.json exists * fabrics: fix 'persistent' handling during connect-all with JSON file * fabrics: nvme config --modify depends on -n and -t argument * fabrics: re-read the discovery log page when a discovery controller reconnected * json: Support uint64 types serialization for older json-c versions * meson: we don't need a c++ compiler * new solidigm plugin * nvme, plugins: fix __u64 -> unsigned long long assumptions * nvme-print: Add missing values in id-ctrl for JSON output * nvme-print: Handle NULL hostid in JSON output * nvme-print: Output 128bit values as uint128 type instead of double * nvme-print: Print fguid as a UUID * nvme-print: Use uint128 JSON function for media_units_written * nvme-print: decode MI status values * nvme-print: decode status types * nvme-print: fix wrong json key * nvme-print: sanitize the get-feature async event config output * nvme: Add helper function to parse 16-bit comma separated list * nvme: Add nvme_cmd wrapper for get_features * nvme: Add show-topology command * nvme: Add wrapper for Format NVM * nvme: Add wrapper for Sanitize NVM * nvme: Add wrappers for Get Log page helpers * nvme: Add wrappers for Identify controller lists * nvme: Add wrappers for NS attach/detach * nvme: Add wrappers for NS management functions * nvme: Add wrappers for basic NS identify * nvme: Add wrappers for firmware commands * nvme: Do not print error message in collect_effects_log helper * nvme: Fix set feature command to get feature identifier 0Dh length as zero * nvme: Introduce a union in struct nvme_dev for different transport types * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere * nvme: Masks SSTAT in sanize-log output * nvme: Remove static nvme_dev, allocate on open instead * nvme: Set default rae value for nvme_get_nsid_log users * nvme: Simplify ns list identify * nvme: Use correct print format specifier for sizeof arguments * nvme: Use local struct nvme_dev for show_registers & map_registers * nvme: check if cfg.metadata is NULL before passing it to strlen() * nvme: use helpers for checking status types * plugins/innogrit: Include timer.h * plugins/innogrit: add smart items for smart-log-add * plugins/micron-nvme: Use correct print format specifier for sizeof arguments * plugins/ocp: Include timer.h * plugins/ocp: Output 128bit values as uint128 type instead of double * plugins/ocp: drop unused fd argument * plugins/ocp: pass struct nvme_dev to internal functions * plugins/seagate: Add support for OCP * plugins/solidigm: fix return value on format parse failure * plugins/toshiba: pass struct nvme_dev rather than fd + name * plugins/virtium: Output 128bit values as uint128 type instead of double * plugins/wdc: Add support for SN660 drive * plugins/wdc: Add type case for feature id * plugins/wdc: Output 128bit values as uint128 type instead of double * plugins/wdc: fix memset() on the address of a pointer * plugins/wdc: pass a struct nvme_dev around rather than a fd * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev * plugins/wdc: prevent duplicate close on NVMe device * plugins/wdc: remove fd argument from print functions * plugins/ytmc: pass struct nvme_dev rather than fd + name * plugins: Use PRIu64 format specifier for 64bit types * print: Add Controller Ready Timeout Exceeded HW error code * print: Fix nvme_id_uuid_list * solidgm: fix initialization warning * solidigm: Added parsing for telemetry customer screenable data * solidigm: Fix printf format for size_t variable * solidigm: Updated Telemetry parsing code to MIT license. * subprojects/libnvme: update for MI admin command coverage * tests: Update license to GPL-2.0-or-later * tree: Add NVMe-MI support * tree: Add dev_fd() helper * tree: Change nvme_dev from global to static * tree: Combine NVMe file descriptor into struct nvme_dev * tree: Move global device info to a single struct * tree: fail on non-negative return values from parse_and_open * udev: Add HOST_IFACE to udev rule * util/json.h: Add json_object_get_uint64 fallback implementation * util/json: Add 128 bit JSON helpers * util/types: Add 128 bit conversion helpers * util: Fix le128_to_cpu on big-endian * util: Fix le128_to_cpu on little-endian * util: Move common type conversion helpers into util section * utils/json: Add json_object_new_uint64 for json-c < 0.14 * utils: Fix uint128_t usage * various fixes reported by coverity * version reporting includes library version * wdc: OCP Log page updates and fixes * wrapper: Add weak nvme_init_copy_range_f1 symbol * wrapper: Call library version of nvme_init_copy_range_f1 * wrapper: Update SPDIX license * zns.c: report zones should be started after retrieved zone - Drop upsreamp patches * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch * remove 0005-fabrics-Honor-config-file-for-connect-all.patch * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch - Handle suse-missing-rclink lint warnings by providing the symlinks - Support auto discovery, add %systemd_ordering to spec file (bsc#1186399) - Mark no binaries rpms as noarch - Update to version 2.2.1+3.gd028407: * Add support for booting from NVMe-oF/TCP according to NVM Express Boot Specification v1.0 (jsc#PED-1449) * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands - Add %check section in spec file to run unit tests - spec file: fix "check" section (bsc#1207686) - add "Provides: nvmeof-boot-support = 0.1" - Update to version v2.4 (jsc#PED-553 jsc#PED-3884) - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435) * json_discovery_log: avoid buffer overrun - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001) * udev: Add HOST_IFACE to udev rule - Build documentation to be up to date - Fix build warning (git-fixes) * fabrics: 'e->traddr' is static - Improvements for supported-log-pages (bsc#1209550) * nvme-doc: update man page for supported-log-pages * nvme-print: sanitize supported-log-pages output - Fix read command (bsc#1209564) * nvme: fix block count and data size logic - Fix mounting filesystems via fstab (bsc#1208075) * fabrics: Fix ordering for auto connect services - Update host_traddr when using config.json file (bsc#1210089) * fabrics: fix fc config JSON file handling - remove 0100-harden_nvmf-connect@.service.patch - Added compat commands for nbft back - Changed default behavior of connect-all to match with old nbft behavior - Replaced old nbft implementation with upstream one - Rebuild documentation on package update - Set version-tag so that version are correctly reported - Fix connect nbft regressions (bsc#1209905) * fabrics: fix argc in show_nbft_compat_cmd() - Fix auto connect conditions (bsc#1210105) * fabrics: fix conditions in nvmf-autoconnect.service - Fix auto boot for NBFT connections (bsc#1211647) * fabrics: add udev rule to avoid renaming nbft interfaces * fabrics: autoconnect: add service unit for connecting NBFT subsystems - Update to version 2.4+24.ga1ee20: * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598) * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598) * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598) * ccan: Add htable, strset and dependencies bsc#1212598) * ccan: Remove unused documentation bsc#1212598) * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598) * nvme-print: Show subsystem iopolicy (bsc#1124564) - Update to version 2.4+25.g367eb9: * json: fix seg. fault converting NULL to JSON string (bsc#1213762) - Update to version 2.4+31.gf7ec09: * udev-rules: rename netapp udev rule (bsc#1215994) * udev-rules: set ctrl_loss_tmo to -1 for ONTAP NVMe/TCP (bsc#1215994) * udev-rule: apply round-robin iopolicy on i/o subsystems alone (bsc#1215994) * fabrics: For TCP/RDMA, compare IP addresses with nvme_ipaddrs_eq() (bsc#1213768) * fabrics: lookup_discovery_ctrl() must look under host and not root (bsc#1213768) * fabrics: only look for matching ctrl on same host (bsc#1213768) - Update to version 2.4+32.g2e2531a: * nvme-netapp: add nspath tlv handling (bsc#1220971) - Initial package of version 2.5.1 - converted neededforbuild to BuildRequires - update to version 2.5.7: many fixes. - update to version 5.9.2: + many fixes - cleanup: + split into liborig2 and oniguruma-devel subpackages + corrected license information + changed summary to conform with policy - update version 5.9.5 * [impl] escape warnings for -Wall. * [impl] remove unused variable. - changes in 5.9.4 * [dist] add oniguruma.pc.in file - changes in 5.9.3 * fix print_tree ENCLOSE_OPTION bug - update version 5.9.6 * [impl] add onigenc_end_unicode(). * [impl] add onig_add_end_call(). - remove ruby build requires. seems unused. - Version 6.5.0 - [new] support Absent clear (Absent functions) - abolish configure option: --enable-combination-explosion-check - [new] support Absent functions (?~...) - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres - [new] support \O (true anychar) - [new] support \K (keep) - add new node type: NODE_GIMMICK - [new] support \N (no newline) - [new] support \R (general newline) - [new] support if-then-else syntax - [new] support backref validity checker - Version 6.4.0 - fix memory leaks - change encoding of doc/XXXX.ja from EUC-JP to UTF-8 - update doc/RE, and doc/RE.ja - fix fatal bug of endless repeat check on Windows - PR #62 : add check for return values - [new] support call zero (\g{0}) - [new] support relative call by positive number - [new] support relative back-reference by positive number - fix #60 : check value type - change output format for ONIG_DEBUG_COMPILE and ONIG_DEBUG_MATCH - Version 6.3.0 - fix #60 : invalid state(CCS_VALUE) in parse_char_class() - fix #59 : access to invalid address by reg->dmax value - fix invalid increment of start position in onig_scan() - fix #58 : access to invalid address by reg->dmin value - fix #57 : DATA_ENSURE() check must be before data access - fix #56 : return invalid result for codepoint 0xFFFFFFFF - [new] add \o{17777777777} syntax. - fix #55 : Byte value expressed in octal must be smaller than 256 - Version 6.2.0 - fix: size in xmemcpy in stack_double (PR #51) - Initialize return value - NEW API: add onig_set_capture_num_limit() - change MemNumType from short int to int - fix: [0-9-a] was not allowed as [0-9\-a] - fix: illegal capture after recursive call - fix: problem with optimization of \z - fix: .* optimization - Set a limit of parser recursion - fix; that warnings are not shown properly - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32 - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is used. - Version 6.1.3 - fix: Syntax error: redirection unexpected (expecting word) #35 - Version 6.1.2 - allow word bound, word begin and word end in look-behind. - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option. - fix use after free node. - fix memory leaks after parsing regexp error. - implement many of is_valid_mbc_string(). - Version 6.1.1 - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer) - fix error unmatched close parenthesis for %{(.*?)} #23 - Version 6.1.0 - add contributed/libfuzzer-onig.cpp (thanks hannob) - update LTVERSION 4:0:0 - NEW API: onigenc_is_valid_mbc_string(). - add is_valid_mbc_string() member into OnigEncodingType. - fix out of bounds read. - disable USE_INVALID_CODE_SCHEME. - doc/RE improved. - add onig_scan() into doc/API. - fix bug: Out of bounds read in onig_strcpy() #17 - fix bug: infinite loop of backreference and group. - fix out of bounds read in mbc_to_code() #16 - doc/RE refinements. - add onig_scan() (NEW API) - reimplement match stack allocation for case too many repeat - and too many captures in regexp. - number of captures <= 32767 for bytecode representation. - don't use int_map_backward for thread-safe. - fix case of enclosed option in look-behind. - fix ignore case in look-behind. - fix memory leak in onig_unicode_define_user_property() - declare variables at the top of scope. (thanks nmaya) - Version 6.0.0 - add NEW API: onig_unicode_define_user_property() - update Unicode data to 8.0.0 - change OnigCodePoint type to unsigned int. - add doc/UNICODE_PROPERTIES. - add error code ONIGERR_FAIL_TO_INITIALIZE. - add make_win64/32.bat. - fix bug of uninitialized regex_t value on error. - reimplement Unicode case folding. - update LTVERSION = 3.0.0 - remove all THREAD_ macro. - add init member into OnigEncoding. (add onig_initialize()) - remove state member of regex. - move source files into src/ - rename configre.in to configure.ac. - fix memory leak. (thanks pigzang) - change mail address. - Version 6.7.0 - add ONIG_SYNTAX_ONIGURUMA (default syntax) - restructure StackType - implement subexp calls (?R), (?&name), (?-n), (?+n) for Perl syntax - use string pool of gperf for Unicode Property lookup function - fix an empty greedy regex and a word boundary (.*\b) fails - remove a stack type STK_POS - add a declaration of onig_end() - fix compilation failure in out-of-source build - [new] hexadecimal codepoint \uHHHH - Version 6.6.1 - fix definition of \X to (?>\O(?:\Y\O)*) - Version 6.6.0 - rename Absent clear to Range clear - [new] Extended Grapheme Cluster \X and boundary \y, \Y - fix: invalid index(ctype) value assigned to Unicode Block properties - --enable-crnl-as-line-terminator to be deprecated - [new] ASCII only mode options (?WDSP) - [new] ONIG_OPTION_XXXX_IS_ASCII options - disable OP_CCLASS_NODE - [spec] Absent clear restore previous range value at backtrack - optimize for simple one char repetition in Absent expression - fix: invalid impl. for reluctant repetition in Absent expression - remove compile switch USE_NAMED_GROUP - Visual Studio 2005 compilation fixed - cleanup with spec-cleaner - Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246) oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c - Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204) oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c - Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203) oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c - Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163) oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c. - Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159) oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS - Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224) oniguruma: use-after-free in onig_new_deluxe() in regext.c - Added oniguruma-6.8.2-CVE-2019-13225-fix.patch (boo#1141157 CVE-2019-13225) oniguruma: null-pointer dereference in match_at() in regexec.c - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Fix the usr-merge changes (bsc#1192013). This includes catching all the places that /sbin was still used directly, as well as making the SPEC file build using /usr/sbin for openSUSE but still use /sbin for SLE, for now. - Merged latest upstream. Mostly cleanup, but includes a fix for iscsi-init.service when trying to write to the root volume too early (bsc#1192568), as well as an upstream fix for possible deadlock when dealing with sysfs. - Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains bug fixes and cleanups. See the Changelog for more details. - Update to latest upstream, including test cleanup, minor bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656). - Updated to latest upstream, including bug fixes and cleanups. Changes included: * add handling name/value pairs for firmware login (bsc#1196113), including man page update for same * Fix bug where some package parts were installed using DESTDIR twice * general build cleanup (in prep for removing DB files from /etc/iscsi some day soon) Also, now delivering a "package config" file for libopeniscsiusr. - Updated to latest upstream version, tagged 2.1.7. Changes included: * updated/fixed test script * updated build system * several bug fixes, including one for bsc#1199264 - Update to latest upstream, including: * Added 'distclean' to Makefile targets * Ensure Makefile '.PHONY' targets set up correctly * fix an iscsid logout bug generating a false error and cleanup logout error messages - Set initiatorname in %post (at end of install), for cases where root is read-only at startup time (bsc#1198457) - For Tumbleweed, moved logrotate files from user-specific directory /etc/logrotate.d to vendor-specific /usr/etc/logrotate.d (for Stefan Schubert <schubi@suse.com>) - Modify SPEC file so systemd unit files are mode 644 (not 755) (bsc#1200570) - Update to upstream version 2.1.8, which includes some bug fixes, and adds the ability to build using meson. The SPEC file was updated to use meson. Also, some files have moved: * the "lock" file has moved from /etc/iscsi to /var/lock/iscsi * the "database files" have moved from /etc/iscsi to /var/lib/iscsi - Updated to latest upstream. Changes: * iscsid/iscsiuio: fix OOM adjustment (github issue #377) - Moving DB files from /etc/iscsi/* to /var/lib/iscsi/* for SLE-15-SP5 and forward, as is done in Tumbleweed. - Added /etc/iscsi/README.DB-files-moved, and added SPEC file changes to support this, including a post-install script to move the DB files, only installed if DB files are moved. - Renamed shared library from libopeniscsiusr0_2_0 to libopeniscsiusr0, to correctly match SONAME in library. - Updated SPEC file dependencies for libopeniscsiusr to avoid conflicting package installation. - Update iscsid.service so it starts iscsid.socket, if needed (bsc#1206132). - Build system: meson builds were ignoring optflags, and other passed in compiler options. - Remove "--strip" in SPEC file for meson build, so that debuginfo is generated. (from mwilck) (bsc#1210536) - Upgrade to upstream version 2.1.9 with tag "2.1.9-suse" (bsc#1210514), replacing open-iscsi-2.1.8-suse.tar.bz2 with open-iscsi-2.1.9-suse.tar.bz2, and resetting open-iscsi-SUSE-latest.diff.bz2. A summary from the ChangeLog file: * Fix discoveryd compiler warning * Sync iscsi_if.h with kernel * Handle old DB records correctly * Make IQN configuration for iscsi-iname * remove OFFLOAD_BOOT_SUPPORTED, which is always true * Use UUID for IPC, not "root" * do not support SHA3 for libressl * build meson cleanups, including changing default DB home * Updated README about NOPs * Remove "BindTo" in systemd service file * Some iscsiuio fixes, including licensing and memory leaks (bsc#1210514) * Small netlink fixes * Fix OOM adjustment * Some error recovery fixes * Some spelling fixes - Fix iscsiuio build version by updating iscsiuio/meson.build and RPM SPEC file (bsc#1210514), updating open-iscsi-SUSE-latest.diff.bz2 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates iscsiuio version to 0.7.8.8. This updates open-iscsi-SUSE-latest.diff.bz2 - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Don't use full URL as source, as the tarball does not exist at that location. - Fix calling of fillup_only: it knows no -i parameter. - Update to git commit cb81e9541b5 (FATE#326034,bug#1104011) * 8021qaz: Remove unused variable * 8021qaz: Honor willing value from config file * lldpad: Support DSCP selectors in APP TLV's * Fix application tlv display * basman_clif: print the OID properly * ecp22: deinit l2_packet_data before freeing ecp22 * DCB set state operation return value check * memleak on received TLVs from modules * Use interface index instead of name in libconfig * Fix 'is_valid_mac' to include mcast mac address * lldpad: Fix segfault in lldptool * Fixup disabling PG + open-lldp-v1.0.1+56.cb81e95.tar.xz - Remove superseded files - open-lldp-1.0.1.tar.gz - open-lldp-git-update.patch.bz2 - open-lldp-gcc5.patch - 0001-l2_linux_packet-correctly-process-return-value-of-ge.patch - 0002-lldpad-Only-set-Tx-adminStatus-if-interface-is-not-m.patch - Use %license instead of %doc [bsc#1082318] - Add gcc9-fix-werror.patch in order to fix bsc#1128299. - Adjust project URL as we're using the Intel's fork. - Disable -Werror (boo#1128299) and remove gcc9-fix-werror.patch. - Add disable-werror.patch. - Update to version v1.0.1+95.3168e11: * Test with newer GCC 8 and 9 versions * RPM build is broken, so skip * Place the tarball in the right place * A tarball needs to be built after bootstrap.sh for use with RPM * Added missing steps for building an RPM * Finish off with testing building the RPM * Test package installation as well * Test under multiple GCC releases * Drop requirement for Travis CI testing with Clang * Support checking build with Travis CI * vdp-netlink: account for sizes properly * qbg: avoid warning for extra parens * qbg: port name is always a valid pointer * dcbx-nl: drop run_cmd * ecp: allow for failure to create * lldp_util: allow for null ifa_addr element * lldpad: Do not enable port if already enabled * Silent -Werror=address-of-packed-member warnings. * Come up with STRNCPY_TERMINATED (#25). * vdptool: fixed compile error for getline() * Fix #23 by off by one strncpy value. * 8021qaz: Block lldptool set operations if read only mode is on * 8021qaz: Add read only option for 8021qaz module * lldp: Allow lldptool to modify optional TLV's content * 8021qaz: Print dscp2prio map * autoconf: Add systemd support in configure.ac * rpm-spec: Add vdp22 man files to lldpad.spec.in - Update to version v1.0.1+102.4c7fcc3: * l2_packet: Guard ETH_P_LLDP define (edit: fixes bsc#1156545) * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - BuildRequire pkgconfig(systemd) instead of systemd directly: allow OBS to shortcut through the -mini flavors. - Use -fcommon in order to fix boo#1160407. - Update to version v1.0.1+63.f977e67 (bsc#1171284,bsc#1170745,bsc#1153520): * lldp/rx.c: Reset state machine variable in process_delete_info() * lldp: do not call 'assert' in rxProcessFrame() * ecp: allow for failure to create * lldp_mand: retrieve permanent mac address in get_mac() * lldp_util: use netlink to fetch mac address * lldp_util: drop get_macstr() * linux/if_link.h: Update and add bonding netlink definitions - Moved sources from github.com/intel to github/openSUSE * upgrading to version v1.0.1+110.6009075a9fcc - merged in latest upstream (no API changes) - Update to version v1.0.1+69.e8f522565f5a to removed commpiler and rpmlint complaints: * Fix bash-completion dir: don't use /etc * Fix compiler issue with strcpy(): use memcpy * Fix compiler complaint argument type mismatch. * Fix compiler complaint declaration vs function. * Fix compiler complaint copying to packed member. * add 'lldpad.socket' to the '%service_*' macros in the SPEC file - Update to version v1.1+15.ef8495548d04, by merging upstream version 1.1 + latest, including: * Fix merge error: remove bogus line * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided This removed the need for the patch disable-werror.patch. - Update to version v1.1+18.0e969d0edcc4: * event_iface: only set rcv buf size if too small (bsc#1175570) - Update to version v1.1+36.e926f7172b96: * tx: rename variable * event_iface: only set rcv buf size if too small (bsc#1175570) * tx: when operating in rx-only mode don't send a port shutdown pdu * Update .travis.yml * vdp22: manpage typo * lldptool: fix manpage * lldp_head: remove all references * add_rtattr: only copy if data is provided * autoconf: convenience to setup asan and ubsan * Post 1.1 release - Update to version v1.1+44.0f781b4162d3: * agent: reset frame status on message delete * Avoiding null pointer dereference - Update to version v1.1+58.8ca361bab766: * clif: Include string.h for mem* function prototypes * basman: use return address when pulling address * Revert "Use interface index instead of name in libconfig" * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Update to version latest Intel upstream (v1.1+77.75e83b6fb98e, jsc#PED-6852): * lldpad: dcbx: prevent null dereference in dcbx_free_data (bsc#1212749) * dcbx: Fix use-after-free * dcbx: Fix NULL pointer dereference * dcbx: Fix leak when receiving legacy TLVs with mismatched mode * lldp: Reject frames with duplicate TLVs * dcbx: Free manifest in rchange callback * dcbx: Avoid memory leak if ifup is called twice * ctrl_iface: Fix a memory leak in ctrl_iface_deinit * lldp: Avoid sending uninitialized data * lldptool: fix null pointer deference * Revert "Use interface index instead of name in libconfig" * Avoiding null pointer dereference * agent: reset frame status on message delete * basman: use return address when pulling address * 8021Qaz: check for rx block validity * 8021qaz: squelch initialization errors * macvtap: fix error condition * vdp22: convert command parsing to null term - Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67. Patch has been borrowed by Fedora, upstream is still busy working out a patch (I'd not be surprised if they end up merging this finally. https://github.com/vmware/open-vm-tools/issues/500 - Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools package fails. - Update to 11.3.0 (build 18090558) (boo#1187567) + Resolved issues: - The following github issues and pull requests have been resolved: 446, 481, 500, and 509 - The following Pull requests have been resolved: 474 and 505 - A number of issues detected by Coverity, internally or by third parties, have been addressed. - A command line tool, vmwgfxctrl, has been added to open-vm-tools for Linux that can be used to control various aspects of the vmwgfx Linux kernel module. Currently it can both display and set the current topology of the vmwgfx kernel driver. It is useful when trying to configure custom resolutions on recent Linux distributions, including multi-monitor setups. - A command line tool, vmware-alias-import, has been added to open-vm-tools that can be used to import vgauth config data and apply it to the running vgauth service. - Enhancements to support or utilize various vSphere features. - Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path "/var/run" to "/run" for it's PIDfile. - Update pam-vmtoolsd.patch to compensate for new line numbers. - Drop patch now contained in 11.3.0: - open-vm-tools-glib-2.67.patch - open-vm-tools-pollGtk.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67. Patch has been borrowed by Fedora, upstream is still busy working out a patch (I'd not be surprised if they end up merging this finally. https://github.com/vmware/open-vm-tools/issues/500 - Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools package fails. - Update to 11.3.0 (build 18090558) (boo#1187567) + Resolved issues: - The following github issues and pull requests have been resolved: 446, 481, 500, and 509 - The following Pull requests have been resolved: 474 and 505 - A number of issues detected by Coverity, internally or by third parties, have been addressed. - A command line tool, vmwgfxctrl, has been added to open-vm-tools for Linux that can be used to control various aspects of the vmwgfx Linux kernel module. Currently it can both display and set the current topology of the vmwgfx kernel driver. It is useful when trying to configure custom resolutions on recent Linux distributions, including multi-monitor setups. - A command line tool, vmware-alias-import, has been added to open-vm-tools that can be used to import vgauth config data and apply it to the running vgauth service. - Enhancements to support or utilize various vSphere features. - Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path "/var/run" to "/run" for it's PIDfile. - Update pam-vmtoolsd.patch to compensate for new line numbers. - Drop patch now contained in 11.3.0: - open-vm-tools-glib-2.67.patch - open-vm-tools-pollGtk.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools package fails. - Update to 11.3.0 (build 18090558) (boo#1187567) + Resolved issues: - The following github issues and pull requests have been resolved: 446, 481, 500, and 509 - The following Pull requests have been resolved: 474 and 505 - A number of issues detected by Coverity, internally or by third parties, have been addressed. - A command line tool, vmwgfxctrl, has been added to open-vm-tools for Linux that can be used to control various aspects of the vmwgfx Linux kernel module. Currently it can both display and set the current topology of the vmwgfx kernel driver. It is useful when trying to configure custom resolutions on recent Linux distributions, including multi-monitor setups. - A command line tool, vmware-alias-import, has been added to open-vm-tools that can be used to import vgauth config data and apply it to the running vgauth service. - Enhancements to support or utilize various vSphere features. - Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path "/var/run" to "/run" for it's PIDfile. - Update pam-vmtoolsd.patch to compensate for new line numbers. - Drop patch now contained in 11.3.0: - open-vm-tools-glib-2.67.patch - open-vm-tools-pollGtk.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools package fails. - Update to 11.3.0 (build 18090558) (boo#1187567) + Resolved issues: - The following github issues and pull requests have been resolved: 446, 481, 500, and 509 - The following Pull requests have been resolved: 474 and 505 - A number of issues detected by Coverity, internally or by third parties, have been addressed. - A command line tool, vmwgfxctrl, has been added to open-vm-tools for Linux that can be used to control various aspects of the vmwgfx Linux kernel module. Currently it can both display and set the current topology of the vmwgfx kernel driver. It is useful when trying to configure custom resolutions on recent Linux distributions, including multi-monitor setups. - A command line tool, vmware-alias-import, has been added to open-vm-tools that can be used to import vgauth config data and apply it to the running vgauth service. - Enhancements to support or utilize various vSphere features. - Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path "/var/run" to "/run" for it's PIDfile. - Update pam-vmtoolsd.patch to compensate for new line numbers. - Drop patch now contained in 11.3.0: - open-vm-tools-glib-2.67.patch - open-vm-tools-pollGtk.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Update to 11.3.5 (build 18557794) (boo#1190987) + New/Updated features: - Added a configurable logging capability to the network script. The network script has been updated to: use vmware-toolbox-cmd to query any network logging configuration from the tools.conf file. Use vmtoolsd --cmd "log ..." to log a message to the vmx logfile when the logging handler is configured to "vmx" or when the logfile is full or is not writeable. - The hgfsmounter (mount.vmhgfs) command has been removed from open-vm-tools. The hgfsmounter (mount.vmhgfs) command is no longer used in Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore, removing all references to the hgfsmounter in Linux builds. + Resolved issues: - Customization: Retry the Linux reboot if telinit is a soft link to systemctl. - Open-vm-tools commands would hang if configured with "--enable-valgrind". + Spec file updates for: - rpmlint errors - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling. - Update to 12.0.0 (build 19345655) (boo#1196803) - jsc#SLE-24097 ECO Update open-vm-tools 12.0.0 + New/Updated features: - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4 jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3 jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5 - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804). - Build vmhgfs with either libfuse2 or libfuse3. + A number of Coverity and Codacy reported issues have been addressed. + The following issues and pull requests reported on github.com/vmware/open-vm-tools have been addressed: Issue # 128, Issue # 314, Pull # 513, Pull # 544, Pull # 573 - Added patches + gcc_size_t.patch (boo#1196804) - Update to 12.1.0 (build 20219665) (boo#1202733) + New/Updated features: - Contains security update fix for (bsc#1202657) - (CVE-2022-31676) VUL-0: CVE-2022-31676: open-vm-tools: local privilege escalation vulnerability + A number of Coverity reported issues have been addressed. + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux release: https://github.com/vmware/open-vm-tools/pull/588 + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit) This change incorporates the support of 64 bit time epoch conversion from Windows NT time to Unix Epoch time on i386. https://github.com/vmware/open-vm-tools/pull/387 - Drop patch now contained in 12.1.0: + gcc_size_t.patch - Add _service to handle open-vm-tools sources - Update to 12.1.5 (build 20735119) (boo#1205962) - A number of Coverity reported issues have been addressed. - The deployPkg plugin may prematurely reboot the guest VM before cloud-init has completed user data setup. If both the Perl based Linux customization script and cloud-init run when the guest VM boots, the deployPkg plugin may reboot the guest before cloud-init has finished. The deployPkg plugin has been updated to wait for a running cloud-init process to finish before the guest VM reboot is initiated. This issue is fixed in this release. - A SIGSEGV may be encountered when a non-quiesing snapshot times out. This issue is fixed in this release. - Unwanted vmtoolsd service error message if not on a VMware hypervisor. When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd services are started automatically at system start and desktop login. If running on physical hardware or in a non-VMware hypervisor, the services will emit an error message to the Systemd's logging service before stopping. This issue is fixed in this release. - Add containerInfo plugin (jsc-PED-1344) - Add dependencies on grpc, protobuf, and containerd for container introspection - Added patches (jsc-PED-1344) + detect-suse-location.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog - Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires section. The dependencies will be added automatically. - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog - convert to obs_scm - update to 12.5.0 (boo#1231826): There are no new features in the open-vm-tools 12.5.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been integrated. Please see the Resolved Issues section of the Release Notes. * For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.5.0 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/ReleaseNotes.md The granular changes that have gone into the 12.5.0 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/open-vm-tools/ChangeLog - Migration of PAM settings to /usr/lib/pam.d. - Update to 12.2.0 (build 21223074) (boo#1209128) - There are no new features in the open-vm-tools 12.2.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - Linux quiesced snapshots have been updated to avoid intermittent hangs of the vmtoolsd process. - Updated the guestOps to handle some edge cases when File_GetSize() fails or returns -1. - A number of Coverity reported issues have been addressed. - Detect the proto files for the containerd grpc client in alternate locations. Pull request #626 - FreeBSD: Support newer releases and code clean-up for earlier versions. Pull request #584 - Please refer to the release notes at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md - The granular changes that have gone into the 12.2.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ open-vm-tools/ChangeLog - Update detect-suse-location.patch to remove upstream accepted portion of the patch (jsc-PED-1344). - As per jsc-PED-1344, update spec file to only build the containerinfo plugin for TW/SLES 15 SP5 and newer. - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* - Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module + Add patch: 2023-20867-Remove-some-dead-code.patch - limit to protobuf < 22 for now until build failures have been fixed - Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900: open-vm-tools: SAML token signature bypass vulnerability + Add patch: CVE-20230-20900.patch - Update to 12.3.0 (build 22234872) (boo#1214850) - There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. - A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. - Building of the VMware Guest Authentication Service (VGAuth) using "xml-security-c" and "xerces-c" is being deprecated. - A number of Coverity reported issues have been addressed. - A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. - For issues resolved in this release, see the Resolved Issues section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md - The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog - Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests - jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. - Drop patch now contained in 12.3.0: + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch + 2023-20867-Remove-some-dead-code.patch + CVE-20230-20900.patch - open-vm-tools is built with containerinfo plugin from 15 sp3 onwards - 15 sp4 currently uses open-vm-tools rpms from 15 sp3. As such, enable the spec file fix for bug (bsc#1205927) for 15 sp3 onwards. - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch - Drop pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: No longer needed, nor used (since 12.3.0 release). - Update to 12.3.5 (build 22544099) (boo#1216670) - There are no new features in the open-vm-tools 12.3.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - This release resolves CVE-2023-34058. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0024.html. - This release resolves CVE-2023-34059 which only affects open-vm-tools. For more information on this vulnerability, please see the Resolved Issues section of the Release Notes. - A GitHub issue has been handled. Please see the Resolved Issues section of the Release Notes. - An update to the deployPkg plugin to coordinate with recent releases of cloud-init for improvement for guest VM customization. - For issues resolved in this release, see the Resolved Issues <https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md#resolved-issues> section of the Release Notes. - For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.5 - Release Notes are available at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/ReleaseNotes.md - The granular changes that have gone into the 12.3.5 release are in the ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.3.5/open-vm-tools/ChangeLog - Drop patch now contained in 12.3.5: - CVE-2023-34058.patch - CVE-2023-34059.patch - Fix (bsc#1217796) - Fix outdated libxmlsec1 dependency version. Updates to open-vm-tools for SLES 12 SP4 and SP5 are now being built againt against libxmlsec1-1-1.2.37. Update the spec file to now require libxmlsec1-openssl1 >= 1.2.37. - Own %{_modulesloaddir}: used to be present via udev-mini -> kmod - > suse-module-tools dependency before. - Use %patch -P N instead of deprecated %patchN. - update to 12.4.0: https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/ReleaseNotes.md https://github.com/vmware/open-vm-tools/blob/stable-12.4.0/open-vm-tools/ChangeLog There are no new features in the open-vm-tools 12.4.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been handled. Please see the Resolved Issues section of the Release Notes. * A number of issues flagged by Coverity have been addressed. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. - Update to 12.4.5 (build 23787635) (boo#1227181) - There are no new features in the open-vm-tools 12.4.5 release. This is primarily a maintenance release that addresses a few critical problems, including: - A Github pull request and associated issue has been handled. Please see the Resolved Issues section of the Release Notes. - A number of issues flagged by Coverity and ShellCheck have been addressed. - A vmtoolsd process hang related to nested logging from an RPC Channel error has been fixed. For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.4.5 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/ReleaseNotes.md The granular changes that have gone into the 12.4.5 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.4.5/open-vm-tools/ChangeLog - convert to obs_scm - update to 12.5.0 (boo#1231826): There are no new features in the open-vm-tools 12.5.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * A Github pull request has been integrated. Please see the Resolved Issues section of the Release Notes. * For a more complete list of issues resolved in this release, see the Resolved Issues section of the Release Notes. For complete details, see: https://github.com/vmware/open-vm-tools/releases/tag/stable-12.5.0 Release Notes are available at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/ReleaseNotes.md The granular changes that have gone into the 12.5.0 release are in the ChangeLog at: https://github.com/vmware/open-vm-tools/blob/stable-12.5.0/open-vm-tools/ChangeLog - Don't require pwdutils for build, dropped long ago and not needed - Added the following patches for bsc#1179319 * Fix compiling with C++: ocki-3.15.1-Fix-compiling-with-c.patch * Added error message handling for p11sak remove-key command. ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch - Added ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch (bsc#1182120) Fix pkcscca migration fails with usr/sb2 is not a valid slot ID - Added ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch (bsc#1182190) Fix a segmentation fault of the sess_opstate test on the Soft Token - Added ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch When constructing an OpenSSL EC public or private key from PKCS#11 attributes or ECDH public data, check that the key is valid, i.e. that the point is on the curve. (bsc#1185976) - Added the following patches for bsc#1182726 " p11sak list-key segfault" * ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch Added NULL pointer to avoid double free() for the list-key and remove-key commands. * ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch Note that two hunks that were unrelated to fixing the running code were removed from this patch. * ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch - Added the following patches for bsc#1188879: * ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch When modifying opencryptoki.conf during token migration, put quotes around strings that contain spaces, e.g. for the slot description and manufacturer. * ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch When migrating a slot the opencryptoki.conf file is modified. If it contains slots that already contain the 'tokversion = x.y' keyword, this is accidentally removed when migrating another slot. * ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch Change the code to use the pid file that pkcsslotd creates, and check if the process with the pid contained in the pid file still exists and runs pkcsslotd. * ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch Always quote the value of 'description' and 'manufacturer'. Quote the value of 'stdll', 'confname', and 'tokname' if it contains spaces, and never quote the value of 'hwversion', 'firmwareversion', and 'tokversion'. - Upgraded to version 3.17.0 (jsc#SLE-18326) + openCryptoki 3.17 - tools: added function to list keys to p11sak - common: added support for OpenSSL 3.0 - common: added support for event notifications - ICA: added SW fallbacks * openCryptoki 3.16 - EP11: protected-key option - EP11: support attribute-bound keys - CCA: import and export of secure key objects - Bug fixes - Removed the following obsolete patches: ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch ocki-3.15.1-Fix-compiling-with-c.patch ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch - Made the following changes for bsc#1199862 "Please install p11sak_defined_attrs.conf." * Replaced ocki-3.11-remove-make-install-chgrp.patch with ocki-3.17-remove-make-install-chgrp.patch to remove the "-g pkcs11" parameter from the install command in the Makefile * Updated the spec file to include /etc/opencryptoki/p11sak_defined_attrs.conf as a %config file with the necessary permissions and group ownership. - Added ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch for bsc#1202106. One test of the gen_purpose test cases fails with C_GetMechanismList #2 rc=CKR_BUFFER_TOO_SMALL" error on the EP11 Token. - Upgrade to version 3.19.0 (jsc#PED-616) + openCryptoki 3.19 - CCA: check for expected master key verification patterns at token init - CCA: check master key verification pattern of created keys to be as expected - EP11: check for expected wrapping key verification pattern at token init - EP11: check wrapping key verification pattern of created keys to be as expected - p11sak/pkcsconf: display PKCS#11 URIs - p11sak: add support for IBM specific Dilithium keys - p11sak: allow to list keys filtered by label - common: add support for dual-function cryptographic functions - Add support for C_SessionCancel function (PKCS#11 v3.0) - EP11: add support for schnorr signatures (mechanism CKM_IBM_ECDSA_OTHER) - EP11: add support for Bitcoin key derivation (mechanism CKM_IBM_BTC_DERIVE) - Bug fixes + openCryptoki 3.18 - Default to FIPS compliant token data format (tokversion = 3.12) - Add support for restricting usage of mechanisms and keys via a global policy - Add support for statistics counting of mechanism usage - ICA/EP11: Support libica version 4 - p11sak tool: Allow to set different attributes for public and private keys - Replaced ocki-3.17-remove-make-install-chgrp.patch with an updated version named ocki-3.19-remove-make-install-chgrp.patch to fit the current state of the source. - Removed the following obsolete patches: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch - Updated spec file to set permissions on /etc/opencryptoki/strength.conf to be owned by root:pkcs11 with permissions of 640. (bsc#1205566) - Updated the package openCryptoki 3.19.0 (jsc#PED-616, bsc#1207760), added the following patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch - Added patch for compile errors * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch -- Changed spec file to use %autosetup instead of %setup. - Updated package to openCryptoki 3.20 (bsc#1207760, jsc#PED-3376, jsc#PED-2870, jsc#PED-2869 ) - Removed the following obsolite patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch - Reworked ocki-3.19-remove-make-install-chgrp.patch to fit the current version of the package and renamed it to ocki-3.20-remove-make-install-chgrp.patch. - Update to version 3.21 (jsc#PED-3360, jsc#PED-3361) * openCryptoki 3.21 - EP11 and CCA: Support concurrent HSM master key changes - CCA: protected-key option - pkcsslotd: no longer run as root user and further hardening - p11sak: Add support for additional key types (DH, DSA, generic secret) - p11sak: Allow wildcards in label filter - p11sak: Allow to specify hex value for CKA_ID attribute - p11sak: Support sorting when listing keys - p11sak: New commands: set-key-attr, copy-key to modify and copy keys - p11sak: New commands: import-key, export-key to import and export keys - Remove support for --disable-locks (transactional memory) - Updates to harden against RSA timing attacks - Bug fixes - Amended a new patch to fit the version 3.21 * ocki-3.21-remove-make-install-chgrp.patch - Removed the old patch for the version 3.20 * ocki-3.20-remove-make-install-chgrp.patch - Upgrade to version 3.22 (jsc#PED-3361) * openCryptoki 3.22 - CCA: Add support for the AES-XTS key type using CPACF protected keys - p11sak: Add support for managing certificate objects - p11sak: Add support for public sessions (no-login option) - p11sak: Add support for logging in as SO (security Officer) - p11sak: Add support for importing/exporting Edwards and Montgomery keys - p11sak: Add support for importing of RSA-PSS keys and certificates - CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different * Bug fixes - Amended the .spec file for pkcsslotd (jsc#1217703) * Renamed the patch ocki-3.21-remove-make-install-chgrp.patch to ocki-3.22-remove-make-install-chgrp.patch - provide user(pkcs11) and group(pkcs11) - Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361) * EP11: Add support for FIPS-session mode * Updates to harden against RSA timing attacks (bsc#1219217) * Bug fixes - Renamed ocki-3.22-remove-make-install-chgrp.patch to ocki-3.23-remove-make-install-chgrp.patch - Don't require pwdutils for build, dropped long ago and not needed - Added the following patches for bsc#1179319 * Fix compiling with C++: ocki-3.15.1-Fix-compiling-with-c.patch * Added error message handling for p11sak remove-key command. ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch - Added ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch (bsc#1182120) Fix pkcscca migration fails with usr/sb2 is not a valid slot ID - Added ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch (bsc#1182190) Fix a segmentation fault of the sess_opstate test on the Soft Token - Added ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch When constructing an OpenSSL EC public or private key from PKCS#11 attributes or ECDH public data, check that the key is valid, i.e. that the point is on the curve. (bsc#1185976) - Added the following patches for bsc#1182726 " p11sak list-key segfault" * ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch Added NULL pointer to avoid double free() for the list-key and remove-key commands. * ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch Note that two hunks that were unrelated to fixing the running code were removed from this patch. * ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch - Added the following patches for bsc#1188879: * ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch When modifying opencryptoki.conf during token migration, put quotes around strings that contain spaces, e.g. for the slot description and manufacturer. * ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch When migrating a slot the opencryptoki.conf file is modified. If it contains slots that already contain the 'tokversion = x.y' keyword, this is accidentally removed when migrating another slot. * ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch Change the code to use the pid file that pkcsslotd creates, and check if the process with the pid contained in the pid file still exists and runs pkcsslotd. * ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch Always quote the value of 'description' and 'manufacturer'. Quote the value of 'stdll', 'confname', and 'tokname' if it contains spaces, and never quote the value of 'hwversion', 'firmwareversion', and 'tokversion'. - Upgraded to version 3.17.0 (jsc#SLE-18326) + openCryptoki 3.17 - tools: added function to list keys to p11sak - common: added support for OpenSSL 3.0 - common: added support for event notifications - ICA: added SW fallbacks * openCryptoki 3.16 - EP11: protected-key option - EP11: support attribute-bound keys - CCA: import and export of secure key objects - Bug fixes - Removed the following obsolete patches: ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch ocki-3.15.1-Fix-compiling-with-c.patch ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch - Made the following changes for bsc#1199862 "Please install p11sak_defined_attrs.conf." * Replaced ocki-3.11-remove-make-install-chgrp.patch with ocki-3.17-remove-make-install-chgrp.patch to remove the "-g pkcs11" parameter from the install command in the Makefile * Updated the spec file to include /etc/opencryptoki/p11sak_defined_attrs.conf as a %config file with the necessary permissions and group ownership. - Added ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch for bsc#1202106. One test of the gen_purpose test cases fails with C_GetMechanismList #2 rc=CKR_BUFFER_TOO_SMALL" error on the EP11 Token. - Upgrade to version 3.19.0 (jsc#PED-616) + openCryptoki 3.19 - CCA: check for expected master key verification patterns at token init - CCA: check master key verification pattern of created keys to be as expected - EP11: check for expected wrapping key verification pattern at token init - EP11: check wrapping key verification pattern of created keys to be as expected - p11sak/pkcsconf: display PKCS#11 URIs - p11sak: add support for IBM specific Dilithium keys - p11sak: allow to list keys filtered by label - common: add support for dual-function cryptographic functions - Add support for C_SessionCancel function (PKCS#11 v3.0) - EP11: add support for schnorr signatures (mechanism CKM_IBM_ECDSA_OTHER) - EP11: add support for Bitcoin key derivation (mechanism CKM_IBM_BTC_DERIVE) - Bug fixes + openCryptoki 3.18 - Default to FIPS compliant token data format (tokversion = 3.12) - Add support for restricting usage of mechanisms and keys via a global policy - Add support for statistics counting of mechanism usage - ICA/EP11: Support libica version 4 - p11sak tool: Allow to set different attributes for public and private keys - Replaced ocki-3.17-remove-make-install-chgrp.patch with an updated version named ocki-3.19-remove-make-install-chgrp.patch to fit the current state of the source. - Removed the following obsolete patches: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch - Updated spec file to set permissions on /etc/opencryptoki/strength.conf to be owned by root:pkcs11 with permissions of 640. (bsc#1205566) - Updated the package openCryptoki 3.19.0 (jsc#PED-616, bsc#1207760), added the following patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch - Added patch for compile errors * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch -- Changed spec file to use %autosetup instead of %setup. - Updated package to openCryptoki 3.20 (bsc#1207760, jsc#PED-3376, jsc#PED-2870, jsc#PED-2869 ) - Removed the following obsolite patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch - Reworked ocki-3.19-remove-make-install-chgrp.patch to fit the current version of the package and renamed it to ocki-3.20-remove-make-install-chgrp.patch. - Update to version 3.21 (jsc#PED-3360, jsc#PED-3361) * openCryptoki 3.21 - EP11 and CCA: Support concurrent HSM master key changes - CCA: protected-key option - pkcsslotd: no longer run as root user and further hardening - p11sak: Add support for additional key types (DH, DSA, generic secret) - p11sak: Allow wildcards in label filter - p11sak: Allow to specify hex value for CKA_ID attribute - p11sak: Support sorting when listing keys - p11sak: New commands: set-key-attr, copy-key to modify and copy keys - p11sak: New commands: import-key, export-key to import and export keys - Remove support for --disable-locks (transactional memory) - Updates to harden against RSA timing attacks - Bug fixes - Amended a new patch to fit the version 3.21 * ocki-3.21-remove-make-install-chgrp.patch - Removed the old patch for the version 3.20 * ocki-3.20-remove-make-install-chgrp.patch - Upgrade to version 3.22 (jsc#PED-3361) * openCryptoki 3.22 - CCA: Add support for the AES-XTS key type using CPACF protected keys - p11sak: Add support for managing certificate objects - p11sak: Add support for public sessions (no-login option) - p11sak: Add support for logging in as SO (security Officer) - p11sak: Add support for importing/exporting Edwards and Montgomery keys - p11sak: Add support for importing of RSA-PSS keys and certificates - CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different * Bug fixes - Amended the .spec file for pkcsslotd (jsc#1217703) * Renamed the patch ocki-3.21-remove-make-install-chgrp.patch to ocki-3.22-remove-make-install-chgrp.patch - provide user(pkcs11) and group(pkcs11) - Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361) * EP11: Add support for FIPS-session mode * Updates to harden against RSA timing attacks (bsc#1219217) * Bug fixes - Renamed ocki-3.22-remove-make-install-chgrp.patch to ocki-3.23-remove-make-install-chgrp.patch - Added the following patches for bsc#1179319 * Fix compiling with C++: ocki-3.15.1-Fix-compiling-with-c.patch * Added error message handling for p11sak remove-key command. ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch - Added ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch (bsc#1182120) Fix pkcscca migration fails with usr/sb2 is not a valid slot ID - Added ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch (bsc#1182190) Fix a segmentation fault of the sess_opstate test on the Soft Token - Added ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch When constructing an OpenSSL EC public or private key from PKCS#11 attributes or ECDH public data, check that the key is valid, i.e. that the point is on the curve. (bsc#1185976) - Added the following patches for bsc#1182726 " p11sak list-key segfault" * ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch Added NULL pointer to avoid double free() for the list-key and remove-key commands. * ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch Note that two hunks that were unrelated to fixing the running code were removed from this patch. * ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch - Added the following patches for bsc#1188879: * ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch When modifying opencryptoki.conf during token migration, put quotes around strings that contain spaces, e.g. for the slot description and manufacturer. * ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch When migrating a slot the opencryptoki.conf file is modified. If it contains slots that already contain the 'tokversion = x.y' keyword, this is accidentally removed when migrating another slot. * ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch Change the code to use the pid file that pkcsslotd creates, and check if the process with the pid contained in the pid file still exists and runs pkcsslotd. * ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch Always quote the value of 'description' and 'manufacturer'. Quote the value of 'stdll', 'confname', and 'tokname' if it contains spaces, and never quote the value of 'hwversion', 'firmwareversion', and 'tokversion'. - Upgraded to version 3.17.0 (jsc#SLE-18326) + openCryptoki 3.17 - tools: added function to list keys to p11sak - common: added support for OpenSSL 3.0 - common: added support for event notifications - ICA: added SW fallbacks * openCryptoki 3.16 - EP11: protected-key option - EP11: support attribute-bound keys - CCA: import and export of secure key objects - Bug fixes - Removed the following obsolete patches: ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch ocki-3.15.1-Fix-compiling-with-c.patch ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch - Made the following changes for bsc#1199862 "Please install p11sak_defined_attrs.conf." * Replaced ocki-3.11-remove-make-install-chgrp.patch with ocki-3.17-remove-make-install-chgrp.patch to remove the "-g pkcs11" parameter from the install command in the Makefile * Updated the spec file to include /etc/opencryptoki/p11sak_defined_attrs.conf as a %config file with the necessary permissions and group ownership. - Added ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch for bsc#1202106. One test of the gen_purpose test cases fails with C_GetMechanismList #2 rc=CKR_BUFFER_TOO_SMALL" error on the EP11 Token. - Upgrade to version 3.19.0 (jsc#PED-616) + openCryptoki 3.19 - CCA: check for expected master key verification patterns at token init - CCA: check master key verification pattern of created keys to be as expected - EP11: check for expected wrapping key verification pattern at token init - EP11: check wrapping key verification pattern of created keys to be as expected - p11sak/pkcsconf: display PKCS#11 URIs - p11sak: add support for IBM specific Dilithium keys - p11sak: allow to list keys filtered by label - common: add support for dual-function cryptographic functions - Add support for C_SessionCancel function (PKCS#11 v3.0) - EP11: add support for schnorr signatures (mechanism CKM_IBM_ECDSA_OTHER) - EP11: add support for Bitcoin key derivation (mechanism CKM_IBM_BTC_DERIVE) - Bug fixes + openCryptoki 3.18 - Default to FIPS compliant token data format (tokversion = 3.12) - Add support for restricting usage of mechanisms and keys via a global policy - Add support for statistics counting of mechanism usage - ICA/EP11: Support libica version 4 - p11sak tool: Allow to set different attributes for public and private keys - Replaced ocki-3.17-remove-make-install-chgrp.patch with an updated version named ocki-3.19-remove-make-install-chgrp.patch to fit the current state of the source. - Removed the following obsolete patches: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch - Updated spec file to set permissions on /etc/opencryptoki/strength.conf to be owned by root:pkcs11 with permissions of 640. (bsc#1205566) - Updated the package openCryptoki 3.19.0 (jsc#PED-616, bsc#1207760), added the following patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch - Added patch for compile errors * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch -- Changed spec file to use %autosetup instead of %setup. - Updated package to openCryptoki 3.20 (bsc#1207760, jsc#PED-3376, jsc#PED-2870, jsc#PED-2869 ) - Removed the following obsolite patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch - Reworked ocki-3.19-remove-make-install-chgrp.patch to fit the current version of the package and renamed it to ocki-3.20-remove-make-install-chgrp.patch. - Update to version 3.21 (jsc#PED-3360, jsc#PED-3361) * openCryptoki 3.21 - EP11 and CCA: Support concurrent HSM master key changes - CCA: protected-key option - pkcsslotd: no longer run as root user and further hardening - p11sak: Add support for additional key types (DH, DSA, generic secret) - p11sak: Allow wildcards in label filter - p11sak: Allow to specify hex value for CKA_ID attribute - p11sak: Support sorting when listing keys - p11sak: New commands: set-key-attr, copy-key to modify and copy keys - p11sak: New commands: import-key, export-key to import and export keys - Remove support for --disable-locks (transactional memory) - Updates to harden against RSA timing attacks - Bug fixes - Amended a new patch to fit the version 3.21 * ocki-3.21-remove-make-install-chgrp.patch - Removed the old patch for the version 3.20 * ocki-3.20-remove-make-install-chgrp.patch - Upgrade to version 3.22 (jsc#PED-3361) * openCryptoki 3.22 - CCA: Add support for the AES-XTS key type using CPACF protected keys - p11sak: Add support for managing certificate objects - p11sak: Add support for public sessions (no-login option) - p11sak: Add support for logging in as SO (security Officer) - p11sak: Add support for importing/exporting Edwards and Montgomery keys - p11sak: Add support for importing of RSA-PSS keys and certificates - CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different * Bug fixes - Amended the .spec file for pkcsslotd (jsc#1217703) * Renamed the patch ocki-3.21-remove-make-install-chgrp.patch to ocki-3.22-remove-make-install-chgrp.patch - provide user(pkcs11) and group(pkcs11) - Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361) * EP11: Add support for FIPS-session mode * Updates to harden against RSA timing attacks (bsc#1219217,CVE-2024-0914) * Bug fixes - Renamed ocki-3.22-remove-make-install-chgrp.patch to ocki-3.23-remove-make-install-chgrp.patch - Updated the .spec file (bsc#1225876, bsc#1227280) * Amended for group %{pkcs_group} and user pkcsslotd * Copying example script files from /usr/share/doc/opencryptoki to /usr/share/opencryptoki (policy-example.conf and strength-example.conf) in case that there is 'rpm.install.excludedocs=yes' set in the zypper.conf(zypp.conf) - Added the following patches for bsc#1179319 * Fix compiling with C++: ocki-3.15.1-Fix-compiling-with-c.patch * Added error message handling for p11sak remove-key command. ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch - Added ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch (bsc#1182120) Fix pkcscca migration fails with usr/sb2 is not a valid slot ID - Added ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch (bsc#1182190) Fix a segmentation fault of the sess_opstate test on the Soft Token - Added ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch When constructing an OpenSSL EC public or private key from PKCS#11 attributes or ECDH public data, check that the key is valid, i.e. that the point is on the curve. (bsc#1185976) - Added the following patches for bsc#1182726 " p11sak list-key segfault" * ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch Added NULL pointer to avoid double free() for the list-key and remove-key commands. * ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch Note that two hunks that were unrelated to fixing the running code were removed from this patch. * ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch - Added the following patches for bsc#1188879: * ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch When modifying opencryptoki.conf during token migration, put quotes around strings that contain spaces, e.g. for the slot description and manufacturer. * ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch When migrating a slot the opencryptoki.conf file is modified. If it contains slots that already contain the 'tokversion = x.y' keyword, this is accidentally removed when migrating another slot. * ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch Change the code to use the pid file that pkcsslotd creates, and check if the process with the pid contained in the pid file still exists and runs pkcsslotd. * ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch Always quote the value of 'description' and 'manufacturer'. Quote the value of 'stdll', 'confname', and 'tokname' if it contains spaces, and never quote the value of 'hwversion', 'firmwareversion', and 'tokversion'. - Upgraded to version 3.17.0 (jsc#SLE-18326) + openCryptoki 3.17 - tools: added function to list keys to p11sak - common: added support for OpenSSL 3.0 - common: added support for event notifications - ICA: added SW fallbacks * openCryptoki 3.16 - EP11: protected-key option - EP11: support attribute-bound keys - CCA: import and export of secure key objects - Bug fixes - Removed the following obsolete patches: ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch ocki-3.15.1-Fix-compiling-with-c.patch ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch - Made the following changes for bsc#1199862 "Please install p11sak_defined_attrs.conf." * Replaced ocki-3.11-remove-make-install-chgrp.patch with ocki-3.17-remove-make-install-chgrp.patch to remove the "-g pkcs11" parameter from the install command in the Makefile * Updated the spec file to include /etc/opencryptoki/p11sak_defined_attrs.conf as a %config file with the necessary permissions and group ownership. - Added ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch for bsc#1202106. One test of the gen_purpose test cases fails with C_GetMechanismList #2 rc=CKR_BUFFER_TOO_SMALL" error on the EP11 Token. - Upgrade to version 3.19.0 (jsc#PED-616) + openCryptoki 3.19 - CCA: check for expected master key verification patterns at token init - CCA: check master key verification pattern of created keys to be as expected - EP11: check for expected wrapping key verification pattern at token init - EP11: check wrapping key verification pattern of created keys to be as expected - p11sak/pkcsconf: display PKCS#11 URIs - p11sak: add support for IBM specific Dilithium keys - p11sak: allow to list keys filtered by label - common: add support for dual-function cryptographic functions - Add support for C_SessionCancel function (PKCS#11 v3.0) - EP11: add support for schnorr signatures (mechanism CKM_IBM_ECDSA_OTHER) - EP11: add support for Bitcoin key derivation (mechanism CKM_IBM_BTC_DERIVE) - Bug fixes + openCryptoki 3.18 - Default to FIPS compliant token data format (tokversion = 3.12) - Add support for restricting usage of mechanisms and keys via a global policy - Add support for statistics counting of mechanism usage - ICA/EP11: Support libica version 4 - p11sak tool: Allow to set different attributes for public and private keys - Replaced ocki-3.17-remove-make-install-chgrp.patch with an updated version named ocki-3.19-remove-make-install-chgrp.patch to fit the current state of the source. - Removed the following obsolete patches: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch - Updated spec file to set permissions on /etc/opencryptoki/strength.conf to be owned by root:pkcs11 with permissions of 640. (bsc#1205566) - Updated the package openCryptoki 3.19.0 (jsc#PED-616, bsc#1207760), added the following patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch - Added patch for compile errors * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch -- Changed spec file to use %autosetup instead of %setup. - Updated package to openCryptoki 3.20 (bsc#1207760, jsc#PED-3376, jsc#PED-2870, jsc#PED-2869 ) - Removed the following obsolite patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch - Reworked ocki-3.19-remove-make-install-chgrp.patch to fit the current version of the package and renamed it to ocki-3.20-remove-make-install-chgrp.patch. - Update to version 3.21 (jsc#PED-3360, jsc#PED-3361) * openCryptoki 3.21 - EP11 and CCA: Support concurrent HSM master key changes - CCA: protected-key option - pkcsslotd: no longer run as root user and further hardening - p11sak: Add support for additional key types (DH, DSA, generic secret) - p11sak: Allow wildcards in label filter - p11sak: Allow to specify hex value for CKA_ID attribute - p11sak: Support sorting when listing keys - p11sak: New commands: set-key-attr, copy-key to modify and copy keys - p11sak: New commands: import-key, export-key to import and export keys - Remove support for --disable-locks (transactional memory) - Updates to harden against RSA timing attacks - Bug fixes - Amended a new patch to fit the version 3.21 * ocki-3.21-remove-make-install-chgrp.patch - Removed the old patch for the version 3.20 * ocki-3.20-remove-make-install-chgrp.patch - Upgrade to version 3.22 (jsc#PED-3361) * openCryptoki 3.22 - CCA: Add support for the AES-XTS key type using CPACF protected keys - p11sak: Add support for managing certificate objects - p11sak: Add support for public sessions (no-login option) - p11sak: Add support for logging in as SO (security Officer) - p11sak: Add support for importing/exporting Edwards and Montgomery keys - p11sak: Add support for importing of RSA-PSS keys and certificates - CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different * Bug fixes - Amended the .spec file for pkcsslotd (jsc#1217703) * Renamed the patch ocki-3.21-remove-make-install-chgrp.patch to ocki-3.22-remove-make-install-chgrp.patch - provide user(pkcs11) and group(pkcs11) - Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361) * EP11: Add support for FIPS-session mode * Updates to harden against RSA timing attacks (bsc#1219217,CVE-2024-0914) * Bug fixes - Renamed ocki-3.22-remove-make-install-chgrp.patch to ocki-3.23-remove-make-install-chgrp.patch - Updated the .spec file (bsc#1225876, bsc#1227280) * Amended for group %{pkcs_group} and user pkcsslotd * Copying example script files from /usr/share/doc/opencryptoki to /usr/share/opencryptoki (policy-example.conf and strength-example.conf) in case that there is 'rpm.install.excludedocs=yes' set in the zypper.conf(zypp.conf) - Added ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch (bsc#1182120) Fix pkcscca migration fails with usr/sb2 is not a valid slot ID - Added ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch (bsc#1182190) Fix a segmentation fault of the sess_opstate test on the Soft Token - Added ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch When constructing an OpenSSL EC public or private key from PKCS#11 attributes or ECDH public data, check that the key is valid, i.e. that the point is on the curve. (bsc#1185976) - Added the following patches for bsc#1182726 " p11sak list-key segfault" * ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch Added NULL pointer to avoid double free() for the list-key and remove-key commands. * ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch Note that two hunks that were unrelated to fixing the running code were removed from this patch. * ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch - Added the following patches for bsc#1188879: * ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch When modifying opencryptoki.conf during token migration, put quotes around strings that contain spaces, e.g. for the slot description and manufacturer. * ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch When migrating a slot the opencryptoki.conf file is modified. If it contains slots that already contain the 'tokversion = x.y' keyword, this is accidentally removed when migrating another slot. * ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch Change the code to use the pid file that pkcsslotd creates, and check if the process with the pid contained in the pid file still exists and runs pkcsslotd. * ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch Always quote the value of 'description' and 'manufacturer'. Quote the value of 'stdll', 'confname', and 'tokname' if it contains spaces, and never quote the value of 'hwversion', 'firmwareversion', and 'tokversion'. - Upgraded to version 3.17.0 (jsc#SLE-18326) + openCryptoki 3.17 - tools: added function to list keys to p11sak - common: added support for OpenSSL 3.0 - common: added support for event notifications - ICA: added SW fallbacks * openCryptoki 3.16 - EP11: protected-key option - EP11: support attribute-bound keys - CCA: import and export of secure key objects - Bug fixes - Removed the following obsolete patches: ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch ocki-3.15.1-Fix-compiling-with-c.patch ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch - Made the following changes for bsc#1199862 "Please install p11sak_defined_attrs.conf." * Replaced ocki-3.11-remove-make-install-chgrp.patch with ocki-3.17-remove-make-install-chgrp.patch to remove the "-g pkcs11" parameter from the install command in the Makefile * Updated the spec file to include /etc/opencryptoki/p11sak_defined_attrs.conf as a %config file with the necessary permissions and group ownership. - Added ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch for bsc#1202106. One test of the gen_purpose test cases fails with C_GetMechanismList #2 rc=CKR_BUFFER_TOO_SMALL" error on the EP11 Token. - Upgrade to version 3.19.0 (jsc#PED-616) + openCryptoki 3.19 - CCA: check for expected master key verification patterns at token init - CCA: check master key verification pattern of created keys to be as expected - EP11: check for expected wrapping key verification pattern at token init - EP11: check wrapping key verification pattern of created keys to be as expected - p11sak/pkcsconf: display PKCS#11 URIs - p11sak: add support for IBM specific Dilithium keys - p11sak: allow to list keys filtered by label - common: add support for dual-function cryptographic functions - Add support for C_SessionCancel function (PKCS#11 v3.0) - EP11: add support for schnorr signatures (mechanism CKM_IBM_ECDSA_OTHER) - EP11: add support for Bitcoin key derivation (mechanism CKM_IBM_BTC_DERIVE) - Bug fixes + openCryptoki 3.18 - Default to FIPS compliant token data format (tokversion = 3.12) - Add support for restricting usage of mechanisms and keys via a global policy - Add support for statistics counting of mechanism usage - ICA/EP11: Support libica version 4 - p11sak tool: Allow to set different attributes for public and private keys - Replaced ocki-3.17-remove-make-install-chgrp.patch with an updated version named ocki-3.19-remove-make-install-chgrp.patch to fit the current state of the source. - Removed the following obsolete patches: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch - Updated spec file to set permissions on /etc/opencryptoki/strength.conf to be owned by root:pkcs11 with permissions of 640. (bsc#1205566) - Updated the package openCryptoki 3.19.0 (jsc#PED-616, bsc#1207760), added the following patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch - Added patch for compile errors * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch -- Changed spec file to use %autosetup instead of %setup. - Updated package to openCryptoki 3.20 (bsc#1207760, jsc#PED-3376, jsc#PED-2870, jsc#PED-2869 ) - Removed the following obsolite patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch - Reworked ocki-3.19-remove-make-install-chgrp.patch to fit the current version of the package and renamed it to ocki-3.20-remove-make-install-chgrp.patch. - Update to version 3.21 (jsc#PED-3360, jsc#PED-3361) * openCryptoki 3.21 - EP11 and CCA: Support concurrent HSM master key changes - CCA: protected-key option - pkcsslotd: no longer run as root user and further hardening - p11sak: Add support for additional key types (DH, DSA, generic secret) - p11sak: Allow wildcards in label filter - p11sak: Allow to specify hex value for CKA_ID attribute - p11sak: Support sorting when listing keys - p11sak: New commands: set-key-attr, copy-key to modify and copy keys - p11sak: New commands: import-key, export-key to import and export keys - Remove support for --disable-locks (transactional memory) - Updates to harden against RSA timing attacks - Bug fixes - Amended a new patch to fit the version 3.21 * ocki-3.21-remove-make-install-chgrp.patch - Removed the old patch for the version 3.20 * ocki-3.20-remove-make-install-chgrp.patch - Upgrade to version 3.22 (jsc#PED-3361) * openCryptoki 3.22 - CCA: Add support for the AES-XTS key type using CPACF protected keys - p11sak: Add support for managing certificate objects - p11sak: Add support for public sessions (no-login option) - p11sak: Add support for logging in as SO (security Officer) - p11sak: Add support for importing/exporting Edwards and Montgomery keys - p11sak: Add support for importing of RSA-PSS keys and certificates - CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different * Bug fixes - Amended the .spec file for pkcsslotd (jsc#1217703) * Renamed the patch ocki-3.21-remove-make-install-chgrp.patch to ocki-3.22-remove-make-install-chgrp.patch - provide user(pkcs11) and group(pkcs11) - Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361) * EP11: Add support for FIPS-session mode * Updates to harden against RSA timing attacks (bsc#1219217,CVE-2024-0914) * Bug fixes - Renamed ocki-3.22-remove-make-install-chgrp.patch to ocki-3.23-remove-make-install-chgrp.patch - Updated the .spec file (bsc#1225876, bsc#1227280) * Amended for group %{pkcs_group} and user pkcsslotd * Copying example script files from /usr/share/doc/opencryptoki to /usr/share/opencryptoki (policy-example.conf and strength-example.conf) in case that there is 'rpm.install.excludedocs=yes' set in the zypper.conf(zypp.conf) - improve handling of user/group. use existing user/group if they exist. create user/group if not (bsc#1225876) - Added ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch (bsc#1182120) Fix pkcscca migration fails with usr/sb2 is not a valid slot ID - Added ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch (bsc#1182190) Fix a segmentation fault of the sess_opstate test on the Soft Token - Added ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch When constructing an OpenSSL EC public or private key from PKCS#11 attributes or ECDH public data, check that the key is valid, i.e. that the point is on the curve. (bsc#1185976) - Added the following patches for bsc#1182726 " p11sak list-key segfault" * ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch Added NULL pointer to avoid double free() for the list-key and remove-key commands. * ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch Note that two hunks that were unrelated to fixing the running code were removed from this patch. * ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch - Added the following patches for bsc#1188879: * ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch When modifying opencryptoki.conf during token migration, put quotes around strings that contain spaces, e.g. for the slot description and manufacturer. * ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch When migrating a slot the opencryptoki.conf file is modified. If it contains slots that already contain the 'tokversion = x.y' keyword, this is accidentally removed when migrating another slot. * ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch Change the code to use the pid file that pkcsslotd creates, and check if the process with the pid contained in the pid file still exists and runs pkcsslotd. * ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch Always quote the value of 'description' and 'manufacturer'. Quote the value of 'stdll', 'confname', and 'tokname' if it contains spaces, and never quote the value of 'hwversion', 'firmwareversion', and 'tokversion'. - Upgraded to version 3.17.0 (jsc#SLE-18326) + openCryptoki 3.17 - tools: added function to list keys to p11sak - common: added support for OpenSSL 3.0 - common: added support for event notifications - ICA: added SW fallbacks * openCryptoki 3.16 - EP11: protected-key option - EP11: support attribute-bound keys - CCA: import and export of secure key objects - Bug fixes - Removed the following obsolete patches: ocki-3.15.1-Added-error-message-handling-for-p11sak-remove-key-c.patch ocki-3.15.1-Fix-compiling-with-c.patch ocki-3.15.1-A-slot-ID-has-nothing-to-do-with-the-number-of-slots.patch ocki-3.15.1-SOFT-Fix-problem-with-C_Get-SetOperationState-and-di.patch ocki-3.15.1-Added-NULL-pointer-to-avoid-double-free-for-the-list.patch ocki-3.15.1-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch ocki-3.15.1-Fixed-p11sak-and-corresponding-test-case.patch ocki-3.15.1-p11sak-Fix-CKA_LABEL-handling.patch ocki-3.15.1-pkcstok_migrate-Quote-strings-with-spaces-in-opencry.patch ocki-3.15.1-pkcstok_migrate-Don-t-remove-tokversion-x.y-during-m.patch ocki-3.15.1-pkcstok_migrate-Fix-detection-if-pkcsslotd-is-still-.patch ocki-3.15.1-pkcstok_migrate-Rework-string-quoting-for-opencrypto.patch - Added the following two patches for bac#1197395. The CKM_IBM_DILITHIUM mechanism does not show up as supported by the EP11 token when an upgraded EP11 host library is used. * openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch * openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch - Made the following changes for bsc#1199862 "Please install p11sak_defined_attrs.conf." * Replaced ocki-3.11-remove-make-install-chgrp.patch with ocki-3.17-remove-make-install-chgrp.patch to remove the "-g pkcs11" parameter from the install command in the Makefile * Updated the spec file to include /etc/opencryptoki/p11sak_defined_attrs.conf as a %config file with the necessary permissions and group ownership. - Added ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch for bsc#1202106. One test of the gen_purpose test cases fails with C_GetMechanismList #2 rc=CKR_BUFFER_TOO_SMALL" error on the EP11 Token. - Upgrade to version 3.19.0 (jsc#PED-616) + openCryptoki 3.19 - CCA: check for expected master key verification patterns at token init - CCA: check master key verification pattern of created keys to be as expected - EP11: check for expected wrapping key verification pattern at token init - EP11: check wrapping key verification pattern of created keys to be as expected - p11sak/pkcsconf: display PKCS#11 URIs - p11sak: add support for IBM specific Dilithium keys - p11sak: allow to list keys filtered by label - common: add support for dual-function cryptographic functions - Add support for C_SessionCancel function (PKCS#11 v3.0) - EP11: add support for schnorr signatures (mechanism CKM_IBM_ECDSA_OTHER) - EP11: add support for Bitcoin key derivation (mechanism CKM_IBM_BTC_DERIVE) - Bug fixes + openCryptoki 3.18 - Default to FIPS compliant token data format (tokversion = 3.12) - Add support for restricting usage of mechanisms and keys via a global policy - Add support for statistics counting of mechanism usage - ICA/EP11: Support libica version 4 - p11sak tool: Allow to set different attributes for public and private keys - Replaced ocki-3.17-remove-make-install-chgrp.patch with an updated version named ocki-3.19-remove-make-install-chgrp.patch to fit the current state of the source. - Removed the following obsolete patches: openCryptoki-sles15-sp4-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch openCryptoki-sles15-sp4-EP11-Fix-host-library-version-query.patch ocki-3.17-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch - Updated spec file to set permissions on /etc/opencryptoki/strength.conf to be owned by root:pkcs11 with permissions of 640. (bsc#1205566) - Updated the package openCryptoki 3.19.0 (jsc#PED-616, bsc#1207760), added the following patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch - Added patch for compile errors * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch -- Changed spec file to use %autosetup instead of %setup. - Updated package to openCryptoki 3.20 (bsc#1207760, jsc#PED-3376, jsc#PED-2870, jsc#PED-2869 ) - Removed the following obsolite patches: * ocki-3.19.0-0001-EP11-Unify-key-pair-generation-functions.patch * ocki-3.19.0-0002-EP11-Do-not-report-DSA-DH-parameter-generation-as-be.patch * ocki-3.19.0-0003-EP11-Do-not-pass-empty-CKA_PUBLIC_KEY_INFO-to-EP11-h.patch * ocki-3.19.0-0004-Mechtable-CKM_IBM_DILITHIUM-can-also-be-used-for-key.patch * ocki-3.19.0-0005-EP11-Remove-DSA-DH-parameter-generation-mechanisms-f.patch * ocki-3.19.0-0006-EP11-Pass-back-chain-code-for-CKM_IBM_BTC_DERIVE.patch * ocki-3.19.0-0007-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0008-EP11-Supply-CKA_PUBLIC_KEY_INFO-when-importing-priva.patch * ocki-3.19.0-0009-EP11-Fix-memory-leak-introduced-with-recent-commit.patch * ocki-3.19.0-0010-p11sak-Fix-segfault-when-dilithium-version-is-not-sp.patch * ocki-3.19.0-0011-EP11-remove-dead-code-and-unused-variables.patch * ocki-3.19.0-0012-EP11-Update-EP11-host-library-header-files.patch * ocki-3.19.0-0013-EP11-Support-EP11-host-library-version-4.patch * ocki-3.19.0-0014-EP11-Add-new-control-points.patch * ocki-3.19.0-0015-EP11-Default-unknown-CPs-to-ON.patch * ocki-3.19.0-0016-COMMON-Add-defines-for-Dilithium-round-2-and-3-varia.patch * ocki-3.19.0-0017-COMMON-Add-defines-for-Kyber.patch * ocki-3.19.0-0018-COMMON-Add-post-quantum-algorithm-OIDs.patch * ocki-3.19.0-0019-COMMON-Dilithium-key-BER-encoding-decoding-allow-dif.patch * ocki-3.19.0-0020-COMMON-EP11-Add-CKA_VALUE-holding-SPKI-PKCS-8-of-key.patch * ocki-3.19.0-0021-COMMON-EP11-Allow-to-select-Dilithium-variant-via-mo.patch * ocki-3.19.0-0022-EP11-Query-supported-PQC-variants-and-restrict-usage.patch * ocki-3.19.0-0023-POLICY-Dilithium-strength-and-signature-size-depends.patch * ocki-3.19.0-0024-TESTCASES-Test-Dilithium-variants.patch * ocki-3.19.0-0025-COMMON-EP11-Add-Kyber-key-type-and-mechanism.patch * ocki-3.19.0-0026-EP11-Add-support-for-generating-and-importing-Kyber-.patch * ocki-3.19.0-0027-EP11-Add-support-for-encrypt-decrypt-and-KEM-operati.patch * ocki-3.19.0-0028-POLICY-STATISTICS-Check-for-Kyber-KEM-KDFs-and-count.patch * ocki-3.19.0-0029-TESTCASES-Add-tests-for-CKM_IBM_KYBER.patch * ocki-3.19.0-0030-p11sak-Support-additional-Dilithium-variants.patch * ocki-3.19.0-0031-p11sak-Add-support-for-IBM-Kyber-key-type.patch * ocki-3.19.0-0032-testcase-Enhance-p11sak-testcase-to-generate-IBM-Kyb.patch * ocki-3.19.0-0033-EP11-Supply-CKA_PUBLIC_KEY_INFO-with-CKM_IBM_BTC_DER.patch * ocki-3.19.0-0034-EP11-Fix-setting-unknown-CPs-to-ON.patch * ocki-3.19.0-0035-Fix-compile-error-error-initializer-element-is-not-c.patch - Reworked ocki-3.19-remove-make-install-chgrp.patch to fit the current version of the package and renamed it to ocki-3.20-remove-make-install-chgrp.patch. - Update to version 3.21 (jsc#PED-3360, jsc#PED-3361) * openCryptoki 3.21 - EP11 and CCA: Support concurrent HSM master key changes - CCA: protected-key option - pkcsslotd: no longer run as root user and further hardening - p11sak: Add support for additional key types (DH, DSA, generic secret) - p11sak: Allow wildcards in label filter - p11sak: Allow to specify hex value for CKA_ID attribute - p11sak: Support sorting when listing keys - p11sak: New commands: set-key-attr, copy-key to modify and copy keys - p11sak: New commands: import-key, export-key to import and export keys - Remove support for --disable-locks (transactional memory) - Updates to harden against RSA timing attacks - Bug fixes - Amended a new patch to fit the version 3.21 * ocki-3.21-remove-make-install-chgrp.patch - Removed the old patch for the version 3.20 * ocki-3.20-remove-make-install-chgrp.patch - Upgrade to version 3.22 (jsc#PED-3361) * openCryptoki 3.22 - CCA: Add support for the AES-XTS key type using CPACF protected keys - p11sak: Add support for managing certificate objects - p11sak: Add support for public sessions (no-login option) - p11sak: Add support for logging in as SO (security Officer) - p11sak: Add support for importing/exporting Edwards and Montgomery keys - p11sak: Add support for importing of RSA-PSS keys and certificates - CCA/EP11/Soft/ICA: Ensure that the 2 key parts of an AES-XTS key are different * Bug fixes - Amended the .spec file for pkcsslotd (jsc#1217703) * Renamed the patch ocki-3.21-remove-make-install-chgrp.patch to ocki-3.22-remove-make-install-chgrp.patch - provide user(pkcs11) and group(pkcs11) - Upgrade openCryptoki to version 3.23 (jsc#PED-3360, jsc#PED-3361) * EP11: Add support for FIPS-session mode * Updates to harden against RSA timing attacks (bsc#1219217,CVE-2024-0914) * Bug fixes - Renamed ocki-3.22-remove-make-install-chgrp.patch to ocki-3.23-remove-make-install-chgrp.patch - Updated the .spec file (bsc#1225876, bsc#1227280) * Amended for group %{pkcs_group} and user pkcsslotd * Copying example script files from /usr/share/doc/opencryptoki to /usr/share/opencryptoki (policy-example.conf and strength-example.conf) in case that there is 'rpm.install.excludedocs=yes' set in the zypper.conf(zypp.conf) - improve handling of user/group. use existing user/group if they exist. create user/group if not (bsc#1225876) - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - Security fix: [CVE-2024-8443, bsc#1230364] * Disable deprecated declaration warnings caused by OpenSSL 3 (bsc#1217722) * opensc: heap buffer overflow in OpenPGP driver when generating key * Added patch: opensc-CVE-2024-8443.patch - Security fix: [opensc-CVE-2024-45620, bsc#1230076] - Security fix: [opensc-CVE-2024-45619, bsc#1230075] - Security fix: [opensc-CVE-2024-45618, bsc#1230074] - Security fix: [opensc-CVE-2024-45617, bsc#1230073] - Security fix: [opensc-CVE-2024-45616, bsc#1230072] - Security fix: [opensc-CVE-2024-45615, bsc#1230071] * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init * opensc: Incorrect handling length of buffers or files in libopensc * opensc: Incorrect handling of the length of buffers or files in pkcs15init * Added patches: - opensc-CVE-2024-45615.patch - opensc-CVE-2024-45616.patch - opensc-CVE-2024-45617.patch - opensc-CVE-2024-45618.patch - opensc-CVE-2024-45619.patch - opensc-CVE-2024-45620.patch - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - Security fix: [CVE-2024-8443, bsc#1230364] * Disable deprecated declaration warnings caused by OpenSSL 3 (bsc#1217722) * opensc: heap buffer overflow in OpenPGP driver when generating key * Added patch: opensc-CVE-2024-8443.patch - Security fix: [opensc-CVE-2024-45620, bsc#1230076] - Security fix: [opensc-CVE-2024-45619, bsc#1230075] - Security fix: [opensc-CVE-2024-45618, bsc#1230074] - Security fix: [opensc-CVE-2024-45617, bsc#1230073] - Security fix: [opensc-CVE-2024-45616, bsc#1230072] - Security fix: [opensc-CVE-2024-45615, bsc#1230071] * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init * opensc: Incorrect handling length of buffers or files in libopensc * opensc: Incorrect handling of the length of buffers or files in pkcs15init * Added patches: - opensc-CVE-2024-45615.patch - opensc-CVE-2024-45616.patch - opensc-CVE-2024-45617.patch - opensc-CVE-2024-45618.patch - opensc-CVE-2024-45619.patch - opensc-CVE-2024-45620.patch - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - Security fix: [CVE-2024-8443, bsc#1230364] * Disable deprecated declaration warnings caused by OpenSSL 3 (bsc#1217722) * opensc: heap buffer overflow in OpenPGP driver when generating key * Added patch: opensc-CVE-2024-8443.patch - Security fix: [opensc-CVE-2024-45620, bsc#1230076] - Security fix: [opensc-CVE-2024-45619, bsc#1230075] - Security fix: [opensc-CVE-2024-45618, bsc#1230074] - Security fix: [opensc-CVE-2024-45617, bsc#1230073] - Security fix: [opensc-CVE-2024-45616, bsc#1230072] - Security fix: [opensc-CVE-2024-45615, bsc#1230071] * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init * opensc: Incorrect handling length of buffers or files in libopensc * opensc: Incorrect handling of the length of buffers or files in pkcs15init * Added patches: - opensc-CVE-2024-45615.patch - opensc-CVE-2024-45616.patch - opensc-CVE-2024-45617.patch - opensc-CVE-2024-45618.patch - opensc-CVE-2024-45619.patch - opensc-CVE-2024-45620.patch - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - Security fix: [CVE-2024-8443, bsc#1230364] * Disable deprecated declaration warnings caused by OpenSSL 3 (bsc#1217722) * opensc: heap buffer overflow in OpenPGP driver when generating key * Added patch: opensc-CVE-2024-8443.patch - Security fix: [opensc-CVE-2024-45620, bsc#1230076] - Security fix: [opensc-CVE-2024-45619, bsc#1230075] - Security fix: [opensc-CVE-2024-45618, bsc#1230074] - Security fix: [opensc-CVE-2024-45617, bsc#1230073] - Security fix: [opensc-CVE-2024-45616, bsc#1230072] - Security fix: [opensc-CVE-2024-45615, bsc#1230071] * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init * opensc: Incorrect handling length of buffers or files in libopensc * opensc: Incorrect handling of the length of buffers or files in pkcs15init * Added patches: - opensc-CVE-2024-45615.patch - opensc-CVE-2024-45616.patch - opensc-CVE-2024-45617.patch - opensc-CVE-2024-45618.patch - opensc-CVE-2024-45619.patch - opensc-CVE-2024-45620.patch - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - make needed directories before running make install - update to version 0.13.0 - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - update to version 0.13.0 - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - update to version 0.14.0 - update to version 0.15.0 - register with p11-kit (https://www.opensc-project.org/opensc/ticket/390) - update to version 0.16.0 - remove fix (issue 505) - clean up spec-file - Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047). - Drop opensc-ADVISORIES. There is no new advisory since 2009. - Switch to tarball fetching from github - Few small cleanups - update to version 0.17.0: * support for new cards * PIN support enhancemets * added .pc file * builds with OpenSSL 1.1.0 (1074799) * See /usr/share/doc/packages/opensc/NEWS for complete list. - Update to version 0.18.0: * Further improvements of PIN support. * Large number of improvements and fixes (boo#1097951, boo#1100501). * See /usr/share/doc/packages/opensc/NEWS for complete list. - Add opensc-desktop.patch, opensc-desktop2.patch and opensc-bash-completions.patch. - Update to version 0.19.0 * Fixed multiple security problems (out of bound writes/reads): * bsc#1104812 * CVE-2018-16391 (bsc#1106998) * CVE-2018-16392 (bsc#1106999) * CVE-2018-16393 (bsc#1108318) * CVE-2018-16418 (bsc#1107039) * CVE-2018-16419 (bsc#1107107) * CVE-2018-16420 (bsc#1107097) * CVE-2018-16421 (bsc#1107049) * CVE-2018-16422 (bsc#1107038) * CVE-2018-16423 (bsc#1107037) * CVE-2018-16424 (bsc#1107036) * CVE-2018-16425 (bsc#1107035) * CVE-2018-16426 (bsc#1107034) * CVE-2018-16427 (bsc#1107033) * Workaround cards returning short signatures without leading zeroes * Distribute minimal opensc.conf * `pkcs11_enable_InitToken made` global configuration option * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver list instead of forcing one driver and skipping vital parts of configuration * Removed configuration options `zero_ckaid_for_ca_certs`, `force_card_driver`, `reopen_debug_file`, `paranoid-memory` * Generalized configuration option `ignored_readers` * If card initialization fails, continue card detection with other card drivers * reader-pcsc: allow fixing the length of a PIN * fixed crash during `C_WaitForSlotEvent` * Allow cancelling the PIN pad prompt before starting the reader transaction. Whether to start the transaction immediately or not is user-configurable for each application * opensc-notify * add Exit button to tray icon * User better description (GenericName) and a generic application icon * Do not display in the application list - Removed patches included upstream now: * opensc-desktop.patch * opensc-desktop2.patch * opensc-bash-completions.patch - Applied spec-cleaner - add explicit BuildRequires: zlib-devel - added opensc-0.19.0-rsa-pss.patch * Fixes the pkcs11-tool example * Added missing CKM_SHA224_RSA_PKCS_PSS * Add support for PSS padding to RSA signatures * Support for signature verification in pkcs11-tool * Switch cleanup steps to avoid segfaults on errors and more sanity checking - added opensc-0.19.0-redundant_logging.patch * Remove redundant debug output - added opensc-0.19.0-piv_card_matching.patch * Improve Card Matching for Dual CAC/PIV and PIVKEY cards. * sourced from https://github.com/OpenSC/OpenSC/pull/1549 - OpenSC 0.21.0: * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK smart card software driver (boo#1177380) * CVE-2020-26572: stack-based buffer overflow in the TCOS smart card software driver (boo#1177378) * CVE-2020-26570: heap-based buffer overflow in the Oberthur smart card software driver (boo#1177364) * CardOS 5.x support boo#1179291 * Support for OAEP encryption, make SHA256 default * New separate debug level for PIN commands * Fix handling of card/reader insertion/removal events in pcscd * Fixes of removed readers handling * Fix Firefox crash because of invalid pcsc context * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards * Propagate ignore_user_content to PKCS#11 layer not to confuse applications * Minidriver: Fix check of ATR length (2-to 33 characters inclusive) * pkcs11-tool: allow using SW tokens * opensc-explorer asn1 accepts offsets and decode records * opensc-explorer cat accepts records * OpenPGP: Add new ec curves supported by GNUK * First steps supporting OpenPGP 3.4 * OpenPGP: Add support for EC key import * Rutoken: Add ATR for Rutoken ECP SC NFC * Improve detection of various CardOS 5 configurations * DNIe: Add new DNIe CA structure for the secure channel * ePass2003: Improve ECC support * ePass2003: Fix erase sequence * IAS-ECC: Fix support for Idemia Cosmo cards * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available * IAS-ECC: Added PIN-pad support for PIN unblock * New driver for Gemalto IDPrime (only some types) * eDo: New driver with initial support for Polish eID card (e-dowód, eDO) * MCRD: Remove unused and broken RSA EstEID support * TCOS: Add missing encryption certificates * PIV: Add ATR of DOD Yubikey * fixed PIV global pin bug * CAC1: Support changing PIN with CAC Alt tokens - includes changes from 0.20.0 * CVE-2019-6502: memory leak in libopensc (boo#1122756) * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747) * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746) * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256) * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307) * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809) * Support RSA-PSS signature mechanisms using RSA-RAW * Added memory locking for secrets * added support for terminal colors * PC/SC driver: Fixed error handling in case of changing or removing the card reader * rename md_read_only to read_only and use it for PKCS#11 and Minidriver * allow global use of ignore_private_certificate * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects * PKCS#11: Truncate long PKCS#11 labels with ... * PKCS#11: Fixed recognition of a token when being unplugged and reinserted * Minidriver: Register for CardOS5 cards * Minidriver: Add support for RSA-PSS * tools: Harmonize the use of option -r/--reader * goid-tool: GoID personalization with fingerprint * openpgp-tool: replace the options -L/--key-length with -t/--key-type * openpgp-tool: add options -C/--card-info and -K/--key-info * opensc-explorer: add command pin_info, extend random * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11 * pkcd11-register: Autostart * opensc-tool: Show ATR also for cards not recognized by OpenSC * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values * pkcs11-tool: Support for signature verification via --verify * pkcs11-tool: Add object type secrkey for --type option * pkcs11-tool: Implement Secret Key write object * pkcs11-tool: Add GOSTR3410-2012 support * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP * pkcs11-tool: Add extractable option to key import * pkcs11-tool: list more key access flags when listing keys * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys * pkcs15-crypt: *Handle keys with user consent * New separate CAC1 driver using the old CAC specification (#1502) * CardOS: Add support for 4K RSA keys in CardOS 5 * CardOS: Fixed decryption with CardOS 5 * Enable CoolKey driver to handle 2048-bit keys * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 * GIDS Decipher fix (#1881) * GIDS: Allow RSA 4K support * MICARDO: Remove long expired EstEID 1.0/1.1 card support * MyEID: Add support for unwrapping a secret key with an RSA key or secret key * MyEID Add support for wrapping a secret key with a secret key * Support for MyEID 4K RSA * Support for OsEID * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys * OpenPGP Card v3 ECC support * Add Rutoken ECP SC * Add Rutoken Lite * Add SmartCard-HSM 4K ATR * Add missing secp384r1 curve parameter * Stacros: Fix decipher with 2.3 * Stacros: Add ATR for 2nd gen. eGK * Stacros: Add new ATR for 3.5 * Stacros: Detect and allow Globalplatform PIN encoding * Fix TCOS IDKey support * TCOS: add encryption certificate for IDKey * Infocamere, Postecert, Cnipa: Remove profiles * Remove incomplete acos5 driver - drop patches now upstream: * opensc-0.19.0-piv_card_matching.patch * opensc-0.19.0-redundant_logging.patch * opensc-0.19.0-rsa-pss.patch - move licenses to licensedir - Fix build on GCC11 * Add opensc-gcc11.patch from Fedora (https://github.com/OpenSC/OpenSC/pull/2241/) - Update to OpenSC 0.22.0: * Removed changes in opensc-gcc11.patch already present in upstream. - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda * Removed some false positives from the openrc-rpmlintrc file. * Use standard paths for file cache on Linux (#2148) and OSX (#2214) * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic) * Add threading test to `pkcs11-tool` (#2067) * Add support to generate generic secret keys (#2140) * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195) * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179). * Support for gcc11 and its new strict aliasing rules (#2241, #2260) * Initial support for building with OpenSSL 3.0 (#2343) * pkcs15-tool: Write data objects in binary mode (#2324) * Avoid limited size of log messages (#2352) * Support for ECDSA verification (#2211) * Support for ECDSA with different SHA hashes (#2190) * Prevent issues in p11-kit by not returning unexpected return codes (#2207) * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293) * Standardize the version 2 on 2.20 in the code (#2096) * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE (#2176) * Copy arguments of C_Initialize (#2350) * Fix RSA-PSS signing (#2234) * Fix DO deletion (#2215) * Add support for (X)EdDSA keys (#1960) * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205) * Add support for applet version 4 (#2332) * New configuration option for opensc.conf to disable pkcs1_padding (#2193) * Add support for ECDSA with different hashes (#2190) * Enable more mechanisms (#2178) * Fixed asking for a user pin when formatting a card (#1737) * Added support for French CPx Healthcare cards (#2217) * Added ATR for new CardOS 5.4 version (#2296) * Fixes security issues: * tcos: use after return (bsc#1192005, CVE-2021-42780) * oberthur: use after free (bsc#1191992, CVE-2021-42779) * oberthur: multiple heap buffer overflows (bsc#1192000, CVE-2021-42781) * multiple stack buffer overflow issues (bsc#1191957, CVE-2021-42782) - Security Fix: [CVE-2023-2977, bsc#1211894] * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package() * Add opensc-CVE-2023-2977.patch - Security Fix: [CVE-2023-40660, bsc#1215762] * opensc: PIN bypass when card tracks its own login state * Add patches: - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch - Security Fix: [CVE-2023-40661, bsc#1215761] * opensc: multiple memory issues with pkcs15-init (enrollment tool) * Add patches: - opensc-CVE-2023-40661-1of12.patch - opensc-CVE-2023-40661-2of12.patch - opensc-CVE-2023-40661-3of12.patch - opensc-CVE-2023-40661-4of12.patch - opensc-CVE-2023-40661-5of12.patch - opensc-CVE-2023-40661-6of12.patch - opensc-CVE-2023-40661-7of12.patch - opensc-CVE-2023-40661-8of12.patch - opensc-CVE-2023-40661-9of12.patch - opensc-CVE-2023-40661-10of12.patch - opensc-CVE-2023-40661-11of12.patch - opensc-CVE-2023-40661-12of12.patch - Security fix: [CVE-2023-5992, bsc#1219386] * Add patch: - opensc-CVE-2023-5992.patch - Do not depend on fillup and insserv if the package build with systemd support; the dependencies are not needed in that case - remove convenience code as changes bytes in the message buffer breaking the verification code [bnc#994989] new patch: openslp.noconvenience.diff - fix storage handling in predicate code, it clashed with gcc's fortify_source extension [bnc#909195] new patch: openslp.predicatestorage.diff - bring back allowDoubleEqualInPredicate option new patch: openslp.doubleequal.diff - fix bug in openslp.initda.diff patch - fix rcopenslp helper - fix _xrealloc not checking the malloc return value [bnc#980722] [CVE-2016-4912] new patch: openslp.xrealloc.diff - Fix bounds check in SLPFoldWhiteSpace [bnc#1001600] [CVE-2016-7567] new patch: openslp.foldws.diff - Replace pkgconfig(libsystemd-*) with pkgconfig(libsystemd) Nowadays pkgconfig(libsystemd) replaces all libsystemd-* libs, which are obsolete. - Also update openslp.sd_notify.diff to use the new systemd lib - Add support for OpenSSL 1.1. Commit from upstream [bsc#1042665] new patch: openslp.openssl-1.1.diff - add separate source openslp.logrotate.systemd to use systemctl reload for logrotate configuration - Use %license (boo#1082318) - fix slpd using the peer address as local address for TCP connections [bnc#1076035] new patch: openslp.localaddr.diff - use tcp connections for unicast requests [bnc#1080964] new patch: openslp.tcpunicast.diff - move systemd notification before the chroot() call, otherwise the notify function cannot reach systend's unix domain socket [bnc#1089097] - Fix memory corruption when the sendbuf gets reallocated [bnc#1090638] [CVE-2017-17833] new patch: openslp.sendbuf_move.diff - Fix out of bounds reads in message parsing new patch: openslp.parseoob.diff - Use tcp connects to talk with other DAs [bnc#1117969] new patch: openslp.tcpknownda.diff - Fix segfault in predicate match if a registered service has a malformed attribute list [bnc#1136136] new patch: openslp.nullattr.diff - Add missing zlib build dependency, which used to be pulled in by libopenssl-devel. The package fails to build since the openssl upgrade to 1.1.1 (bsc#1149792) - Add missing group(daemon) prerequires to the openslp-server package [bnc#1165050] - Add missing openslp requires to the openslp-server package [bnc#1165121] - Implement automatic active discovery retries so that DAs do not get dropped if they are not reachable for some time [bnc#1166637] [bnc#1184008] new patch: openslp.unicastactivediscovery.diff - Do not depend on fillup and insserv if the package build with systemd support; the dependencies are not needed in that case - remove convenience code as changes bytes in the message buffer breaking the verification code [bnc#994989] new patch: openslp.noconvenience.diff - fix storage handling in predicate code, it clashed with gcc's fortify_source extension [bnc#909195] new patch: openslp.predicatestorage.diff - bring back allowDoubleEqualInPredicate option new patch: openslp.doubleequal.diff - fix bug in openslp.initda.diff patch - fix rcopenslp helper - fix _xrealloc not checking the malloc return value [bnc#980722] [CVE-2016-4912] new patch: openslp.xrealloc.diff - Fix bounds check in SLPFoldWhiteSpace [bnc#1001600] [CVE-2016-7567] new patch: openslp.foldws.diff - Replace pkgconfig(libsystemd-*) with pkgconfig(libsystemd) Nowadays pkgconfig(libsystemd) replaces all libsystemd-* libs, which are obsolete. - Also update openslp.sd_notify.diff to use the new systemd lib - Add support for OpenSSL 1.1. Commit from upstream [bsc#1042665] new patch: openslp.openssl-1.1.diff - add separate source openslp.logrotate.systemd to use systemctl reload for logrotate configuration - Use %license (boo#1082318) - fix slpd using the peer address as local address for TCP connections [bnc#1076035] new patch: openslp.localaddr.diff - use tcp connections for unicast requests [bnc#1080964] new patch: openslp.tcpunicast.diff - move systemd notification before the chroot() call, otherwise the notify function cannot reach systend's unix domain socket [bnc#1089097] - Fix memory corruption when the sendbuf gets reallocated [bnc#1090638] [CVE-2017-17833] new patch: openslp.sendbuf_move.diff - Fix out of bounds reads in message parsing new patch: openslp.parseoob.diff - Use tcp connects to talk with other DAs [bnc#1117969] new patch: openslp.tcpknownda.diff - Fix segfault in predicate match if a registered service has a malformed attribute list [bnc#1136136] new patch: openslp.nullattr.diff - Add missing zlib build dependency, which used to be pulled in by libopenssl-devel. The package fails to build since the openssl upgrade to 1.1.1 (bsc#1149792) - Add missing group(daemon) prerequires to the openslp-server package [bnc#1165050] - Add missing openslp requires to the openslp-server package [bnc#1165121] - Implement automatic active discovery retries so that DAs do not get dropped if they are not reachable for some time [bnc#1166637] [bnc#1184008] new patch: openslp.unicastactivediscovery.diff - frontport SLE11 patches: * add hardMTU option to limit the datagram package size to 1400 bytes [bnc#648384]. patch: openslp.hardmtu.diff * fix double free in SLPDKnownDAAdd error case [bnc#667953] patch: openslp.knowndafree.diff * fix libslp socket handling, check if socket is still alive and fix socket close code [bnc#693756] patch: openslp.loopbacksocket.diff * make openslpd reconnect to DAs if they closed the connection [bnc#723385] patch: openslp.slpdreconnect.diff * fixup lifetime of registrations a bit so that they don't get removed too early [bnc#658972] patch: openslp.lifetime.diff - update to openslp-2.0.0 to get IPv6 support * dropped patches: v1dadiscovery.diff, openslp.clrflags.diff openslp.fixdsareturn.diff, openslp.dereg.diff, openslp.tcpclearovr.diff, openslp.lifetime.diff, slptool-timeout.diff, openslp.poll.diff, openslp.ignorespaces.diff, openslp.checkovr.diff, openslp.fixaddrcheck.diff, openslp.loopbacksocket.diff, openslp.diff, openslp.doubleequal.diff, openslp.discovery.diff, openslp.parseext.diff, openslp.knowndafree.diff, openslp.emptyanswer.diff, openslp.v1sladdr.diff, hppa.diff * renamed patches: openslp-1.2.0-visibility.patch -> openslp.visibility.diff openslp-1.2.0-daemon.diff -> openslp.daemon.diff openslp.use-TCPDIAG-for-checking-listeners -> openslp.netlink.diff openslp-ocloexec.patch -> openslp.cloexec.diff - always use localtime in the log file [bnc#855385] patch: openslp.localtime.diff - use tcp to connect to the local SA patch: openslp.tcplocal.diff - drop unused mdns support - rename README.SuSE to README.SUSE - use AI_CANONNAME when looking up the canonical name - openslp.sd_notify.diff make slpd systemd service of type notify instead of simple, to avoid startup races. - Do not apply previous patch to distros without systemd. - Limit init script usage only to legacy products. - fix last commit - Do not depend on fillup and insserv if the package build with systemd support; the dependencies are not needed in that case - remove convenience code as changes bytes in the message buffer breaking the verification code [bnc#994989] new patch: openslp.noconvenience.diff - fix storage handling in predicate code, it clashed with gcc's fortify_source extension [bnc#909195] new patch: openslp.predicatestorage.diff - bring back allowDoubleEqualInPredicate option new patch: openslp.doubleequal.diff - fix bug in openslp.initda.diff patch - fix rcopenslp helper - fix _xrealloc not checking the malloc return value [bnc#980722] [CVE-2016-4912] new patch: openslp.xrealloc.diff - Fix bounds check in SLPFoldWhiteSpace [bnc#1001600] [CVE-2016-7567] new patch: openslp.foldws.diff - Replace pkgconfig(libsystemd-*) with pkgconfig(libsystemd) Nowadays pkgconfig(libsystemd) replaces all libsystemd-* libs, which are obsolete. - Also update openslp.sd_notify.diff to use the new systemd lib - Add support for OpenSSL 1.1. Commit from upstream [bsc#1042665] new patch: openslp.openssl-1.1.diff - add separate source openslp.logrotate.systemd to use systemctl reload for logrotate configuration - Use %license (boo#1082318) - fix slpd using the peer address as local address for TCP connections [bnc#1076035] new patch: openslp.localaddr.diff - use tcp connections for unicast requests [bnc#1080964] new patch: openslp.tcpunicast.diff - move systemd notification before the chroot() call, otherwise the notify function cannot reach systend's unix domain socket [bnc#1089097] - Fix memory corruption when the sendbuf gets reallocated [bnc#1090638] [CVE-2017-17833] new patch: openslp.sendbuf_move.diff - Fix out of bounds reads in message parsing new patch: openslp.parseoob.diff - Use tcp connects to talk with other DAs [bnc#1117969] new patch: openslp.tcpknownda.diff - Fix segfault in predicate match if a registered service has a malformed attribute list [bnc#1136136] new patch: openslp.nullattr.diff - Add missing zlib build dependency, which used to be pulled in by libopenssl-devel. The package fails to build since the openssl upgrade to 1.1.1 (bsc#1149792) - Add missing group(daemon) prerequires to the openslp-server package [bnc#1165050] - Add missing openslp requires to the openslp-server package [bnc#1165121] - Implement automatic active discovery retries so that DAs do not get dropped if they are not reachable for some time [bnc#1166637] [bnc#1184008] new patch: openslp.unicastactivediscovery.diff - Do not depend on fillup and insserv if the package build with systemd support; the dependencies are not needed in that case - remove convenience code as changes bytes in the message buffer breaking the verification code [bnc#994989] new patch: openslp.noconvenience.diff - fix storage handling in predicate code, it clashed with gcc's fortify_source extension [bnc#909195] new patch: openslp.predicatestorage.diff - bring back allowDoubleEqualInPredicate option new patch: openslp.doubleequal.diff - fix bug in openslp.initda.diff patch - fix rcopenslp helper - fix _xrealloc not checking the malloc return value [bnc#980722] [CVE-2016-4912] new patch: openslp.xrealloc.diff - Fix bounds check in SLPFoldWhiteSpace [bnc#1001600] [CVE-2016-7567] new patch: openslp.foldws.diff - Replace pkgconfig(libsystemd-*) with pkgconfig(libsystemd) Nowadays pkgconfig(libsystemd) replaces all libsystemd-* libs, which are obsolete. - Also update openslp.sd_notify.diff to use the new systemd lib - Add support for OpenSSL 1.1. Commit from upstream [bsc#1042665] new patch: openslp.openssl-1.1.diff - add separate source openslp.logrotate.systemd to use systemctl reload for logrotate configuration - Use %license (boo#1082318) - fix slpd using the peer address as local address for TCP connections [bnc#1076035] new patch: openslp.localaddr.diff - use tcp connections for unicast requests [bnc#1080964] new patch: openslp.tcpunicast.diff - move systemd notification before the chroot() call, otherwise the notify function cannot reach systend's unix domain socket [bnc#1089097] - Fix memory corruption when the sendbuf gets reallocated [bnc#1090638] [CVE-2017-17833] new patch: openslp.sendbuf_move.diff - Fix out of bounds reads in message parsing new patch: openslp.parseoob.diff - Use tcp connects to talk with other DAs [bnc#1117969] new patch: openslp.tcpknownda.diff - Fix segfault in predicate match if a registered service has a malformed attribute list [bnc#1136136] new patch: openslp.nullattr.diff - Add missing zlib build dependency, which used to be pulled in by libopenssl-devel. The package fails to build since the openssl upgrade to 1.1.1 (bsc#1149792) - Add missing group(daemon) prerequires to the openslp-server package [bnc#1165050] - Add missing openslp requires to the openslp-server package [bnc#1165121] - Implement automatic active discovery retries so that DAs do not get dropped if they are not reachable for some time [bnc#1166637] [bnc#1184008] new patch: openslp.unicastactivediscovery.diff - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Fix build breakage caused by missing security key objects: + Modify openssh-7.7p1-cavstest-ctr.patch. + Modify openssh-7.7p1-cavstest-kdf.patch. + Add openssh-link-with-sk.patch. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Support /usr/etc/pam.d - Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes occasional crashes on connection termination caused by accessing freed memory. - update to 8.4p1: Security ======== * ssh-agent(1): restrict ssh-agent from signing web challenges for FIDO/U2F keys. * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating a FIDO resident key. * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for each use. These keys may be generated using ssh-keygen using a new "verify-required" option. When a PIN-required key is used, the user will be prompted for a PIN to complete the signature operation. New Features - ----------- * sshd(8): authorized_keys now supports a new "verify-required" option to require FIDO signatures assert that the token verified that the user was present before making the signature. The FIDO protocol supports multiple methods for user-verification, but currently OpenSSH only supports PIN verification. * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn signatures. Webauthn is a standard for using FIDO keys in web browsers. These signatures are a slightly different format to plain FIDO signatures and thus require explicit support. * ssh(1): allow some keywords to expand shell-style ${ENV} environment variables. The supported keywords are CertificateFile, ControlPath, IdentityAgent and IdentityFile, plus LocalForward and RemoteForward when used for Unix domain socket paths. bz#3140 * ssh(1), ssh-agent(1): allow some additional control over the use of ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling and disabling its use. bz#69 * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time limit for keys in addition to its current flag options. Time- limited keys will automatically be removed from ssh-agent after their expiry time has passed. * scp(1), sftp(1): allow the -A flag to explicitly enable agent forwarding in scp and sftp. The default remains to not forward an agent, even when ssh_config enables it. * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of the destination. This allows, e.g., keeping host keys in individual files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654 * ssh(1): add %-TOKEN, environment variable and tilde expansion to the UserKnownHostsFile directive, allowing the path to be completed by the configuration (e.g. bz#1654) * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted from stdin. bz#3180 * sshd(8): improve logging for MaxStartups connection throttling. sshd will now log when it starts and stops throttling and periodically while in this state. bz#3055 Bugfixes - ------- * ssh(1), ssh-keygen(1): better support for multiple attached FIDO tokens. In cases where OpenSSH cannot unambiguously determine which token to direct a request to, the user is now required to select a token by touching it. In cases of operations that require a PIN to be verified, this avoids sending the wrong PIN to the wrong token and incrementing the token's PIN failure counter (tokens effectively erase their keys after too many PIN failures). * sshd(8): fix Include before Match in sshd_config; bz#3122 * ssh(1): close stdin/out/error when forking after authentication completes ("ssh -f ...") bz#3137 * ssh(1), sshd(8): limit the amount of channel input data buffered, avoiding peers that advertise large windows but are slow to read from causing high memory consumption. * ssh-agent(1): handle multiple requests sent in a single write() to the agent. * sshd(8): allow sshd_config longer than 256k * sshd(8): avoid spurious "Unable to load host key" message when sshd load a private key but no public counterpart * ssh(1): prefer the default hostkey algorithm list whenever we have a hostkey that matches its best-preference algorithm. * sshd(1): when ordering the hostkey algorithms to request from a server, prefer certificate types if the known_hosts files contain a key marked as a @cert-authority; bz#3157 * ssh(1): perform host key fingerprint comparisons for the "Are you sure you want to continue connecting (yes/no/[fingerprint])?" prompt with case sensitivity. * sshd(8): ensure that address/masklen mismatches in sshd_config yield fatal errors at daemon start time rather than later when they are evaluated. * ssh-keygen(1): ensure that certificate extensions are lexically sorted. Previously if the user specified a custom extension then the everything would be in order except the custom ones. bz#3198 * ssh(1): also compare username when checking for JumpHost loops. bz#3057 * ssh-keygen(1): preserve group/world read permission on known_hosts files across runs of "ssh-keygen -Rf /path". The old behaviour was to remove all rights for group/other. bz#3146 * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen manual page and usage(). * sshd(8): explicitly construct path to ~/.ssh/rc rather than relying on it being relative to the current directory, so that it can still be found if the shell startup changes its directory. bz#3185 * sshd(8): when redirecting sshd's log output to a file, undo this redirection after the session child process is forked(). Fixes missing log messages when using this feature under some circumstances. * sshd(8): start ClientAliveInterval bookkeeping before first pass through select() loop; fixed theoretical case where busy sshd may ignore timeouts from client. * ssh(1): only reset the ServerAliveInterval check when we receive traffic from the server and ignore traffic from a port forwarding client, preventing a client from keeping a connection alive when it should be terminated. bz#2265 * ssh-keygen(1): avoid spurious error message when ssh-keygen creates files outside ~/.ssh * sftp-client(1): fix off-by-one error that caused sftp downloads to make one more concurrent request that desired. This prevented using sftp(1) in unpipelined request/response mode, which is useful when debugging. bz#3054 * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect() helpers. bz#3071 * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to write to it so we don't leave an empty .ssh directory when it's not needed. bz#3156 * ssh(1), sshd(8): fix multiplier when parsing time specifications when handling seconds after other units. bz#3171 - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - sysusers-sshd.conf: use sysusers.d configuration file to create sshd user (avoid hard dependency on shadow). - Make sure sshd is enabled correctly when upgrading from a pre-systemd distribution (bsc#1180083). - Add openssh-reenable-dh-group14-sha1-default.patch, which adds diffie-hellman-group14-sha1 key exchange back to the default list (bsc#1180958). This is needed for backwards compatibility with older platforms. - Improve robustness of sshd init detection when upgrading from a pre-systemd distribution. - Add openssh-fix-ssh-copy-id.patch, which fixes breakage introduced in 8.4p1 (bsc#1181311). - Add openssh-7.6p1-audit_race_condition.patch, fixing sshd termination of multichannel sessions with non-root users (error on 'mm_request_receive_expect') (bsc#1115550, bsc#1174162). - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which attempts to mitigate instances of secrets lingering in memory after a session exits. (bsc#1213004 bsc#1213008) - Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch (bsc#1190975, CVE-2021-41617), backported from upstream by Ali Abdallah. - Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137, CVE-2021-28041), from upstream. - Add openssh-do-not-send-empty-message.patch: Prevent empty messages from being sent. This avoids a superfluous new line (bsc#1192439). - Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh connections update their dbus environment (bsc#1179465). - Revert addition of openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: This caused invalid and irrelevant environment assignments (bsc#1207014). - openssh-7.7p1-fips_checks.patch: close the right filedescriptor to avoid fd leads, and also close fdh in read_hmac (bsc#1209536) - Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if requested to load a PKCS#11 provider that isnt a PKCS#11 provider (bsc#1213504,CVE-2023-38408) - Enhanced SELinux functionality. Added * openssh-7.8p1-role-mls.patch Proper handling of MLS systems and basis for other SELinux improvements * openssh-6.6p1-privsep-selinux.patch Properly set contexts during privilege separation * openssh-6.6p1-keycat.patch Add ssh-keycat command to allow retrival of authorized_keys on MLS setups with polyinstantiation * openssh-6.6.1p1-selinux-contexts.patch Additional changes to set the proper context during privilege separation * openssh-7.6p1-cleanup-selinux.patch Various changes and putting the pieces together For now we don't ship the ssh-keycat command, but we need the patch for the other SELinux infrastructure This change fixes issues like bsc#1214788, where the ssh daemon needs to act on behalf of a user and needs a proper context for this - Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795). This mitigates a prefix truncation attack that could be used to undermine channel security. - Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385). This limits the use of shell metacharacters in host- and user names. - Fix hostbased ssh login failing occasionally with "signature unverified: incorrect signature" by fixing a typo in patch (bsc#1221123): * openssh-7.8p1-role-mls.patch - Add patches openssh-7.7p1-seccomp_getuid.patch and openssh-bsc1216474-s390-leave-fds-open.patch (bsc#1216474, bsc#1218871) - Add patches from upstream to change the default value of UpdateHostKeys to Yes (unless VerifyHostKeyDNS is enabled). This makes ssh update the known_hosts stored keys with all published versions by the server (after it's authenticated with an existing key), which will allow to identify the server with a different key if the existing key is considered insecure at some point in the future (bsc#1222831). * 0001-upstream-enable-UpdateHostkeys-by-default-when-the.patch * 0002-upstream-disable-UpdateHostkeys-by-default-if.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Add a missing dependency on jitterentropy-devel for libopenssl-1_1-devel [bsc#1202148] - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Return the correct indicator for a given EC group order bits * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Consider RSA siggen/sigver with PKCS1 padding also approved * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - FIPS: Service-level indicator [bsc#1190651] * Mark PBKDF2 with key shorter than 112 bits as non-approved * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - POWER10 performance enhancements for cryptography [jsc#PED-512] * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch * openssl-1_1-Fixed-counter-overflow.patch * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Timing Oracle in RSA Decryption * Add patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207538, CVE-2022-4450] * Double free after calling PEM_read_bio_ex() * Add patches: - openssl-CVE-2022-4450-1of2.patch - openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Security Fix: [bsc#1207536, CVE-2023-0215] * Use-after-free following BIO_new_NDEF() * Add patches: - openssl-CVE-2023-0215-1of4.patch - openssl-CVE-2023-0215-2of4.patch - openssl-CVE-2023-0215-3of4.patch - openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207533, CVE-2023-0286] * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address * Add openssl-CVE-2023-0286.patch - FIPS: Serialize jitterentropy calls [bsc#1207994] * Add openssl-1_1-serialize-jitterentropy-calls.patch - FIPS: Service-level indicator [bsc#1208998] * Add additional check required by FIPS 140-3. Minimum values for PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for iteration count and 20 characters for password. * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - Security Fix: [CVE-2023-0464, bsc#1209624] * Excessive Resource Usage Verifying X.509 Policy Constraints * Add openssl-CVE-2023-0464.patch - Security Fix: [CVE-2023-0465, bsc#1209878] * Invalid certificate policies in leaf certificates are silently ignored * Add openssl-CVE-2023-0465.patch - Security Fix: [CVE-2023-0466, bsc#1209873] * Certificate policy check not enabled * Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-2650, bsc#1211430] * Possible DoS translating ASN.1 object identifiers * Add openssl-CVE-2023-2650.patch - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch - Security Fix: [bsc#1207534, CVE-2022-4304] * Reworked the Fix for the Timing Oracle in RSA Decryption The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case compared to 1.1.1s. * Add openssl-CVE-2022-4304.patch * Removed patches: - openssl-CVE-2022-4304-1of2.patch - openssl-CVE-2022-4304-2of2.patch * Refreshed patches: - openssl-CVE-2023-0464.patch - openssl-CVE-2023-0465.patch - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Dont pass zero length input to EVP_Cipher because assembler optimized AES cannot handle zero size. [bsc#1213517] * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: (bsc#1213853, CVE-2023-3817) * Fix excessive time spent checking DH q parameter value (bsc#1213853, CVE-2023-3817). The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped. * Add openssl-1_1-CVE-2023-3817.patch - Displays "fips" in the version string (bsc#1215215) * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: [bsc#1216922, CVE-2023-5678] * Fix excessive time spent in DH check / generation with large Q parameter value. * Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. * Add openssl-CVE-2023-5678.patch - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1222548, CVE-2024-2511] * Fix unconstrained session cache growth in TLSv1.3 * Add openssl-CVE-2024-2511.patch - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free security vulnerability. Calling the function SSL_free_buffers() potentially caused memory to be accessed that was previously freed in some situations and a malicious attacker could attempt to engineer a stituation where this occurs to facilitate a denial-of-service attack. [CVE-2024-4741, bsc#1225551] - Security fix: [bsc#1227138, CVE-2024-5535] * SSL_select_next_proto buffer overread * Add openssl-CVE-2024-5535.patch - Build with no-afalgeng [bsc#1226463] - Security fix: [bsc#1220262, CVE-2023-50782] * Implicit rejection in PKCS#1 v1.5 * Add openssl-CVE-2023-50782.patch - Added the following patches for bsc#1097463 * openssl-ibmca-sles15-Switch-to-ibmca.so-filename-to-allow-a-standalone-us.patch * openssl-ibmca-sles15-Fix-lib-name-in-test-code.patch * openssl-ibmca-sles15-Update-lib-name-in-documentation.patch - Upgraded to version 2.0.0 (Fate#325688) * openssl-ibmca 2.0.0 Add ECC support. Add check and distcheck make-targets. Project cleanup, code was broken into multiple files and coding style cleanup. Improvements to compat macros for openssl. Don't disable libica sw fallbacks. Fix dlclose logic. * openssl-ibmca 1.4.1 Fix structure size for aes-256-ecb/cbc/cfb/ofb Update man page Switch to ibmca.so filename to allow standalone use Switch off Libica fallback mode if available Make sure ibmca_init only runs once Provide simple macro for DEBUG_PRINTF possibility Cleanup and slight rework of function set_supported_meths - Did some cleanup to the spec file, based on spec-cleanup. - Removed the following obsolete patches: * openssl-ibmca-sles15-Switch-to-ibmca.so-filename-to-allow-a-standalone-us.patch * openssl-ibmca-sles15-Fix-lib-name-in-test-code.patch * openssl-ibmca-sles15-Update-lib-name-in-documentation.patch - Upgraded to version 2.0.1 (Fate#325688) * openssl-ibmca 2.0.1 Dont fail when a libica symbol cannot be resolved. - Made multiple changes to the spec file based on spec-cleaner output. - Upgraded to version 2.0.2 (Fate#325688) * openssl-ibmca 2.0.2 Fix doing rsa-me, altough rsa-crt would be possible. - Added openssl-ibmca-sles15sp1-Move-ERR_load-unload-to-bind_helper-resp-destroy-fun.patch An Apache HTTP Server was set up with mod_ssl and the openssl ibmca engine using libica and a CEX6A card. Whenever a worker process is cleaned up a segmentation fault occurs. (bsc#1138517) - Upgraded to version 2.0.3 (jsc#SLE-6123, jsc#SLE-6424) * openssl-ibmca 2.0.3 Add MSA9 CPACF support for ECDSA sign/verify - Dropped obsolete openssl-ibmca-sles15sp1-Move-ERR_load-unload-to-bind_helper-resp-destroy-fun.patch - Changed the ExclusiveArch directive to include s390x only. - The code in e_ibmca.c does a dlopen for libica.so.3, instead of linking against the shared library. As a result, if the package containing libica.so.3 isn't installed, problems occur. Added a "Requires: libica3" to the spec file to fix this. (bsc#1142286) - Made a couple of changes to the spec file based on the output from spec-cleaner. - Upgrade to version 2.1.0 (jsc#SLE-7852, jsc#SLE-7882) Add MSA9 CPACF support for X25519, X448, Ed25519 and Ed448 - Upgrade to version 2.1.1 (jsc#SLE-13709) * Bug fixes - Upgraded to version 2.2.1 (jsc#SLE-18333) * openssl-ibmca 2.2.1 Bug fixes * openssl-ibmca 2.2.0 Implement fallbacks based on OpenSSL Disable software fallbacks from libica Allow to specify default library (libica vs. libica-cex) to use Provide "libica" engine ctrl to switch library at load time Update README.md Remove libica link dependency Generate sample configuration files from system configuration Restructure registration global data * openssl-ibmca 2.1.3 Bug fix * openssl-ibmca 2.1.2 Bug fixes - Modified spec file to * Define a global variable enginesdir the same was as IBM does instead of _ENGINE_DIR as we had been doing. * Implemented %make_build macro according to spec-cleaner * Changed the package description to match IBM's. * Removed the redundant "autoreconf --force --install" - Completely revamped the postinstall scriptlet so that it doesn't need to know or care about how many lines are in either /etc/ssl/openssl.cnf, or the sample file at /usr/share/doc/packages/openssl-ibmca/openssl.cnf.sample We're now using the ".include" directive for the openssl.cnf file, and only modifying that file the minimum necessary to implement the change. (bsc#1004463) - Upgraded to version 2.3.1 (jsc#PED-597) * openssl-ibmca 2.3.1 - Adjustments for libica 4.1.0 * openssl-ibmca 2.3.0 - First version including the provider - Fix for engine build without OpenSSL 3.0 sources * openssl-ibmca 2.2.3 - Fix PKEY segfault with OpenSSL 3.0 * openssl-ibmca 2.2.2 - Fix tests with OpenSSL 3.0 - Build against libica 4.0 - Removed a Requires for libica from the specfile. - Removed the obsolete baselibs.conf file - Updated .spec file removed '#' from the line containing 'sed -e 's/^dynamic_path/#dynamic_path/' (bsc#1209038) - Added in %files * /usr/lib64/engines-3/ibmca-provider.la * /usr/lib64/engines-3/ibmca-provider.so - Upgraded openssl-ibmca to version 2.4.0 (bsc#1210059) * openssl-ibmca 2.4.0 - Provider: Adjustments for OpenSSL versions 3.1 and 3.2 - Provider: Support RSA blinding - Provider: Constant-time fixes for RSA PKCS#1 v1.5 and OAEP padding - Provider: Support "implicit rejection" option for RSA PKCS#1 v1.5 padding - Provider: Adjustments in OpenSSL config generator and example configs - Engine: EC: Cache ICA key in EC_KEY object (performance improvement) - Engine: Enable RSA blinding - Applies a patch (bsc#1210359) * openssl-ibmca-engine-noregister.patch - Updated the '#dynamic_path' line, as it was before, with the comment '#'. - Added dependency on libica4 (bsc#1209038) * BuildRequires and Requires statements in .spec file for libica4 - Updated the .spec file as follow: * BuildRequires: libica-devel >= 4.0.0 * BuildRequires: libica-tools >= 4.0.0 - Updated the .spec file * uses a flag openssl3 (1 or 0) to include or not the openssl3 libraries - Add multibuild flavor to provide library compiled against openssl-3 [bsc#1207472] - Adjust dlopen() for the new ibmca-openssl3.so for the multibuild flavor. This allows to install in parallel a version compiled against openssl 1.1.1 and another with openssl 3.0. [bsc#1207472] - Adjust configure and Makefile to require libica-openssl3 when building wiht openssl3 flavor. [bsc#1207472] * Add openssl3-rename-libica-files.patch - Added the following patches for bsc#1097463 * openssl-ibmca-sles15-Switch-to-ibmca.so-filename-to-allow-a-standalone-us.patch * openssl-ibmca-sles15-Fix-lib-name-in-test-code.patch * openssl-ibmca-sles15-Update-lib-name-in-documentation.patch - Upgraded to version 2.0.0 (Fate#325688) * openssl-ibmca 2.0.0 Add ECC support. Add check and distcheck make-targets. Project cleanup, code was broken into multiple files and coding style cleanup. Improvements to compat macros for openssl. Don't disable libica sw fallbacks. Fix dlclose logic. * openssl-ibmca 1.4.1 Fix structure size for aes-256-ecb/cbc/cfb/ofb Update man page Switch to ibmca.so filename to allow standalone use Switch off Libica fallback mode if available Make sure ibmca_init only runs once Provide simple macro for DEBUG_PRINTF possibility Cleanup and slight rework of function set_supported_meths - Did some cleanup to the spec file, based on spec-cleanup. - Removed the following obsolete patches: * openssl-ibmca-sles15-Switch-to-ibmca.so-filename-to-allow-a-standalone-us.patch * openssl-ibmca-sles15-Fix-lib-name-in-test-code.patch * openssl-ibmca-sles15-Update-lib-name-in-documentation.patch - Upgraded to version 2.0.1 (Fate#325688) * openssl-ibmca 2.0.1 Dont fail when a libica symbol cannot be resolved. - Made multiple changes to the spec file based on spec-cleaner output. - Upgraded to version 2.0.2 (Fate#325688) * openssl-ibmca 2.0.2 Fix doing rsa-me, altough rsa-crt would be possible. - Added openssl-ibmca-sles15sp1-Move-ERR_load-unload-to-bind_helper-resp-destroy-fun.patch An Apache HTTP Server was set up with mod_ssl and the openssl ibmca engine using libica and a CEX6A card. Whenever a worker process is cleaned up a segmentation fault occurs. (bsc#1138517) - Upgraded to version 2.0.3 (jsc#SLE-6123, jsc#SLE-6424) * openssl-ibmca 2.0.3 Add MSA9 CPACF support for ECDSA sign/verify - Dropped obsolete openssl-ibmca-sles15sp1-Move-ERR_load-unload-to-bind_helper-resp-destroy-fun.patch - Changed the ExclusiveArch directive to include s390x only. - The code in e_ibmca.c does a dlopen for libica.so.3, instead of linking against the shared library. As a result, if the package containing libica.so.3 isn't installed, problems occur. Added a "Requires: libica3" to the spec file to fix this. (bsc#1142286) - Made a couple of changes to the spec file based on the output from spec-cleaner. - Upgrade to version 2.1.0 (jsc#SLE-7852, jsc#SLE-7882) Add MSA9 CPACF support for X25519, X448, Ed25519 and Ed448 - Upgrade to version 2.1.1 (jsc#SLE-13709) * Bug fixes - Upgraded to version 2.2.1 (jsc#SLE-18333) * openssl-ibmca 2.2.1 Bug fixes * openssl-ibmca 2.2.0 Implement fallbacks based on OpenSSL Disable software fallbacks from libica Allow to specify default library (libica vs. libica-cex) to use Provide "libica" engine ctrl to switch library at load time Update README.md Remove libica link dependency Generate sample configuration files from system configuration Restructure registration global data * openssl-ibmca 2.1.3 Bug fix * openssl-ibmca 2.1.2 Bug fixes - Modified spec file to * Define a global variable enginesdir the same was as IBM does instead of _ENGINE_DIR as we had been doing. * Implemented %make_build macro according to spec-cleaner * Changed the package description to match IBM's. * Removed the redundant "autoreconf --force --install" - Completely revamped the postinstall scriptlet so that it doesn't need to know or care about how many lines are in either /etc/ssl/openssl.cnf, or the sample file at /usr/share/doc/packages/openssl-ibmca/openssl.cnf.sample We're now using the ".include" directive for the openssl.cnf file, and only modifying that file the minimum necessary to implement the change. (bsc#1004463) - Upgraded to version 2.3.1 (jsc#PED-597) * openssl-ibmca 2.3.1 - Adjustments for libica 4.1.0 * openssl-ibmca 2.3.0 - First version including the provider - Fix for engine build without OpenSSL 3.0 sources * openssl-ibmca 2.2.3 - Fix PKEY segfault with OpenSSL 3.0 * openssl-ibmca 2.2.2 - Fix tests with OpenSSL 3.0 - Build against libica 4.0 - Removed a Requires for libica from the specfile. - Removed the obsolete baselibs.conf file - Updated .spec file removed '#' from the line containing 'sed -e 's/^dynamic_path/#dynamic_path/' (bsc#1209038) - Added in %files * /usr/lib64/engines-3/ibmca-provider.la * /usr/lib64/engines-3/ibmca-provider.so - Upgraded openssl-ibmca to version 2.4.0 (bsc#1210059) * openssl-ibmca 2.4.0 - Provider: Adjustments for OpenSSL versions 3.1 and 3.2 - Provider: Support RSA blinding - Provider: Constant-time fixes for RSA PKCS#1 v1.5 and OAEP padding - Provider: Support "implicit rejection" option for RSA PKCS#1 v1.5 padding - Provider: Adjustments in OpenSSL config generator and example configs - Engine: EC: Cache ICA key in EC_KEY object (performance improvement) - Engine: Enable RSA blinding - Applies a patch (bsc#1210359) * openssl-ibmca-engine-noregister.patch - Updated the '#dynamic_path' line, as it was before, with the comment '#'. - Added dependency on libica4 (bsc#1209038) * BuildRequires and Requires statements in .spec file for libica4 - Updated the .spec file as follow: * BuildRequires: libica-devel >= 4.0.0 * BuildRequires: libica-tools >= 4.0.0 - Updated the .spec file * uses a flag openssl3 (1 or 0) to include or not the openssl3 libraries - Add multibuild flavor to provide library compiled against openssl-3 [bsc#1207472] - Adjust dlopen() for the new ibmca-openssl3.so for the multibuild flavor. This allows to install in parallel a version compiled against openssl 1.1.1 and another with openssl 3.0. [bsc#1207472] - Adjust configure and Makefile to require libica-openssl3 when building wiht openssl3 flavor. [bsc#1207472] * Add openssl3-rename-libica-files.patch - ppc64.patch: Add support for PowerPC64 - altivec.patch: Fix altivec implementation of cmpltf and cmplef operations - Reenable check on ppc and ppc64 - Update to version 0.4.17: + Merged known distro patches. + Added MIPS backend. + Disabled ARM backend because of poor coverage. + Added bytecode parsing and writing. This can be used instead of manual creation of OrcPrograms. - Drop altivec.patch and ppc64.patch: fixed upstream. - Update to version 0.4.18: + Important bugfix in reading constants from bytecode. + Documentation and code cleanup. + Fix cache flushing on iOS. - Update to version 0.4.21 + Fix memory leaks + Fix list corruption when splitting code memory chunks, causing crashes when allocating a lot of code memory and trying to free it later + Various compiler warnings, coverity warnings and static code analysis fixes + Documentation fix for mulhsw, mulhuw - Add orc-disable-test-limits.patch to disable test-limits test, it only works on x86-64 - Update to version 0.4.22: + Handle NOCONFIGURE=1 in autogen.sh. + Some memory leak fixes in the compiler. + Fixes for compiler warnings on Win64. + Properly detect CPU features on Android in non-debug build. + Use Android logging system instead of stderr for debug output. - Temp-disable testsuite on i586 until we get the random fails sorted out with upstream. - Drop orc-disable-test-limits.patch, and autoreconf call, and corresponding BuildRequires, as testsuite is disabled, and patch needing them is dropped. - Add xz BuildRequires for openSUSE < 11.3 (and thus also SLE11). - Fix version dependency for gtk-doc (min 1.12). - Disable building of gtk-doc for SLE11, where this version of gtk-doc is not available (by means of bcond_with/without). The pre-built documentation, as shipped in the tarball will be installed in this case. - Update to version 0.4.23: + Various improvements to the NEON backend to bring it closer to the SSE backend. + Add support for setting a custom backup function. + Preserve NEON/VFP registers across subroutines. + Fix 64 bit parameter loading on big-endian systems. + Improved implementations for various opcodes. + Various improvements and fixes to constants handling. + Avoid some undefined operations on signed integers. + Prefer user specific directories over global ones for intermediate files to prevent name collisions. - disable make check for ppc64le archi would need changes in orcprogram-altivec.c and define of HAVE_POWERPC - Update to version 0.4.24: + Only reuse constants of the same size and value. + Fix reading of .orc files with Windows line endings on Windows. + Fix out of bounds array access in the tests. + Remove duplicate code path in orcc. + Put a limit to the memcpy test. + Fix mmap leak on error path. - disable testsuite on aarch64 - Update to version 0.4.25: + compiler: also prefer the backup function when no target, instead of trying to use emulation which is usually slower. + executor: fix load of parameters smaller than 64 bits, fixing crashes on ldresnearb and friends in emulated code. + test-limits: improve test without target. + Only check for Android's liblog on Android targets, so we don't accidentally pick up another liblog that may exist elsewhere. + Don't require libtool for uninstalled setups (-uninstalled pkg-config file). + Make -Bsymbolic check in configure work with clang. + Coverity code analyser fixes. + docs: update generated opcode tables. + Add orc_version_string() function and make orcc check the liborc that is being picked up to make sure the right lib is being used. - Update to version 0.4.26: + Use 64 bit arithmetic to increment the stride if needed. + Fix generation of ModR/M / SIB bytes for the EBP, R12, R13 registers on X86/X86-64. + Fix test_parse unit test if no executable backend is available. + Add orc-test path to the -uninstalled .pc file. + Fix compiler warnings in the tests on OS X. - Add pkgconfig(glib-2.0) BuildRequires, the build looks for it. - Remove obsolete bconds, they were only there for now obsolete versions of openSUSE. - Drop explicit xz BuildRequires: No longer needed. - Enable testsuite for all arches again. - Disable make check for all arches except x86_64 again. - Update to version 0.4.27: + sse: preserve non volatile sse registers, needed for MSVC. + x86: don't hard-code register size to 0 in orc_x86_emit_*() funcs. + Fix incorrect asm generation on 64-bit Windows with MSVC. + Add support for building using the Meson build system. - Switch to the meson build system, which knows how to cope with GTK 1.26+: + Use the tarball published on github (the automake bootstrapped one does not contain the meson build system). + Add meson BuildRequires and switch configure/make/make_install macros to the relevant meson/meson_build/meson_install variants. - Update to version 0.4.28: + Numerous undefined behaviour fixes. + Ability to disable tests. + Fix meson dist behaviour. - Add relax-tests.patch to increase test timeouts to 2 minutes, also limit the max value for memcpy_speed.c test bsc#1130085 - Backport patch from upstream to fix a stack-based buffer overflow in the Orc compiler when formatting error messages (bsc#1228184, CVE-2024-40897): * 0001-Use-vasprintf-if-available-for-error-messages-and.patch * 0002-Fix-build.patch - bsc#1202827 - Fail to deploy sle15sp5 guest via virt-install with osinfo add-sle15sp5-support.patch - Update to database version 20220830 osinfo-db-20220830.tar.xz - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Update to database version 20221018 osinfo-db-20221018.tar.xz - Update to database version 20221130 osinfo-db-20221130.tar.xz - Add support for SLE Micro 5.4 add-slem5.4-support.patch - Fix <derives-from id> value add-slem5.3-support.patch - Update to database version 20230308 osinfo-db-20230308.tar.xz - Update to database version 20230518 osinfo-db-20230518.tar.xz - Update to database version 20230719 osinfo-db-20230719.tar.xz - Add support for SLE 15-SP6 add-sle15sp6-support.patch - Add support for SLE Micro 5.5 add-slem5.5-support.patch - Drop patches contained in new tarball add-opensuse-leap-15.5-support.patch add-sle15sp5-support.patch add-slem5.3-support.patch add-slem5.4-support.patch - Update to database version 20231027 (jsc#PED-6305) osinfo-db-20231027.tar.xz - Update to database version 20231215 (jsc#PED-6305) osinfo-db-20231215.tar.xz - Add support for openSUSE Leap 15.6 (jsc#PED-6305) add-opensuse-leap-15.6-support.patch - Add support for SLE Micro 6.0 (jsc#PED-6305) add-slem6.0-support.patch - bsc#1222738 - virt-manager shows SLE Micro 6.0 in suggested OS version should be SL Micro 6.0 add-slm6.0-support.patch Drop add-slem6.0-support.patch - Update to database version 20240510 osinfo-db-20240510.tar.xz - bsc#1227116 - osinfo still uses deprecated SL-Micro name Reverse prior decision to drop the use of "Enterprise" in the name of the SUSE Linux Micro product. add-slem6.0-support.patch Drop add-slm6.0-support.patch - Adjust some default hardware requirements (bsc#1227231) adjust-tumbleweed-hardware-requirements.patch add-opensuse-leap-15.6-support.patch add-sle15sp6-support.patch - Update to database version 20240701 osinfo-db-20240701.tar.xz - Update the release dates in the definitions for the following products openSUSE leap 15.6, SLE 15-SP6, SLEM 5.5, SLEM 6.0 - Add support for openSUSE Leap 15.7 (jsc#PED-8910) add-opensuse-leap-15.7-support.patch - Add support for SLE-15-SP7 (jsc#PED-8910) (bsc#1230160) add-sle15sp7-support.patch - Add support for SLE Micro 6.1 (jsc#PED-8910) add-slem6.1-support.patch - Drop support for Leap 15.7. Next major version is Leap 16 add-opensuse-leap-15.7-support.patch - Adjust place holder release-date for sle15sp7 add-sle15sp7-support.patch - bsc#1202827 - Fail to deploy sle15sp5 guest via virt-install with osinfo add-sle15sp5-support.patch - Update to database version 20220830 osinfo-db-20220830.tar.xz - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Update to database version 20221018 osinfo-db-20221018.tar.xz - Update to database version 20221130 osinfo-db-20221130.tar.xz - Add support for SLE Micro 5.4 add-slem5.4-support.patch - Fix <derives-from id> value add-slem5.3-support.patch - Update to database version 20230308 osinfo-db-20230308.tar.xz - Update to database version 20230518 osinfo-db-20230518.tar.xz - Update to database version 20230719 osinfo-db-20230719.tar.xz - Add support for SLE 15-SP6 add-sle15sp6-support.patch - Add support for SLE Micro 5.5 add-slem5.5-support.patch - Drop patches contained in new tarball add-opensuse-leap-15.5-support.patch add-sle15sp5-support.patch add-slem5.3-support.patch add-slem5.4-support.patch - Update to database version 20231027 (jsc#PED-6305) osinfo-db-20231027.tar.xz - Update to database version 20231215 (jsc#PED-6305) osinfo-db-20231215.tar.xz - Add support for openSUSE Leap 15.6 (jsc#PED-6305) add-opensuse-leap-15.6-support.patch - Add support for SLE Micro 6.0 (jsc#PED-6305) add-slem6.0-support.patch - bsc#1222738 - virt-manager shows SLE Micro 6.0 in suggested OS version should be SL Micro 6.0 add-slm6.0-support.patch Drop add-slem6.0-support.patch - Update to database version 20240510 osinfo-db-20240510.tar.xz - bsc#1227116 - osinfo still uses deprecated SL-Micro name Reverse prior decision to drop the use of "Enterprise" in the name of the SUSE Linux Micro product. add-slem6.0-support.patch Drop add-slm6.0-support.patch - Adjust some default hardware requirements (bsc#1227231) adjust-tumbleweed-hardware-requirements.patch add-opensuse-leap-15.6-support.patch add-sle15sp6-support.patch - Update to database version 20240701 osinfo-db-20240701.tar.xz - Update the release dates in the definitions for the following products openSUSE leap 15.6, SLE 15-SP6, SLEM 5.5, SLEM 6.0 - Add support for openSUSE Leap 15.7 (jsc#PED-8910) add-opensuse-leap-15.7-support.patch - Add support for SLE-15-SP7 (jsc#PED-8910) (bsc#1230160) add-sle15sp7-support.patch - Add support for SLE Micro 6.1 (jsc#PED-8910) add-slem6.1-support.patch - Drop support for Leap 15.7. Next major version is Leap 16 add-opensuse-leap-15.7-support.patch - Adjust place holder release-date for sle15sp7 add-sle15sp7-support.patch - Update to edk2-stable202111 - Features (https://github.com/tianocore/edk2/releases): Add SSDT CPU topology generator Support ACPI 6.4 in GTDT parser and generator Support ACPI 6.4 in DynamicTables FADT parser Support ACPI 6.4 in Acpiview PCCT parser Support ACPI 6.4 in Acpiview HMAT parser Add support for the microvm machine type (qemu) OVMF/ArmVirt: add support for virtio-mmio 1.0 IntelFsp2Pkg: adopt FSP 2.3 specification UefiCpuPkg VTF0 X64: Build page tables using Linear-Address Translation to a 1-GByte Page Enable wildcard host name matching in HTTPS/TLS implementation Add QuickSort function into BaseLib Add SMM NV variable support in universal UEFI payload Add TDVF to OvmfPkg Make package and platform builds reproducible across source format changes - Patches (git log --oneline --reverse edk2-stable202108~..edk2-stable202111): 7b4a99be8a CryptoPkg: BaseCryptLib fix incorrect param order 82f7e315d6 MdeModulePkg/PeiCore: Remove MigrateSecModulesInFv() 8b15024dc7 Maintainers: Add kraxel as Reviewer to ArmVirtPkg and OvmfPkg 80e67af9af OvmfPkg: introduce a common work area ab77b6031b OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b2 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm a82bad9730 ArmPkg/GicV3Dxe: Don't signal EOI on arbitrary interrupts 94e465e5cb OvmfPkg/Virtio10: Add virtio-mmio 1.0 defines 08293e43da OvmfPkg/VirtioMmioDeviceLib: Add virtio 1.0 detection. 212a2b9bb8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Fix SetPageSize. 537a724421 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Fix SetQueueAddress 6a3e9576b8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Add default QueueNum ae12188cf8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Adapt feature bit handling 77d5fa8024 OvmfPkg/VirtioMmioDeviceLib: enable virtio 1.0 b04453d36b MdeModulePkg/EbcDxe: Mitigate memcpy intrinsics dc995ce906 MdeModulePkg: Add BootDiscoveryPolicyOld variable. 443300be46 MdePkg:Update IndustryStandard/Nvme.h with Nvme amdin controller data 0f11537548 MdeModulePkg:Increase Nvme capacity display cae735f613 ArmPkg: Enable boot discovery policy for ARM package. cb0d24637d OvmfPkg/OvmfXen: set PcdAcpiS3Enable at initialization 28152333bc OvmfPkg/LockBoxLib: use PcdAcpiS3Enable to detect S3 support 52e2dabc0f OvmfPkg/PlatformBootManagerLib: use PcdAcpiS3Enable to detect S3 support 5b5f10d746 OvmfPkg/SmmControl2Dxe: use PcdAcpiS3Enable to detect S3 support 9f3eda177a OvmfPkg/OvmfXen: add QemuKernelLoaderFsDxe f0fe55bca4 UefiPayloadPkg: Fix the build error when enable Core ci for UefiPayloadPkg 5d34cc49d5 UefiCpuPkg/PiSmmCpuDxeSmm: Update mPatchCetSupported set condition cdda3f74a1 UefiPayloadPkg/UefiPayloadEntry: Fix memory corruption 3b3f882288 MdeModulePkg/PiSmmCore: Drop deprecated image profiling commands b170806518 UefiCpuPkg: Clean up save state boundary checks and comments. 12e33dca4c IntelFsp2Pkg: Support Config File and Binary delta comparison 63fddc98e0 UefiPayloadPkg: Create .yaml file in UefiPayloadPkg e3ee8c8dbd .azurepipelines: Add UefiPayloadPkg in gate-build-job.yml and CISetting.py b6bc203375 MdeModulePkg/HiiDatabaseDxe:remove dead code block c5e805ffe1 MdeModulePkg: Fix typo of "memory" in RamDiskDxe debug message 81d71fb86e Maintainers.txt: Update maintainer/reviewer roles in MdeModulePkg edf8bc6d24 SecurityPkg/MemoryOverwriteControl: Add missing argument to DEBUG print 4473834e7d OvmfPkg/OvmfXen: Fix build with QemuKernelLoaderFsDxe a7cf2c5664 RedfishPkg: Fix various typos 851785ea67 UefiPayloadPkg: Include more modules in UefiPayloadPkg. d248516b3a UefiPayloadPkg: Include Network modules in UefiPayloadPkg. 6c7d6d4a5e UefiCpuPkg: ResetVector Tool Support for Python 3 cf7c650592 UefiCpuPkg: ResetVector Tool additional debug prints d96df7e993 UefiPayloadPkg: Fix the bug in dump guid HOB info functions dcd3d63f4f UefiPayloadPkg: Dump hob info from gEdkiiBootManagerMenuFileGuid 610d8073f2 SecurityPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from edk2-platforms 4d5f39cd22 SecurityPkg/TPM: Fix bugs in imported PeiDxeTpmPlatformHierarchyLib ebbc8ab2cd SecrutiyPkg/Tcg: Import Tcg2PlatformDxe from edk2-platforms 2906e572c6 SecurityPkg/Tcg: Make Tcg2PlatformDxe buildable and fix style issues f108178c56 SecurityPkg: Introduce new PCD PcdRandomizePlatformHierarchy a4867dea2a SecurityPkg/Tcg: Import Tcg2PlatformPei from edk2-platforms 2fa89c8e11 SecurityPkg/Tcg: Make Tcg2PlatformPei buildable and fix style issues 3b69fcf5f8 SecurityPkg: Add references to header and inf files to SecurityPkg 6c80564b89 MdeModulePkg/Core/Pei: Fix typo in function descriptions 6f501a7c9b MdeModulePkg/Core/Pei: Make migrated PEIM message verbose c19d18136e MdeModulePkg/Core/Pei: Fix pointer size mismatch in EvacuateTempRam() f4e72cf9d6 UefiPayloadPkg: Add script to build UniversalPayload in UefiPayloadPkg bda3546c55 UefiPayloadPkg: Fix the warning when building UefiPayloadPkg with IA32+X64 010753b7e7 UefiCpuPkg: Refactor initialization of CPU features during S3 resume 89f7ed8b29 UefiCpuPkg: Prevent from re-initializing CPU features during S3 resume 60d8bb9f28 UefiCpuPkg: VTF0 Linear-Address Translation to a 1-GByte Page till 512GB ac6388add4 ArmPkg/ProcessorSubClassDxe: Fix the format of ProcessorId e3e47d7963 UefiCpuPkg: SecCoreNative without ResetVector 542cba73d2 SecurityPkg: Add debug log for indicating IBB verified OBB successfully f334c5a41d IntelFsp2WrapperPkg: Make PcdFspModeSelection dynamic 79019c7a42 OvmfPkg: set a default value for the WorkAreaHeader PCD fdeff3fdae EmbeddedPkg: Remove duplicate libfdt.h include f2a7e24e38 EmbeddedPkg: AndroidBootImgBoot error handling updates c0cd26f43c EmbeddedPkg: Install FDT if UpdateDtb is not present 7ea7f9c077 EmbeddedPkg: Add LoadFile2 for linux initrd d60915b751 UefiPayloadPkg: Add Macro to enable or disable some drivers. 46b4606ba2 MdeModulePkg/PciBusDxe: Improve the flow of testing support attributes f57040b038 MdeModulePkg/BootManagerMenuApp: Limit string drawing within one line b0f1b1c5fd MdePkg: Fix DEVICE_SECURITY_EVENT_DATA_HEADER version definition cc5a67269e UefiPayloadPkg: Build a HOB from bootloader ACPI table dc430ccf3f UefiPayloadPkg: Use dummy constructor for PlatformHookLib 4a1899dd79 UefiPayloadPkg: Add ".upld_info" in universal payload 2ea0a0a414 BaseTools: Switch to downloading the ARM compiler from Arm's site 1ce6ceb75b BaseTools: Switch to downloading the AARCH64 compiler from Arm's site c214128a38 BaseTools/GenMake: Use ToolDefinition as fallback option 259c184c8f BaseTools/build: Set MakefileName 445c39f757 BaseTools: Remove Makefile/MakefileName fields c7d5b046d9 BaseTools: Remove hard-coded strings for target and tools_def 442e46d3b6 UefiPayloadPkg: Update maximum logic processor to 256 499c4608b1 OvmfPkg/TPM PPI: Connect default consoles for user interaction b8675deaa8 OvmfPkg: Handle TPM 2 physical presence opcodes much earlier 8ab8fbc016 OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compilation bd298d7593 OvmfPkg: Reference new Tcg2PlatformPei in the build system f86de75862 MdePkg: MmCommunication: Added definition of MM Communication PPI 8b4bb94f64 MdePkg: CI YAML: Added new GUID to ignore duplicate list 9e950cda6a MdeModulePkg: CI YAML: Added new GUID to ignore duplicate list 2273799677 SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start 422e5d2f7f UefiPayloadPkg: Remove asm code and sharing libraries 0875443f7e DynamicTablesPkg: Extract AcpiHelperLib from TableHelperLib 20775950c6 DynamicTablesPkg: Update TableHelperLib.inf 1ad5182500 DynamicTablesPkg: Rename single char input parameter 653113412f DynamicTablesPkg: Add HexFromAscii() to AcpiHelperLib 72ab552554 DynamicTablesPkg: Add AmlGetEisaIdFromString() to AcpiHelperLib 96e006b37e DynamicTablesPkg: Add Configuration Manager Object parser 235ff9fcd1 DynamicTablesPkg: Use %a formatter in AmlDbgPrint 7a8c037e9e DynamicTablesPkg: Update DynamicTablesPkg.ci.yaml 691c5f7762 DynamicTablesPkg: Deprecate Crs specific methods in AmlLib 22873f58c4 DynamicTablesPkg: Rework AmlResourceDataCodegen.c/h 4cc1458dbe IntelFsp2Pkg: Adopt FSP 2.3 specification. c49cb8f30e ArmPkg: SmbiosMiscDxe: Don't populate ExtendedBiosSize when size < 16MB 282122ec5f ArmVirtPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib b3685956d2 ArmVirtPkg: Reference new TPM classes in the build system for compilation c806b76865 ArmVirtPkg: Disable the TPM2 platform hierarchy 606340fba3 OvmfPkg/Microvm: copy OvmfPkgX64 files as-is 4932f05a00 OvmfPkg/Microvm: rename output files, fix includes 2a49c19b9e OvmfPkg/Microvm: no smm 60d55c4156 OvmfPkg/Microvm: no secure boot 0569c52b15 OvmfPkg/Microvm: no tpm 06fa1f1931 OvmfPkg/Microvm: no sev 6073bf6cd8 OvmfPkg/Microvm: no csm b9dd64b80e OvmfPkg/Microvm: no emulated scsi 27de86ae41 OvmfPkg/Microvm: use MdePkg/Library/SecPeiDxeTimerLibCpu 76602f45dc OvmfPkg/Microvm: use XenTimerDxe (lapic timer) 6a8e9ad24b OvmfPkg/Microvm: PlatformPei/MemDetect tweaks 8583b57c5c OvmfPkg/Microvm: PlatformPei/Platform memory map tweaks bf02d73e74 OvmfPkg/Microvm: PlatformPei/Platform: add id. 1d3e89f349 OvmfPkg/ResetSystemLib: add driver for microvm 2c467c9be2 OvmfPkg/Microvm: BdsPlatform: PciAcpiInitialization tweak. 8456785986 OvmfPkg/Microvm: use PciHostBridgeLibNull 55f47d2299 OvmfPkg/Microvm: wire up serial console, drop super-io 862e814de4 OvmfPkg/Microvm: add Maintainers.txt entry 06a326caf1 DynamicTablesPkg: Update FADT generator to ACPI 6.4 f09dbf20b9 DynamicTablesPkg: Rename SBSA generic watchdog 942c9bd357 ShellPkg: Update Acpiview GTDT parser to ACPI 6.4 80e67bcb23 ShellPkg: Update Acpiview PCCT parser to ACPI 6.4 b4da6c29f1 ShellPkg: Add Type 5 PCC Subspace Structure parser 5ece2ad36c MdeModulePkg/Core/Dxe: Add lock protection in CoreLocateHandleBuffer() 30400318a2 ShellPkg: Update Acpiview HMAT parser to ACPI spec version 6.4 71c3c9c0c4 DynamicTablesPkg: Remove unnecessary includes 25cf58a163 DynamicTablesPkg: Add missing parameter check bfaf7c8b9e DynamicTablesPkg: Add AddSsdtAcpiHeader() 28b2df475f DynamicTablesPkg: Add AmlRdSetEndTagChecksum() 74addfeab6 DynamicTablesPkg: Add AmlSetRdListCheckSum() 7b2022d39e DynamicTablesPkg: Set EndTag's Checksum if RdList is modified 2dd7dd3952 DynamicTablesPkg: Clear pointer in node creation fcts 37bd08176c DynamicTablesPkg: Update error handling for node creation 6d2777d85f DynamicTablesPkg: Make AmlNodeGetIntegerValue public f995f8672b DynamicTablesPkg: AML Code generation for Register() 9454d1ebcb DynamicTablesPkg: AML Code generation for Resource data EndTag 1e33479b39 DynamicTablesPkg: AML code generation for a Package 12e65fd258 DynamicTablesPkg: Helper function to compute package length ce15936f2f DynamicTablesPkg: AML code generation for a ResourceTemplate de62ccbf4f DynamicTablesPkg: AML code generation for a Method e2d7b4950b DynamicTablesPkg: AML code generation to Return a NameString 3e958e93ce DynamicTablesPkg: AML code generation for a Method returning a NS 018a962d92 DynamicTablesPkg: AML code generation for a _LPI object a5e36ad9bc DynamicTablesPkg: AML code generation to add an _LPI state f17ef10e63 DynamicTablesPkg: Add CM_ARM_LPI_INFO object 769e63999f DynamicTablesPkg: SSDT CPU topology and LPI state generator 19ee56c4b3 UefiPayloadPkg: Add a macro to select the SecurityStubDxe driver. 782d018703 MdePkg: Add ProcessorUpgradeSocketLGA4677 from SMBIOS 3.5.0 ba4ae92234 ShellPkg: Support ProcessorUpgradeSocketLGA4677 from SMBIOS 3.5.0 f22feb0e3b CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in Pkcs7Verify() 4225a464c6 MdePkg/BaseLib: Add QuickSort function on BaseLib 6ed6abd6c1 BaseTools: Change RealPath to AbsPath 978d428ec3 UefiPayloadPkg: Add PCI root bridge info hob support for SBL 43b3840873 MdeModulePkg/Sd: Corrections for Extra.uni files a7fcab7aa3 MdeModulePkg/Core/Dxe: Acquire a lock when iterating gHandleList e40fefafa9 ArmVirtPkg/FdtClintDxe: Move FdtClientDxe to EmbeddedPkg fb759b8b73 MdePkg: Add PcdPciIoTranslation PCD 7d78a86ecf ArmPkg: Use PcdPciIoTranslation PCD from MdePkg 77e9b3a7c6 ArmVirtPkg/FdtPciPcdProducerLib: Relocate PciPcdProducerLib to OvmfPkg d881c6ddf5 ArmVirtPkg/HighMemDxe: Relocate HighMemDxe to OvmfPkg 47bd85e9f9 OvmfPkg/HighMemDxe: Add RISC-V in the supported arch. f8d0501ded ArmVirtPkg/QemuFwCfgLib: Relocate QemuFwCfgLib to OvmfPkg 26aa241d2f OvmfPkg/QemuFwCfgLibMmio: Add RISC-V arch support c6770f4b88 MdePkg: Add PcdPciMmio32(64)Translation PCDs 9a7509e465 ArmVirtPkg/FdtPciHostBridgeLib: Relocate FdtPciHostBridgeLib to OvmfPkg/Fdt b21c6794de OvmfPkg/FdtPciHostBridgeLib: Add RISC-V in the supported arch. e0c23cba5e ArmVirtPkg/VirtioFdtDxe: Relocate VirtioFdtDxe to OvmfPkg/Fdt f2400e06db BaseTools: add edk2-test repo to SetupGit.py 785cfd3305 UefiPayloadPkg: Use SECURITY_STUB_ENABLE to control the SecurityStubDxe 7e43d3e086 ArmPkg/Smbios: Fix max cache size 2 wrong issue f10a112f08 UefiPayloadPkg: Fix the build issue for coreboot 2108698346 StandaloneMmPkg: Support CLANGPDB builds 11a4af85a4 Ovmfpkg: update Ia32 build to use new work area 36b561623a OvmfPkg/AmdSev: update the fdf to use new workarea PCD 91a978ce7e UefiPayloadPkg: Replace MEMROY_ENTRY by MEMORY_ENTRY 6ef5797447 UefiPayloadPkg: Fix ECC reported issues 90246a6d9f UefiPayloadPkg: Fix the build failure for non-universal payload 37a33f02aa UefiCpuPkg: Cpu feature data stored in memory may be migrated 4fdf843c75 DynamicTablesPkg: Fix unitialized variable use 6893865b30 DynamicTablesPkg: Fix void pointer arithmetic 99325a8b65 MdeModulePkg/SortLib: Add QuickSort function on BaseLib 305fd6bee0 UefiCpuPkg/CpuCacheInfoLib: Add QuickSort function on BaseLib 2f286930a8 ShellPkg: Parse I/O APIC and x2APIC structure bd5ec03d87 NetworkPkg/HttpBootDxe: make file extension check case-insensitive 6254037223 ArmPkg: Implement PlatformBootManagerLib for LinuxBoot f079e9b450 OvmfPkg: Copy Main.asm from UefiCpuPkg to OvmfPkg's ResetVector 5a2411784b OvmfPkg: Clear WORK_AREA_GUEST_TYPE in Main.asm c9ec74a198 OvmfPkg: Add IntelTdxMetadata.asm 8b76f23534 OvmfPkg: Enable TDX in ResetVector 87a34ca0cf UefiPayloadPkg: Add a common SmmAccessDxe module e7e8ea27d4 UefiPayloadPkg: Add a common SMM control Runtime DXE module bed990aae6 UefiPayloadPkg: Add bootloader SMM support module 1d66480aa4 UefiPayloadPkg: Add SpiFlashLib 04714cef46 UefiPayloadPkg: Add FlashDeviceLib ae8acce8ae UefiPayloadPkg: Add a common FVB SMM module 242dcfe30f UefiPayloadPkg: Add a SMM dispatch module b80c17b62d UefiPayloadPkg: Add SMM support and SMM variable support 2f6f3329ad FmpDevicePkg/FmpDxe: Use new Variable Lock interface 9a95d11023 IntelFsp2Pkg/SplitFspBin.py: adopt FSP 2.3 specification. bb146ce32d MdePkg Cpuid.h: Define CPUID.(EAX=7,ECX=0):EDX[30] 1bc232aae3 RedfishPkg: Update link to staging/RedfishClientPkg in Readme.md e7663fdd82 UefiPayloadPkg: Remove SystemTableInfo GUID. 91b772ab62 RedfishPkg: Add more information to Readme.md c8594a5311 SecurityPkg/FvReportPei: Remove the ASSERT to allow neither M nor V 939c2355da IntelFsp2Pkg SplitFspBin.py: Correct file name in file header 6f9e83f757 NetworkPkg/HttpDxe: Enable wildcard host name matching for HTTP+TLS. b258f12889 BaseTools/VrfCompile: Fix uninitialized field from unnamed field 0f4cdad25b DynamicTablesPkg: Add missing BaseStackCheckLib instance e13e53cb2f NetworkPkg/NetworkPkg.dsc: Add RngLib mapping for ARM and RISCV64 c1f2287635 SecurityPkg/SecurityPkg.dsc: Add missing RngLib for ARM and RISCV64 b0a03ca4a9 SignedCapsulePkg/SignedCapsulePkg.dsc: Add RngLib mapping 15e635d1b5 UefiCpuPkg/MtrrLib/UnitTest: Fix 32-bit GCC build issues 4050c873b5 MdeModulePkg/Variable/RuntimeDxeUnitTest: Fix 32-bit GCC builds d79df34beb BaseTools: Fix StructurePcd offset error. b5d4a35d90 MdeModulePkg/XhciSched: Fix missing DEBUG arguments 48452993ad MdePkg/Include: Enhance DebugLib to support reproduce builds 5948ec3647 MdePkg: Reproduce builds across source format changes f331310a10 ArmPkg: Reproduce builds across source format changes 77dcd03ecf MdeModulePkg: Reproduce builds across source format changes 45137bca2f NetworkPkg: Reproduce builds across source format changes d939a25d41 SecurityPkg: Reproduce builds across source format changes fd42dcb1fc OvmfPkg: Reproduce builds across source format changes 8c1b1fe634 ShellPkg: Add comment that ItemPtr is set after validation d6e6337cd6 MdePkg: Fix ACPI memory aggregator/device type mismatch c974257821 MdeModulePkg AtaAtapiPassThru: Always do S.M.A.R.T. check if device support aab6bb3d32 MdeModulePkg/DxeCapsuleLibFmp: Capsule on Disk file name capsule a7b35aae13 MdeModulePkg\UfsBlockIoPei: UFS MMIO address size support both 32/64 bits f826b20811 UefiCpuPkg/UefiCpuLib: Add GetCpuFamilyModel and GetCpuSteppingId 8c8867c5da MdeModulePkg/DxeCapsuleLibFmp: Use new Variable Lock interface 22c3b5a865 BaseTools: Add authenticated variable store support a92559671a OvmfPkg/Xen: Fix VS2019 build issues 4c495e5e3d OvmfPkg/Bhyve/PlatformPei: Fix VS2019 X64 NOOPT build issue 466ebdd2e0 MdeModulePkg/FPDT: Lock boot performance table address variable at EndOfDxe 455b0347a7 UefiCpuPkg/PiSmmCpuDxeSmm: Use SMM Interrupt Shadow Stack e1e7306b54 OvmfPkg/Library/ResetSystemLib: Fix Microvm VS2019 NOOPT build issue 4c7ce0d285 MdeModulePkg AtaAtapiPassThru: Skip the potential NULL pointer access bb1bba3d77 NetworkPkg: Fix invalid pointer for DNS response token on error - Removed patches which are merged to mainline: - ovmf-OvmfPkg-OvmfXen-set-PcdAcpiS3Enable-at-initializatio.patch to fix the S3 detection in ovmf-xen - cb0d24637d edk2-stable202111-rc1~220 - ovmf-OvmfPkg-OvmfXen-add-QemuKernelLoaderFsDxe.patch to add QemuKernelLoaderFsDxe to ovmf-xen to load kernel from qemu fw_cfg - 9f3eda177a edk2-stable202111-rc1~216 - ovmf-OvmfPkg-OvmfXen-Fix-build-with-QemuKernelLoaderFsDxe.patch - 4473834e7d edk2-stable202111-rc1~203 - The edk2-stable202111 includes the following patches for bsc#1192126 to fix unlimited reset. (bsc#1192126) 80e67af9af OvmfPkg: introduce a common work area ab77b6031b OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b2 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm - Removed useless patch files because they are merged to edk2-stable202111 - ovmf-OvmfPkg-OvmfXen-Fix-build-with-QemuKernelLoaderFsDxe.patch - ovmf-OvmfPkg-OvmfXen-add-QemuKernelLoaderFsDxe.patch - ovmf-OvmfPkg-OvmfXen-set-PcdAcpiS3Enable-at-initializatio.patch - Updated URL to the edk2 repo on github - Use downloaded edk2-edk2-stable%{version}.tar.gz instead of the URL for Source0 because the edk2-edk2-stable202111 tarball is broken in tianocore repo which can not pass the "osc service runall download_files" testing. - We ill change it back to the following setting when upstream fixed tarball: Source0: https://github.com/tianocore/edk2/releases/download/edk2-stable%{version}/edk2-edk2-stable%{version}.tar.gz - Modified gdb_uefi.py.in for python3 (bsc#1192126) - change 'long' to 'int' - using print (' instead of print " - Sort file lists for reproducible build results - Update to edk2-stable202202 - Features (https://github.com/tianocore/edk2/releases): OvmfPkg Add new target for Cloud Hypervisor Add TDVF to OvmfPkg Add new APIs to UefiCpuPkg/UefiCpuLib Add AMD Secure Nested Paging Support Add SSDT PCI generator in DynamicTablesPkg Support ACPI 6.4 PPTT changes Add FdtHwInfoParser library Add DynamicPlatRepo library Make package and platform builds reproducible across source format changes Add Uncrustify CI Plugin Apply uncrustify changes to all package C and H files - Patches (git log --oneline --reverse edk2-stable202111~..edk2-stable202202): bb1bba3d77 NetworkPkg: Fix invalid pointer for DNS response token on error ef9a059cdb EmulatorPkg/Win/Host: Update CC_FLAGS 69877614fd .pytool/Plugin/EccCheck: Remove RevertCode() 854462bd34 .pytool/Plugin/EccCheck: Remove temp directory on exception 3019f1bbab .pytool/Plugin/EccCheck: Add performance optimizations 99f84ff473 .pytools/Plugin/LicenseCheck: Use temp directory for git diff output 76a1ce4d5f .azurepipelines/templates: Update max pipeline job time to 2 hours 365dced2c3 ArmPkg: Update YAML to ignore specific ECC files/errors 1939fc9569 ArmPlatformPkg: Update YAML to ignore specific ECC files/errors c97fee87f0 ArmVirtPkg: Update YAML to ignore specific ECC files/errors d5744ecba8 CryptoPkg: Update YAML to ignore specific ECC files/errors d7d30e8f21 EmulatorPkg: Update YAML to ignore specific ECC files/errors 9deb937076 MdeModulePkg: Update YAML to ignore specific ECC files/errors df790cd6b3 MdePkg: Update YAML to ignore specific ECC files/errors 60fa40be45 SecurityPkg: Update YAML to ignore specific ECC files/errors 9944508e85 ShellPkg: Update YAML to ignore specific ECC files/errors c30c40d6c6 StandaloneMmPkg: Update YAML to ignore specific ECC files/errors c057347977 UefiPayloadPkg: Update YAML to ignore specific ECC files/errors f0f3f5aae7 UnitTestFrameworkPkg: Update YAML to ignore specific ECC files/errors dfafa8e453 MdeModulePkg/DxeCorePerformanceLib:Variable Initial a4a582e180 ArmPkg: Change use of EFI_D_* to DEBUG_* 1d2482e1e3 ArmPlatformPkg: Change use of EFI_D_* to DEBUG_* c5b3a56e4f ArmVirtPkg: Change use of EFI_D_* to DEBUG_* a1878955b2 EmbeddedPkg: Change use of EFI_D_* to DEBUG_* 9c7da8d804 EmulatorPkg: Change use of EFI_D_* to DEBUG_* 917e98f3e5 FatPkg: Change use of EFI_D_* to DEBUG_* 87000d7708 MdeModulePkg: Change use of EFI_D_* to DEBUG_* 5f289f3ae3 MdePkg: Change use of EFI_D_* to DEBUG_* c49ca4a29e NetworkPkg: Change use of EFI_D_* to DEBUG_* 47719926e8 OvmfPkg: Change use of EFI_D_* to DEBUG_* ca56749b0e PcAtChipsetPkg: Change use of EFI_D_* to DEBUG_* e905fbb05a SecurityPkg: Change use of EFI_D_* to DEBUG_* 4a1aee13d8 ShellPkg: Change use of EFI_D_* to DEBUG_* 586fda4800 SourceLevelDebugPkg: Change use of EFI_D_* to DEBUG_* 96e1cba5c1 UefiCpuPkg: Change use of EFI_D_* to DEBUG_* 1871d28eaf ArmPkg: Change OPTIONAL keyword usage style 2863ba97ca ArmPlatformPkg: Change OPTIONAL keyword usage style 9607597a74 ArmVirtPkg: Change OPTIONAL keyword usage style c8f46130f8 CryptoPkg: Change OPTIONAL keyword usage style fe2d81892f DynamicTablesPkg: Change OPTIONAL keyword usage style 792433088c EmbeddedPkg: Change OPTIONAL keyword usage style c69fc80c80 EmulatorPkg: Change OPTIONAL keyword usage style 9c721071d3 FmpDevicePkg: Change OPTIONAL keyword usage style e3917e22e7 MdeModulePkg: Change OPTIONAL keyword usage style d0e2f8232a MdePkg: Change OPTIONAL keyword usage style 8874fa199d NetworkPkg: Change OPTIONAL keyword usage style 79d49e162e OvmfPkg: Change OPTIONAL keyword usage style 237295f46d PcAtChipsetPkg: Change OPTIONAL keyword usage style dc8fe5ec95 RedfishPkg: Change OPTIONAL keyword usage style 12710fe93b SecurityPkg: Change OPTIONAL keyword usage style 9b8507cabe ShellPkg: Change OPTIONAL keyword usage style 18908e6131 SignedCapsulePkg: Change OPTIONAL keyword usage style f9c9215b55 SourceLevelDebugPkg: Change OPTIONAL keyword usage style 902e76de19 StandaloneMmPkg: Change OPTIONAL keyword usage style 4ec586b9f6 UefiCpuPkg: Change OPTIONAL keyword usage style e35dd32821 UefiPayloadPkg: Change OPTIONAL keyword usage style 78bc3bdd2a UnitTestFrameworkPkg: Change OPTIONAL keyword usage style ea85f0fe13 ArmVirtPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() e3b855f283 CryptoPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 4a9d411662 DynamicTablesPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() db52c7f755 MdeModulePkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 098307e082 MdePkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() ed7f7c9168 NetworkPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 8e875037bf OvmfPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() deba54761a PcAtChipsetPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() f9f4fb2329 SecurityPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 7c2a6033c1 UefiCpuPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 429309e0c6 ArmPkg: Apply uncrustify changes 40b0b23ed3 ArmPlatformPkg: Apply uncrustify changes 2b16a4fb91 ArmVirtPkg: Apply uncrustify changes 7c34237831 CryptoPkg: Apply uncrustify changes 731c67e1d7 DynamicTablesPkg: Apply uncrustify changes e7108d0e96 EmbeddedPkg: Apply uncrustify changes a550d468a6 EmulatorPkg: Apply uncrustify changes bcdcc4160d FatPkg: Apply uncrustify changes 45ce0a67bb FmpDevicePkg: Apply uncrustify changes 111f2228dd IntelFsp2Pkg: Apply uncrustify changes 7c7184e201 IntelFsp2WrapperPkg: Apply uncrustify changes 1436aea4d5 MdeModulePkg: Apply uncrustify changes 2f88bd3a12 MdePkg: Apply uncrustify changes d1050b9dff NetworkPkg: Apply uncrustify changes ac0a286f4d OvmfPkg: Apply uncrustify changes 5220bd211d PcAtChipsetPkg: Apply uncrustify changes 39de741e2d RedfishPkg: Apply uncrustify changes c411b485b6 SecurityPkg: Apply uncrustify changes 47d20b54f9 ShellPkg: Apply uncrustify changes b878648967 SignedCapsulePkg: Apply uncrustify changes c1e126b119 SourceLevelDebugPkg: Apply uncrustify changes 91415a36ae StandaloneMmPkg: Apply uncrustify changes 053e878bfb UefiCpuPkg: Apply uncrustify changes e5efcf8be8 UefiPayloadPkg: Apply uncrustify changes 7c0ad2c338 UnitTestFrameworkPkg: Apply uncrustify changes dc453b5164 .pytool/Plugin/UncrustifyCheck: Add Uncrustify CI plugin 1832eb15aa UefiPayloadPkg/UefiPayloadPkg.fdf: Update DXE Apriori list ca78281c25 UefiPayloadPkg/PayloadEntry: Inherit 4/5-level paging from bootloader b2f7ee2ded UefiPayloadPkg: Increase SystemMemoryUefiRegionSize from 32M to 64M 94e0a7bddb UefiPayloadPkg: Add missing Guid gUefiAcpiBoardInfoGuid 2527723de9 UefiPayloadPkg: Add performance measurement feature ffdde9d719 UefiPayloadPkg: Skip ModuleInfo HOB in Payload 965292135b UefiPayloadPkg/UefiPayloadPkg.dsc:Add BootManagerLib for BootManagerMenuApp 85a678bf76 UefiPayloadPkg: Add integration instruction for coreboot common error 7b28310008 BaseTools: Increase the DevicePath length for support more PCD value. d25b803e51 MdeModulePkg/Bus/Pci/UhciDxe: Fix the UsbHc memory allocate and free issue c82ab4d8c1 BaseTools/VfrCompile: Correct Bit Field Flags for numeric/one of 2ddacfb6b8 OvmfPkg/SecMain: move SEV specific routines in AmdSev.c e2289d19d8 UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c 2fe8edfe55 OvmfPkg/ResetVector: move clearing GHCB in SecMain 3053183d41 OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use 707c71a01b OvmfPkg: reserve SNP secrets page cca9cd3dd6 OvmfPkg: reserve CPUID page f2dc28f0b6 OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase 34819f2cac OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values d9822304ce OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() 7c3b2892ea OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest d2b998fbdc OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values a19b648952 OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest 19914edc5a OvmfPkg/AmdSevDxe: do not use extended PCI config space ade62c18f4 OvmfPkg/MemEncryptSevLib: add support to validate system RAM d706f8fec2 OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 11b15336f0 OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM d39f8d88ec OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI phase 202fb22be6 OvmfPkg/SecMain: validate the memory used for decompressing Fv 8eb79b5f4f OvmfPkg/PlatformPei: validate the system RAM when SNP is active 26210f9436 MdePkg: Define ConfidentialComputingGuestAttr 504ae26b80 OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is active b95908e043 UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status f4e3ce5f53 UefiCpuPkg: add PcdGhcbHypervisorFeatures f5a6e1bab5 OvmfPkg/PlatformPei: set the Hypervisor Features PCD 2c354252be MdePkg/GHCB: increase the GHCB protocol max version 9c703bc0f1 UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is enabled d4d7c9ad5f UefiCpuPkg/MpInitLib: use BSP to do extended topology check b928eb44d5 OvmfPkg/MemEncryptSevLib: change the page state in the RMP table b7b8872031 OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address ea3a12d970 OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map 67484aed69 OvmfPkg/AmdSev: expose the SNP reserved pages through configuration table 06544455d0 UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs 0f1d7477c0 OvmfPkg: Remove unused print service driver (PrintDxe) 30631f0a26 MdePkg: Add missing Cache ID (in)valid define 0077c22f6d MdePkg: Remove PPTT ID type structure a50b65ce22 ShellPkg: Update Acpiview PPTT parser to ACPI 6.4 8cf2bdfcfb ShellPkg: Add Cache ID to PPTT parser b2bbe3df54 DynamicTablesPkg: Remove PPTT ID structure from ACPI 6.4 generator e139829dd6 DynamicTablesPkg: Update PPTT generator to ACPI 6.4 e81a81e584 DynamicTablesPkg: Add CacheId to PPTT generator 9afcd48a94 OvmfPkg: Handle Cloud Hypervisor host bridge 2ccefa32a6 OvmfPkg: Create global entry point for SMBIOS parsing d8ef774346 OvmfPkg: Retrieve SMBIOS from Cloud Hypervisor 66bce05f6d OvmfPkg: Generalize AcpiPlatformDxe 7594c5bfe2 OvmfPkg: Install ACPI tables for Cloud Hypervisor f6df289a1c OvmfPkg/OvmfXen: Fix Xen build 2b20a34fd5 OvmfPkg-EmuVariableFvbRuntimeDxe: Support Access To Memory Above 4G d5efc875ef MdePkg: Introduce CcMeasurementProtocol for CC Guest firmware a124cd4ef9 SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib 8c06c53b58 SecurityPkg: Support CcMeasurementProtocol in DxeTpmMeasurementLib adf070ff56 OvmfPkg/Microvm: add PcdConfidentialComputingGuestAttr 2686468c43 OvmfPkg/Bhyve: add MemEncryptSevLib 61be49e0f7 OvmfPkg/PlatformCI: factor out PlatformBuildLib.py 21ee379407 OvmfPkg/PlatformCI: add QEMU_SKIP 64bccda534 OvmfPkg/PlatformCI: add BhyveBuild.py 04eacd3943 OvmfPkg/PlatformCI: add MicrovmBuild.py 8b8ae609a7 OvmfPkg/PlatformCI: add AmdSevBuild.py 2722856a87 OvmfPkg/PlatformCI: dummy grub.efi for AmdSev 1203eba58e OvmfPkg/PlatformCI: add XenBuild.py 64ef0dd1d3 OvmfPkg/Microvm/fdt: add device tree support 79dcaf7054 OvmfPkg/Microvm/fdt: load fdt from fw_cfg c802f8935c OvmfPkg/Microvm/fdt: add empty fdt 2a68abf6ee OvmfPkg/Microvm/virtio: add virtio-mmio support e07d27e24d OvmfPkg/Microvm: add README 7f1861be2b DynamicTablesPkg: AML Code generation for memory ranges 0e7147fe75 DynamicTablesPkg: AML Code generation to create a named Package() fd5fc4bbb7 DynamicTablesPkg: AML Code generation to create a named ResourceTemplate() b2b8def4e3 DynamicTablesPkg: AML Code generation to add _PRT entries 69ddfee1c3 DynamicTablesPkg: Add AmlAttachNode() ce306e48eb DynamicTablesPkg: Add Pci related objects e35a746cf5 DynamicTablesPkg: SSDT Pci express generator ec37fd9c1f DynamicTablesPkg: Fix multiple objects parsing 557dede8a6 OvmfPkg/PlatformPei: ScanOrAdd64BitE820Ram improvements 759e3c6d21 OvmfPkg/PlatformPei: prefer etc/e820 for memory detection 41d8bb3038 OvmfPkg/PlatformPei: stop using cmos for memory detection 7a6e6ae933 EmulatorPkg: Update lldbefi.py to work with current lldb which uses python3 4d30352445 ArmPkg: Add SMC helper functions c039fa7ff0 ArmPkg: Update SMC calls to use the new ArmCallSmc0/1/2/3 functions 90ad4b3b34 DynamicTablesPkg: Definition for HwInfoParser interface d59c5a20f8 DynamicTablesPkg: FdtHwInfoParser: CM Object descriptor helper 5d8b5d171c DynamicTablesPkg: FdtHwInfoParser: Add FDT utility functions 8d2691c3d5 DynamicTablesPkg: FdtHwInfoParser: Add Boot Arch parser 3ebe1ff5c9 DynamicTablesPkg: FdtHwInfoParser: Generic Timer Parser 51941f7558 DynamicTablesPkg: FdtHwInfoParser: Add Serial port parser e366a41ef0 DynamicTablesPkg: FdtHwInfoParser: Add GICC parser 0fa1217726 DynamicTablesPkg: FdtHwInfoParser: Add GICD parser b04cf355a0 DynamicTablesPkg: FdtHwInfoParser: Add MSI Frame parser d250d408cf DynamicTablesPkg: FdtHwInfoParser: Add ITS parser 7b6c8b30a5 DynamicTablesPkg: FdtHwInfoParser: Add GICR parser 26bf034a59 DynamicTablesPkg: FdtHwInfoParser: Add GIC dispatcher c67bf628c8 DynamicTablesPkg: FdtHwInfoParser: Add PCI config parser deb01dfd7f DynamicTablesPkg: Add FdtHwInfoParser library 9006967c8d DynamicTablesPkg: Handle 16550_WITH_GAS id b2d0ed20fd DynamicTablesPkg: Definition for DynamicPlatRepoLib interface 2e2db65e39 DynamicTablesPkg: DynamicPlatRepo: Add TokenGenerator 740e3bb634 DynamicTablesPkg: DynamicPlatRepo: Add TokenFixer 5fe5b6f94f DynamicTablesPkg: DynamicPlatRepo: Add TokenMapper 38f6d78c3b DynamicTablesPkg: Add DynamicPlatRepo library f14fff5135 StandaloneMmPkg/FvLib: Support large file with EFI_FFS_FILE_HEADER2. 3a72ec71cd OvmfPkg: remove unused TPM options from MicrovmX64.dsc b47575801e OvmfPkg: move tcg configuration to dsc and fdf include files 5711ff4d0b OvmfPkg: drop TPM_CONFIG_ENABLE b819388772 OvmfPkg: create Tcg12ConfigPei.inf 4de8d61bce OvmfPkg: rework TPM configuration e6ea1464a8 OvmfPkg/PlatformPei: Revert "stop using cmos for memory detection" a6c0418651 ArmPkg/SmbiosMiscDxe: Remove duplicate HII string definition 45e3842970 ArmPkg/SmbiosMiscDxe: Get full SMBIOS strings from OemMiscLib b451c69088 ArmPkg/ProcessorSubClassDxe: Get serial and part number from OemMiscLib 8ed8568922 SecurityPkg: Debug code to audit BIOS TPM extend operations 195f011973 SecurityPkg: Reallocate TPM Active PCRs based on platform support ab5ab2f603 SecurityPkg: TPM must go to Idle state on CRB command completion c63a10ecb7 EmbeddedPkg/AcpiLib: Add more helper functions f129b1f06f OvmfPkg/Bhyve: fix tls-enabled build ee1f8262b8 OvmfPkg: Call PlatformInitializeConsole for GPU passthrough case de9e5b7dc7 IntelFsp2WrapperPkg : FSPM/S UPD data address based on Build Type 9ec2cc1f31 IntelFsp2WrapperPkg : Remove EFIAPI from local functions. ae8272ef78 MdeModulePkg/UsbBusDxe: fix NOOPT build error 15c596aeeb OvmfPkg: Bhyve: Delete unused AcpiTables/Ssdt.asl file 6612ff8561 UefiCpuPkg: Extend measurement of microcode patches to TPM e910f076ad BaseTools: Fix the bug of --cmd-len build option 7935be0fbd IntelFsp2Pkg/FspSecCore: ExtendedImageRevision was not printed. c095122d4b MdeModulePkg/PciBusDxe: Enumerator to check for RCiEP before looking for RP d463c56ddd MdeModulePkg: Replace with UFS_UNIT_DESC to fix timeout problem 45920941d9 MdeModulePkg: Refactoring UFS DME request and fix timing problem 13d9e8ec98 MdeModulePkg: Put off UFS HCS.DP checking to fix timing problem 079a58276b OvmfPkg/AmdSev/SecretPei: Mark SEV launch secret area as reserved 9dd14fc91c MdePkg: Add registers of boot partition feature 14a731096d UnitTestFrameworkPkg: CI YAML: Grant cmockery spell check exception 6062002bd5 MdeModulePkg/PartitionDxe: Add break to handle invalid LBA0 in MBR 7438a85bf1 BaseTools: Fix wrong variable header size c712ce2bb1 OvmfPkg/CloudHv: Add new target for Cloud Hypervisor a2da72b2ca OvmfPkg/CloudHv: Replace legacy 8254 PIT with local APIC timer 6ecdda71fe OvmfPkg/CloudHv: Connect serial console 1552050ce7 OvmfPkg/CloudHv: Remove legacy 8259 PIC support fdcea7ff6f OvmfPkg/CloudHv: Remove Q35 specifics 71082d3d1b OvmfPkg/CloudHv: Reduce dependency on QemuFwCfg 196be601f9 OvmfPkg/CloudHv: Remove video support 7b6cbe0a81 OvmfPkg/CloudHv: Remove USB support e73d1bf96a OvmfPkg/CloudHv: Remove CSM support b66056ef21 OvmfPkg/CloudHv: add Maintainers.txt entry 5302bd81d9 OvmfPkg: Add CloudHvX64 to the CI 59c48c9314 UefiPayloadPkg: Change the user interface name of the Uiapp 5801910013 UefiPayloadPkg: Not use BaseCpuTimerLib by default. 772c5bb8dc FmpDevicePkg/FmpDxe: Update FmpDeviceCheckImageWithStatus() handling 7709988dd8 RedfishPkg/RedfishRestExDxe:Simplify status check 21320ef669 MdeModulePkg/Variable: Make only EFI_VARIABLE_NON_VOLATILE invalid 7e5c603cba MdeModulePkg/SdMmcPciHcDxe: Robust improvements for SD card 1.8V switch ee67067f17 MdeModulePkg: VariableSmmRuntimeDxe: Fix Variable Policy Message Length 5b39832e18 MdePkg: MmCommunication2: Update MM communicate2 function description ce37f45955 ArmPkg: MmCommunicationDxe: MM communicate function argument attributes 541a077bd1 ArmPkg: MmCommunicationDxe: Update MM communicate `CommBuffer**` checks 1aa1ec4574 ArmPkg: MmCommunicationDxe: Update MM communicate `CommSize` check 8cc5590eab ArmPkg: MmCommunicationDxe: Update MM communicate `MessageLength` check 6777e67383 EmbeddedPkg: Fix a build error in FwVol.c in X64 arch a867f3a704 UefiPayloadPkg: Use BaseCpuTimerLib for Universal Payload by default f4b7b473b4 MdeModulePkg/UefiBootManagerLib: Convert BmLoadOption to Variable Policy 76b3d45b75 ShellPkg: Add the missing VariablePolicyHelperLib in ShellPkg.dsc 8542fc5f95 NetworkPkg: Add the missing VariablePolicyHelperLib in NetworkPkg.dsc ae35314e7b Maintainers.txt: Add Sami Mujawar as reviewer for ArmPkg 862ea6e836 OvmfPkg: change qemu default resolution to 1280x800 e95b44c90e ArmVirtPkg: change qemu default resolution to 1280x800 929804b172 OvmfPkg: add PcdVideoResolutionSource 7f25ddbc03 OvmfPkg/QemuVideoDxe: simplify InitializeBochsGraphicsMode 336da55ca8 OvmfPkg/QemuVideoDxe: drop QEMU_VIDEO_BOCHS_MODES->ColorDepth 55c05427b9 OvmfPkg/QemuVideoDxe: factor out QemuVideoBochsAddMode 49a2d8cbf5 OvmfPkg/QemuVideoDxe: parse edid blob, detect display resolution ba79becd55 OvmfPkg/BaseCachingPciExpressLib: Migrate BaseCachingPciExpressLib 103fa647d1 ArmPkg: Replace CoreId and ClusterId with Mpidr in ARM_CORE_INFO struct 742dafd2cc DynamicTablesPkg: Print specifier macro for CM_OBJECT_ID 13136cc311 DynamicTablesPkg: FdtHwInfoParserLib: Parse Pmu info 5751d60821 DynamicTablesPkg: AmlLib: AmlAddPrtEntry() to handle GSI 5816bd3eab DynamicTablesPkg: AcpiSsdtPcieLibArm: Remove link device generation dc1118fa0d ArmVirtPkg: Add cspell exceptions 0dbd356983 ArmVirtPkg/Kvmtool: Add DSDT ACPI table 312ef7a0a4 ArmVirtPkg/Kvmtool: Add Configuration Manager 17a02163bd ArmVirtPkg/Kvmtool: Enable ACPI support 5b3c682d91 ArmVirtPkg/Kvmtool: Enable Acpiview 017564d637 ArmPkg/ArmMmuLib AARCH64: avoid EL0 accessible mappings 45b1612659 DynamicTablesPkg: Add Memory32Fixed function 007a95055b DynamicTablesPkg: Remove redundant cast in AmlCodeGenReturn 33189f0527 DynamicTablesPkg: Add AmlCodeGenMethodRetInteger function a4b7aa362d MdeModulePkg/Bus/Pci/PciBusDxe: Support platform PCI ROM override 6fb09da89f ShellPkg: Fix incorrect PPTT FlagName dereference c09dbc92e9 BaseTools/Conf: Add new macro for customizing dll file reduction. d4ac53aa91 BaseTools: Fix error leg in DscBuildData.py f78b937c95 MdeModulePkg/RuntimeDxe: clear mVirtualMapMaxIndex 96b8b5fd10 MdeModulePkg/UiApp: Fix spelling of 'FRONTPAGE' bd676f080a Maintainers.txt: add missing github IDs to OvmfPkf/Fdt reviewers 1f54eaa725 Maintainers.txt: update email for Leif Lindholm b360b0b589 Maintainers.txt: Update email address c9b7c6e0cc BaseTools: Update CLANG{35,38}_WARNING_OVERRIDES to ignore unused vars 42af706dfb BaseTools: Update brotli submodule 1193aa2dfb MdeModulePkg: update brotli submodule 85589ddbf6 OvmfPkg/VmgExitLib: Fix uninitialized variable warning with XCODE5 c28e376edc OvmfPkg/FvbServicesSmm: use the VmgExitLibNull 8a57673316 ShellPkg: Fix Ping GetTimerPeriod API failure b24306f15d NetworkPkg: Fix incorrect unicode string of the AKM/Cipher Suite - Add amd-sev-es to the following descriptors because James Fehlig tested them (bsc#1196879): 60-ovmf-x86_64.json 60-ovmf-x86_64-2m.json 60-ovmf-x86_64-ms.json 60-ovmf-x86_64-2m-ms.json - Backported patches in ovmf-bsc1196879-sev-fix.patch for fixing SEV: de463163d9 OvmfPkg/AmdSev: reserve snp pages 63c50d3ff2 OvmfPkg/ResetVector: cache the SEV status MSR value in workarea f1d1c337e7 OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea - TPM_ENABLE got renamed to TPM2_ENABLE and TPM_CONFIG_ENABLE removed (except on ARM for some reason) (boo#1197104) - Add GCC 12 workaround (ovmf-ignore-spurious-GCC-12-warning.patch) that handles: https://bugzilla.tianocore.org/show_bug.cgi?id=3816 The same patch is already included in qemu package. - Respin amd-sev and amd-sev-es features After more testing, we found that not all descriptors can support both amd-sev with amd-sev-es. So we removed all amd-sev and amd-sev-es feature tags but only keep them in ovmf-x86_64-2m.json and 60-ovmf-x86_64.json. (bsc#1198246#c75) - add ovmf-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch. It fixes crashes when linked using gcc 12 (bsc#1199597). - Update to edk2-stable202205 - Features (https://github.com/tianocore/edk2/releases): Support PEI 64bit in IntelFsp2Pkg and IntelFsp2WrapperPkg IntelFsp2Pkg: BaseFspCommonLib Support for X64 Build Add PrmPkg BaseTools Enhance GenFw to support PRM GCC build Enable Intel TDX in OvmfPkg Generate CloudHv target as PVH ELF binary Add parallel hash feature into BaseCryptLib Configure/Enable elliptic curve ciphers in OpenSSL Add FMMT tool into edk2 BaseTools Dynamic variable flash information cannot be passed in Standalone MM - Patches (git log --oneline --reverse edk2-stable202202~..edk2-stable202205): b24306f15d NetworkPkg: Fix incorrect unicode string of the AKM/Cipher Suite 2dbed52506 ArmVirtPkg/ArmVirtMemoryInitPeiLib: avoid redundant cache invalidation 54cddc3ad4 ArmVirtPkg/ArmVirtKvmTool: wire up configurable timeout de463163d9 OvmfPkg/AmdSev: reserve snp pages 63c50d3ff2 OvmfPkg/ResetVector: cache the SEV status MSR value in workarea f1d1c337e7 OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea b1b89f9009 MdeModulePkg: Correct high-memory use in NvmExpressDxe 84338c0d49 MdeModulePkg: Replace Opcode with the corresponding instructions. d3febfd9ad MdePkg: Replace Opcode with the corresponding instructions. 7bc8b1d9f4 SourceLevelDebugPkg: Replace Opcode with the corresponding instructions. 2aa107c0aa UefiCpuPkg: Replace Opcode with the corresponding instructions. bbaa00dd01 MdePkg: Remove the macro definitions regarding Opcode. 6a890db161 BaseTools: Upgrade the version of NASM tool 497ac7b6d7 UefiPayloadPkg/PayloadLoaderPeim: Use INT64 as input parameter dc39554d58 edk2/MdeModulePkg/Debuglib: Add Standalone MM support 906242343f MdeModulePkg/GraphicsConsoleDxe: Check status to make sure no error b422b0fcf9 EmulatorPkg/EmuGopDxe: Set ModeInfo after Open successfully 589d51df26 MdeModulePkg/Usb/Keyboard.c: Don't request protocol before setting b909b4ad09 OvmfPkg: Make the Xen ELF header generator more flexible 0a707eb258 OvmfPkg: Xen: Use a new fdf include for the PVH ELF header 0015a4e0a8 OvmfPkg: Xen: Generate fdf include file from ELF header generator 9ac8c85d50 OvmfPkg: CloudHv: Remove VARS and CODE sections e1c7f9b4e5 OvmfPkg: Generate CloudHv as a PVH ELF binary d50d9e5549 OvmfPkg: CloudHv: Retrieve RSDP address from PVH 82bfd2e86d OvmfPkg: CloudHv: Rely on PVH memmap instead of CMOS b83d0a6438 OvmfPkg: CloudHv: Add README 4a68176cb5 UefiCpuPkg: Extend SMM CPU Service with rendezvous support. 949b8a3d97 Maintainers.txt: Add new reviewer for UefiPayloadPkg 091b6a1197 UefiPayloadPkg: Add build option for Above 4G Memory 4adc364c75 UefiPayloadPkg: Fix case of protocol 79f2734e5a MdeModulePkg: Add a check for metadata size in NvmExpress Driver af74efe494 UefiPayloadPkg: Make Boot Manager Key configurable 62fa37fe7b BlSupportSmm: fix definition of SetSmrr() 56530dec11 .pytool/Plugin/UncrustifyCheck: Output file diffs by default 2aac8bb7ef .pytool: Update to newest pytools c63ef58698 .azurepipelines: Updated python version f06941cc46 MdeModulePkg: Add bRefClkFreq card attribute programming support 2b175eeb6a RedfishPkg: fix memory leak issue 10b4c8f3b7 Maintainers: Update Maintainers.txt for edk2 Redfish modules 0fdd466c75 UefiCpuPkg/MpInitLib:remove optional in declaration 52e09dcd7a UefiCpuPkg: Support FFS3 GUID in SearchForBfvBase.asm a13dfc769b MdeModulePkg/DxeIpl: Create 5-level page table for long mode c8ea48bdf9 DynamicTablesPkg: Fix serial port namespace path in DBG2 414cd2a4d5 BaseTools/GenFw: Enhance GenFw to support PRM GCC build 33438f7354 EmulatorPkg/RedfishPlatformCredentialLib: Check EFI_SECURE_BOOT_MODE_NAME 5b56c52b5c EmulatorPkg/RedfishPlatformCredentialLib: Don't stop Redfish service 0531f61376 IntelFsp2Pkg: BaseFspDebugLibSerialPort Support for X64 411b3ff6dd IntelFsp2Pkg: BaseFspSwitchStackLib Support for X64 b429959bb6 MdeModulePkg/SdMmcPciHcDxe: Make timeout for SD card configurable 79a705fbaf UefiPayloadPkg: Hookup SD/MMC timeout 28eeb08d86 MdePkg/Include: Smbios Specification 3.5.0 changes c1e662101a CryptoPkg: Add new hash algorithm ParallelHash256HashAll in BaseCryptLib. 267a92fef3 MdePkg/AcpiXX.h: Update Error Severity type for Generic Error Status Block ec0b54849b IntelFsp2Pkg: BaseFspCommonLib Support for X64 5d8d8b5148 MdeModulePkg/NvmExpressDxe: fix check for Cap.Css 69218d5d28 MdeModulePkg/NvmExpressPei: fix check for NVM command set bf9230a9f3 BaseTools: Add the FeatureFlagExpression usage to the Source Section 3115377bf0 BaseTools: Remove the redundant __FLEXIBLE_SIZE from PcdValueInit.c 4a2e1000a1 CryptoPkg: update openssl submodule to 1.1.1n 355515a06a CryptoPkg? Redefinition bug in CrtLibSupport.h. 7b005f344e BaseTools: fix gcc12 warning 85021f8cf2 BaseTools: fix gcc12 warning 22130dcd98 Basetools: turn off gcc12 warning ec30a4a0c3 BaseTools:Support decimal version number in ECC check 3ef2071927 UefiCpuPkg: Update BFV searching algorithm in VTF0 691b178667 ShellPkg/AcpiView: Adds ACPI_PARSER bitfield parser 40004ff9d5 ShellPkg/AcpiView: PrintFormatter for FADT Flags field 7456990e8e MdeModulePkg/Ufs: bRefClkFreq attribute be programmed after fDeviceInit 237c966396 UefiPayloadPkg/UefiPayloadPkg.ci.yaml: Remove duplicated entry 76191052fd UefiPayloadPkg: Fix build error 449eb01a8d UefiPayloadPkg: Fix architecture in the build instruction c248802e40 UefiPayloadPkg: Fix PciHostBridgeLib 2b4b8013fe UefiPayloadPkg/Library/PlatformBootManagerLib: Remove broken VGA detection 55637a2894 UefiPayloadPkg: Make Boot Timeout configurable 2268920afc .azurepipelines: Use Python 3.8 c3ca70669e .azurepipelines: Use windows-2019 VM image 3b0de44759 EmulatorPkg: Use windows-2019 VM image 75628d27c0 OvmfPkg: Use windows-2019 VM image b328bb54c6 BaseTools/Bin: Update GCC ARM compiler version 3f0c788a5f MdePkg: Add Tdx.h 77228269e7 MdePkg: Update Cpuid.h for Tdx 818bc9596d MdePkg: Introduce basic Tdx functions in BaseLib c3001cb744 MdePkg: Add TdxLib to wrap Tdx operations eddcba40b5 UefiCpuPkg: Extend VmgExitLibNull to handle #VE exception daf8f642f3 OvmfPkg: Extend VmgExitLib to handle #VE exception de327f7d8a UefiCpuPkg/CpuExceptionHandler: Add base support for the #VE exception ab9d790901 MdePkg: Add helper functions for Tdx guest in BaseIoLibIntrinsic b6b2de8848 MdePkg: Support mmio for Tdx guest in BaseIoLibIntrinsic d74e932681 MdePkg: Support IoFifo for Tdx guest in BaseIoLibIntrinsic 3571fc906f MdePkg: Support IoRead/IoWrite for Tdx guest in BaseIoLibIntrinsic 7bed7ae6c5 UefiCpuPkg: Support TDX in BaseXApicX2ApicLib d983b102b3 MdePkg: Add macro to check SEV / TDX guest 88da06ca76 UefiCpuPkg: Enable Tdx support in MpInitLib 352eabdcd5 OvmfPkg: Add IntelTdx.h in OvmfPkg/Include/IndustryStandard 6a608255bb OvmfPkg: Add TdxMailboxLib 57bcfc3b06 OvmfPkg: Create initial version of PlatformInitLib 102cafedad OvmfPkg/PlatformInitLib: Add hob functions 9a9b33b3d6 OvmfPkg/PlatformPei: Move global variables to PlatformInfoHob 5a2574a82e OvmfPkg/PlatformPei: Refactor MiscInitialization 6d2ce5fd5c OvmfPkg/PlatformPei: Refactor MiscInitialization for CloudHV 3dd47f9544 OvmfPkg/PlatformPei: Refactor AddressWidthInitialization 432e4acd87 OvmfPkg/PlatformPei: Refactor MaxCpuCountInitialization f3801cf26c OvmfPkg/PlatformPei: Refactor QemuUc32BaseInitialization e510326245 OvmfPkg/PlatformPei: Refactor InitializeRamRegions 12e860a1e8 OvmfPkg/PlatformPei: Refactor MemMapInitialization cec82a64cf OvmfPkg/PlatformPei: Refactor NoexecDxeInitialization f53f449f15 OvmfPkg/PlatformPei: Refactor MiscInitialization 10460942ff OvmfPkg/PlatformInitLib: Create MemDetect.c 96047b6663 OvmfPkg/PlatformInitLib: Move functions to Platform.c b22ac35b75 OvmfPkg: Update PlatformInitLib to process Tdx hoblist ccca1c2d5d OvmfPkg/Sec: Declare local variable as volatile in SecCoreStartupWithStack 2b80269d98 OvmfPkg: Update Sec to support Tdx 6b27c11690 OvmfPkg: Check Tdx in QemuFwCfgPei to avoid DMA operation bec9104201 MdeModulePkg: Skip setting IA32_ERER.NXE if it has already been set fd306d1dbc MdeModulePkg: Add PcdTdxSharedBitMask cc3620f304 UefiCpuPkg: Update AddressEncMask in CpuPageTable e23f8f52fd OvmfPkg: Update PlatformInitLib for Tdx guest cf17156d7d OvmfPkg: Update PlatformPei to support Tdx guest 9fdc70af6b OvmfPkg: Update AcpiPlatformDxe to alter MADT table 5aa8018639 OvmfPkg/BaseMemEncryptTdxLib: Add TDX helper library fae5c1464d OvmfPkg: Add TdxDxe driver 07c721fea7 OvmfPkg/QemuFwCfgLib: Support Tdx in QemuFwCfgDxe 2520182122 OvmfPkg: Update IoMmuDxe to support TDX c2e7be4055 OvmfPkg: Rename XenTimerDxe to LocalApicTimerDxe 299c44cd4f UefiCpuPkg: Setting initial-count register as the last step c37cbc030d OvmfPkg: Switch timer in build time for OvmfPkg 580a6b616b OvmfPkg: Add TdxWorkArea definition 75942a52ae OvmfPkg: Add PrePiHobListPointerLibTdx 4fe2678411 OvmfPkg: Add PeilessStartupLib 1f29de4d20 OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest 55fda68a80 OvmfPkg: Update TdxDxe to set TDX PCDs f674fa9cde OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob 149ed8e421 OvmfPkg/IncompatiblePciDeviceSupportDxe: Refine the configuration c477b2783f OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest cb8349f01a MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if needed 44a53a3bdd OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B 7fda517c3d OvmfPkg: Add dependency of VariableSmm driver to make it work normally. b953265a27 UefiPayloadPkg: Add a new DebugPrintErrorLevelLib instance 0023e35cf4 UefiPayloadPkg: Change some configuration of the payload 3e130e40fc UefiPayloadPkg: Consume the new added DebugPrintErrorLevelLib instance f16b05a13b .pytool/Plugin/UncrustifyCheck: Update func to return absolute paths dbfbaedb21 .pytool/Plugin/UncrustifyCheck: Add ignore file support d932199d39 OvmfPkg: Revert Uncrustify formatting in VbeShim.h files ad6816c319 OvmfPkg: Do not check VbeShim.h formatting with Uncrustify d2998af211 PrmPkg: Add package and include headers 5f76c3e471 PrmPkg: Add PrmConfig protocol interface e189e01af2 PrmPkg/PrmContextBufferLib: Add initial library instance 3f7af17c6b PrmPkg/PrmConfigDxe: Add initial driver 9276e0d2b9 PrmPkg: Add initial PrmSamplePrintModule c63905aba7 PrmPkg: Add initial PrmSampleMemoryAllocationModule 27b1a840e4 PrmPkg: Add initial PrmSampleHardwareAccessModule 7c41ec47ca PrmPkg: Add initial PrmSampleContextBufferModule 97ab54c1b1 PrmPkg: Add initial package DSC file d2cb6e67a4 Readme.md: Add initial content e846797662 PrmPkg: Add ALLOCATE_CONTEXT_BUFFER_IN_FW build option a6f8946bc9 PrmPkg: Enable variable growth for the PRM_MODULE_EXPORT macro ef05955996 PrmPkg: Publish PRM operation region to support PRM ACPI _DSM invocation f96517f4d0 PrmPkg: Export major/minor version in PRM module PE COFF header 50e1432a40 PrmPkg: Add initial PrmSsdtInstallDxe module a409f4b67d PrmPkg: Remove PRM Module Update Lock 0797989c5d PrmPkg: Remove ALLOCATE_CONTEXT_BUFFER_IN_FW build flag 0b469caff6 PrmPkg/PrmContextBuffer.h: Add ACPI parameter support structures be2c927d7c PrmPkg/PrmLoaderDxe: Add ACPI parameter buffer support c1a7a50f67 PrmPkg/PrmSampleContextBufferModule: Remove OS debug print requirement 4c8486fd72 PrmPkg/PrmSampleHardwareAccessModule: Add non-print PRM handlers 7217263514 PrmPkg/SampleAcpiParameterBufferModule: Add initial module fec018624c PrmPkg/HardwareAccessModuleConfigLib: Add initial library d10b8dc5d8 PrmPkg/Samples/Readme.md: Add initial file 6b7dde7cdd PrmPkg: Refactor some PrmLoaderDxe functionality into libraries 4348c72ad0 PrmPkg/Application/PrmInfo: Add initial application e10c776487 PrmPkg: Enforce stricter types 2e55b0cd9e PrmPkg/Test/PrmPkgHostTest.dsc: Add initial file 3599f5479d PrmPkg/Test/UnitTest/Library: Add initial UEFI Boot Services test lib 82d15dc6c1 PrmPkg/Library/DxePrmContextBufferLib: Add host-based unit tests 68ee42c991 PrmPkg/DxePrmModuleDiscoveryLib: Add initial host-based unit tests c040831cf9 PrmPkg: Add PlatformGuid a9302b89a9 PrmPkg: Update PRM OpRegion f8e68587e2 Readme.md: Add iASL note and QEMU sample link 4a4aeaa446 PrmPkg: Replace PcdPrmPlatformGuid with EDKII_DSC_PLATFORM_GUID 17b2d64ced PrmPkg/Samples: Remove PrmSampleMemoryAllocationModule 050b2ba27d PrmPkg/Samples: Remove PrmSamplePrintModule 88f3d734f5 PrmPkg: Remove the concept of OS services deea4e58b0 Readme.md: Add a link to PRM Specification f3c11224b5 PrmPkg: Changes for edk2 repo transition a298a84478 PrmPkg: Apply uncrustify changes 94f905b3bf MdeModulePkg/HiiDatabase: Fix Setup numeric default value incorrect issue b8c5ba2337 BaseTools: efi_debugging.py: Add debugger agnostic dbg Python Classes 0d7fec9f79 BaseTools: Scripts/efi_gdb.py: Add gdb EFI commands and pretty Print 4f4afcd288 BaseTools: Scripts/efi_lldb.py: Add lldb EFI commands and pretty Print bfefdc2c49 UefiPayloadPkg: Fix PciHostBridgeLib 676084303d UefiPayloadPkg: Support IA32 Build 63e155f24d UefiPayloadPkg: Add dependency of VariableSmm driver. dab96cf02e UefiPayloadPkg: Add --quiet argument to Universal Payload build script 35a4b63247 NetworkPkg: Add PCDs for HTTP DNS RetryCount and RetryInterval 38a9afd0fb NetworkPkg/HttpDxe: Decofigure Tcp4 before reconfiguring 3974aa539e NetworkPkg/HttpDxe: Decofigure Tcp6 before reconfiguring c43ff5188d NetworkPkg/HttpDxe: Add ConnectionClose flag fo HTTP_PROTOCOL 753fd319e2 NetworkPkg/HttpDxe: Detect 'Connection: close' header 12a50c9ce1 NetworkPkg/HttpDxe: Detect HTTP/1.0 servers 5576b17363 BaseTools: Fix DevicePath tool build failure issue 4352d115c4 CryptoPkg/CrtLibSupport: add fcntl.h 3b4b49cf00 CryptoPkg/CrtLibSupport: add strstr() 58771f4b2d CryptoPkg/CrtLibSupport: add INT_MIN 2759e42fbc CryptoPkg/CrtLibSupport: add UINT_MAX fd5f347c84 CryptoPkg/CrtLibSupport: add MODULESDIR 03951e5645 CryptoPkg/CrtLibSupport: add off_t fab6285a73 CryptoPkg/CrtLibSupport: fix strcpy f5508a91e3 CryptoPkg/UnitTest: fix DH testcase c411566fad pip-requirements.txt: Update basetools version to 0.1.17 8a5727c7a8 Maintainers.txt: Add Michael Kubacki as UnitTestFrameworkPkg maintainer 1a49e2aa3c CryptoPkg: Add instrinsics to support building ECC on IA32 windows efc39e65e5 CryptoPkg: Reconfigure OpensslLib to add EC algorithms 0c901fcc20 CryptoPkg: Make EC source file config-able f3da13461c CryptoPkg/TlsLibNull: Remove MU_CHANGE comment markers 4cfb28f12a UefiPayloadPkg: Fix the build failure 9bf7291d63 ShellPkg: Update smbiosview type 41 with SMBIOS 3.5 fields 630df8c86e IntelFsp2Pkg: X64 compatible changes to support PEI in 64bit 6f219bef55 IntelFsp2Pkg: Add FSPx_ARCH2_UPD support for X64 d40965b987 IntelFsp2Pkg: Update FSP_GLOBAL_DATA and FSP_PLAT_DATA for X64 00aa71ce20 IntelFsp2Pkg: FspSecCore support for X64 6bec5a66ea IntelFsp2Pkg: SecFspSecPlatformLibNull support for X64 4a6ed7e46a IntelFsp2WrapperPkg: Adopt FSPM_UPD_COMMON_FSP24 for X64 86a2f3c439 IntelFsp2WrapperPkg: BaseFspWrapperApiLib support for X64 91a03f78ba IntelFsp2WrapperPkg: SecFspWrapperPlatformSecLibSample support for X64 3d97733f44 MdePkg: Add CC_GUEST_TYPE in ConfidentialComputingGuestAttr.h d020ac55b6 OvmfPkg: Replace GUEST_TYPE with CC_GUEST_TYPE 74a3eb975d MdePkg: Add CcProbeLibNull 2f44d77c68 OvmfPkg: Add CcProbeLib 2a7e1e890d OvmfPkg: Add CcProbeLib in *.dsc 7012cb73c4 MdePkg: Probe Cc guest in BaseIoLibIntrinsicSev 76fda1def3 OvmfPkg: Call CcProbe in SecMain.c instead of TsIsEnabled 532bd4ec38 CryptoPkg/Crt: fix strcpy build on older VS compilers 6d2baf9dfb PrmPkg/DxePrmContextBufferLib: Fix unit test GCC compilation errors 892787fed5 OvmfPkg/OvmfPkgX64: Adjust load sequence of TdxDxe and AmdSevDxe driver b06a007b64 CryptoPkg: Declare PcdEcEnabled in Library consuming OpensslLib fdfbf1fdab MdePkg: Update smbiosview type 9 with SMBIOS 3.5 fields a85ae8d964 ShellPkg: Update smbiosview type 9 with SMBIOS 3.5 fields 2306555bf9 UefiPayloadPkg: Fix IA32 entry build failure f4dfec6ca1 BaseTools: Move gPlatformFinalPcd to Datapipe and optimize size ee582858c4 .azurepipelines: Add NOOPT to all package builds 2d9d605714 .pytool/Plugin/UncrustifyCheck: Add Azure DevOps UI debug instructions b807174fec MdeModulePkg/GraphicsConsoleDxe: add modes 5a17629902 OvmfPkg: clear PcdConOut{Row,Column} 96e1d337e0 ArmVirtPkg: clear PcdConOut{Row,Column} 483d3bb716 ShellPkg: Update smbiosview type 0 with SMBIOS 3.5 fields ecc79b092e OvmfPkg/VirtioGpuDxe: add VirtioGpuSendCommandWithReply 182122914c OvmfPkg/VirtioGpuDxe: add GetDisplayInfo to virtio-gpu spec header. 82c07f2cc7 OvmfPkg/VirtioGpuDxe: add VirtioGpuGetDisplayInfo 5f6ecaa398 OvmfPkg/VirtioGpuDxe: use GopQueryMode in GopSetMode 86de090b99 OvmfPkg/VirtioGpuDxe: move code to GopInitialize 916f90baa5 OvmfPkg/VirtioGpuDxe: query native display resolution from host d372ab585a BaseTools/Conf: Fix Dynamic-Library-File template cabd96ad03 OvmfPkg: restore CompatImageLoaderDxe chunk 4092f1d397 OvmfPkg/Bhyve: add support for QemuFwCfg daa6cd8763 ArmPlatformPkg: Fix error message in Scripts/Ds5/edk2_debugger.py 5299568ce6 ArmPlatformPkg: Fix target initialisation in cmd_load_symbols.py 101f4c7892 ArmPlatformPkg: Fix EDK2_DSC check in Scripts/Makefile a64b944942 BaseTools: Add FMMT Python Tool 826527c9db UefiPayloadPkg: Add definition for PayloadCommandLine HOB d4eef3fe7c MdePkg: Add CpuLib to module INFs that depend on UefiCpuLib. a63b086e69 IntelFsp2Pkg: Add CpuLib to module INFs that depend on UefiCpuLib 3afa0a2096 IntelFsp2WrapperPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 1783b099d3 OvmfPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 86d41c077e UefiCpuPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 2434f6f206 UefiPayloadPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 247a0fc65e OvmfPkg: Add README for TDVF 8079d4dc4f MdePkg: add SmmCpuRendezvousLib.h and SmmCpuRendezvousLibNull implement. 1a6c837638 UefiPayloadPkg: Fix the UPL build failure 29ae55a0b8 PcAtChipsetPkg: Change the flow of PcRtcInit() a658ed30e5 MdeModulePkg/PCD: Pcd initialize DXE have assert 0e31124877 .pytool: Fix python command error in self introduction doc 43613b2fe8 CryptoPkg: Rename PCD about openssl EC configuration f753c36209 CryptoPkg: Separate auto-generated openssl config and edk2 openssl config 499b0d5fa5 CryptoPkg: Update process_files.pl to automatically add PCD config option a332ffb6ef CryptoPkg/openssl: update generated files 9dd964f5e5 CryptoPkg/openssl: disable codestyle checks for generated files b5cd30a79b UefiCpuPkg: Revert "UefiCpuPkg: Enable Tdx support in MpInitLib" ad629b5c5a OvmfPkg: Add MpInitLibDepLib related PPI/Protocol definitions 2f06e5af47 OvmfPkg: Add MpInitLibDepLib b63a49e056 OvmfPkg/Sec: Install MpInitLibDepLib PPIs in SecMain.c 73d6d41de0 OvmfPkg/TdxDxe: Install MpInitLibDepLib protocols deee7a100b OvmfPkg: Enable 2 different CpuMpPei and CpuDxe drivers 17702186b5 MdeModulePkg: PiSmmCore: Inspect memory guarded with pool headers d0efa681b6 UefiPayloadPkg: Simplify code logic 57ebb2994d UefiPayloadPkg: Add Serial IO device path according to related protocol ef01d63ef3 UefiPayloadPkg: Connect all root bridge in PlatformBootManagerBeforeConsole 35d9b7ea2d ArmPkg: Remove RVCT support b55b6d33e4 ArmPlatformPkg: Remove RVCT support e9eeb0ad2b CryptoPkg: Remove RVCT support 48b919cb14 MdePkg: Remove RVCT support 5621d81edf FatPkg: Remove RVCT support cc070e9e0c NetworkPkg: Remove RVCT support a744199470 ArmVirtPkg: Remove RVCT support b7a446f224 EmbeddedPkg: Remove RVCT support 57c84113a1 OvmfPkg: Remove RVCT support 708620d29d BaseTools: Remove RVCT support 2d1138a1a8 .azurepipelines: Fix cspell version to v5.20.0 7b126978e1 .pytool/plugin/SpellCheck: Allow compound words 2189c71026 .pytool/plugin/SpellCheck: Add more common words 0903042b66 MdeModulePkg: Add Variable Flash Info HOB 60b519456c MdeModulePkg/VariableFlashInfoLib: Add initial library 4dbebc2d10 MdeModulePkg/Variable: Consume Variable Flash Info 8db39c60cd MdeModulePkg/FaultTolerantWrite: Consume Variable Flash Info 524a15c1fa ArmVirtPkg/ArmVirt.dsc.inc: Add VariableFlashInfoLib a69eac7578 EmulatorPkg: Add VariableFlashInfoLib a7d3d4e7c4 OvmfPkg: Add VariableFlashInfoLib 1f026ababf UefiPayloadPkg: Add VariableFlashInfoLib a72d552f19 OvmfPkg/OvmfPkgX64: Use different CcProbeLib when SMM is on or off a21a3438f7 OvmfPkg: Make an Ia32/X64 hybrid build work with SEV 9c733f0b90 OvmfPkg: TdxDxe: Fix AsmRelocateApMailBoxLoop 07c0c2eb0a OvmfPkg: fix PcdFSBClock 16779ede2d Removed prefix to match AsmRelocateApMailBoxLoopStart - Removed patches in ovmf-bsc1196879-sev-fix.patch which are merged to mainline: - OvmfPkg/AmdSev: reserve snp pages - de463163d9 edk2-stable202205-rc1~292 - OvmfPkg/ResetVector: cache the SEV status MSR value - 63c50d3ff2 edk2-stable202205-rc1~291 - OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR - f1d1c337e7 edk2-stable202205-rc1~290 - Add the following patches for building edk2-stable202205 with nasm-2.14 on SLE15-SP3/SP4 and Leap 15.3/15.4. Those patches add marco back because nasm-2.14 doesn't support corresponding instructions. (jsc#PED-1410) - ovmf-Revert-MdePkg-Remove-the-macro-definitions-regarding.patch ovmf-Revert-UefiCpuPkg-Replace-Opcode-with-the-correspond.patch ovmf-Revert-SourceLevelDebugPkg-Replace-Opcode-with-the-c.patch ovmf-Revert-MdePkg-Replace-Opcode-with-the-corresponding-.patch ovmf-Revert-MdeModulePkg-Replace-Opcode-with-the-correspo.patch - Then reverted 5 patches in 84338c0d49~..bbaa00dd01 MdeModulePkg: Replace Opcode with the corresponding MdePkg: Replace Opcode with the corresponding SourceLevelDebugPkg: Replace Opcode with the UefiCpuPkg: Replace Opcode with the corresponding MdePkg: Remove the macro definitions regarding Opcode. - Change the size of ovmf-x86_64 to 4MB, otherwise OBS exposes the following error: [ 266s] GenFv: ERROR 3000: Invalid [ 266s] the required fv image size 0x1afed8 exceeds the set fv image size 0x1ac000 - [ovmf-x86_64]="-p OvmfPkg/OvmfPkgX64.dsc -D FD_SIZE_4MB" - Removed patches in ovmf-bsc1196879-sev-fix.patch which are merged to edk2-stable202205: - OvmfPkg/AmdSev: reserve snp pages - de463163d9 edk2-stable202205-rc1~292 - OvmfPkg/ResetVector: cache the SEV status MSR value - 63c50d3ff2 edk2-stable202205-rc1~291 - OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR - f1d1c337e7 edk2-stable202205-rc1~290 - Because 5 revert patches in edk2-stable202205 for nasm-2.14 is against 15-SP4/Leap 15.4 and earlier version. So add suse_version and sle_version checking logic in ovmf.spec when applying revert patches. (jsc#PED-1410) - Modified ovmf.changes log, using PED-1410 instead of PED-1359 for pushing to SLE15-SP5. - Add patches to disable option ROM on sev (bsc#1199156) ovmf-bsc1199156-OvmfPkg-IncompatiblePciDeviceSupportDxe-Ignore-Optio.patch - Update to edk2-stable202208 (jsc#PED-1410) - Features (https://github.com/tianocore/edk2/releases): Add CRC16 and CRC32C to MdePkg IntelFsp2Pkg/ConfigEditor: Support FSP 2.3 header Extend SecureBootVariableLib interfaces UEFI HTTPS Boot Support for HTTP Client Authentication (Basic or Digest) Support 64bit FspResetType for X64 build IntelFsp2Pkg/FspSecCore: Add FSP-I entry for SMM support Add PCI_DEVICE_PPI definition to EDK2 Support to assign the subject name to sign the capsule file - Patches (git log --oneline --reverse edk2-stable202205..edk2-stable202208): 7f0890776e MdeModulePkg/UniversalPayload: Align Identifier value with UPL spec b4be5f05dd UefiPayloadPkg: Align Identifier value with UPL spec dac2fc8146 UefiPayloadPkg: Align SpecRevision value with UPL spec 3ca7326b37 OvmfPkg/VirtioGpuDxe: replace struct copy with CopyMem call fa2b212d61 IntelFsp2Pkg: Add FSP 2.3 header support 11d8abcba2 IntelFsp2Pkg: FSP_TEMP_RAM_INIT call must follow X64 Calling Convention df1c7e91b4 IntelFsp2WrapperPkg: FSP_TEMP_RAM_INIT call for X64 Calling Convention 62044aa99b OvmfPkg/ResetVector: Removing SEV-ES CPUID bit check 54cd0d9b2f OvmfPkg: Fix TDVMCALL error in ApRunLoop.nasm 64706ef761 OvmfPkg: Search EFI_RESOURCE_MEMORY_UNACCEPTED for Fw hoblist 81ab97b7b9 OvmfPkg/AmdSev: remove unused SMM bits from .dsc and .fdf files 0223898f3e OvmfPkg/Microvm: drop CODE and VARS files b57911c84c OvmfPkg/FdtPciHostBridgeLib: io range is not mandatory 47f44097eb OvmfPkg/Platform: unfix PcdPciExpressBaseAddress ad3bafa7d5 OvmfPkg/Microvm/pcie: no vbeshim please bd10d4e201 OvmfPkg/Microvm/pcie: mPhysMemAddressWidth tweak 632574ced1 OvmfPkg/Microvm/pcie: add pcie support 5c9f151e0c OvmfPkg: CloudHv: Fix FW_BASE_ADDRESS 43f3cfce19 OvmfPkg: Check for QemuFwCfg availability before accessing it 3129ed374c OvmfPkg: CloudHv: Rely on QemuFwCfgLibNull implementation bf25f27e00 OvmfPkg: Don't access A20 gate register on Cloud Hypervisor 72c5afd0b4 Security: Add HashLibTdx b1567b2e15 CryptoPkg: Add SecCryptLib dc443e4437 SecurityPkg: Add definition of EFI_CC_EVENT_HOB_GUID a708536dce OvmfPkg: Introduce SecMeasurementLib 4b0a622635 OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV ac03c339de OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table f8264e1303 MdePkg: Define CC Measure EventLog ACPI Table 57a6ee3461 OvmfPkg/IntelTdx: Add TdTcg2Dxe 0a4019ec9d OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot 0b36dea3f8 BaseTools: Fix dependency issue in PcdValueInit 4f89e4b3e8 .pytool: UncrustifyCheck: Set IgnoreFiles path relative to package path 2818fda9bc Security: Add SecTpmMeasurementLibTdx ff0ffe5999 OvmfPkg: Implement MeasureHobList/MeasureFvImage a81a650da1 OvmfPkg: Delete SecMeasurementLibTdx ff36b2550f OvmfPkg/Sec: fix stack switch 21a9b605b8 CpuException: Avoid allocating code pages for DXE instance 34d505123e CpuException: Init global variables in-place 2fbc5ff0a5 CpuException: Avoid allocating page but using global variables 2a09527ebc CpuException: Remove InitializeCpuInterruptHandlers e7abb94d1f CpuException: Add InitializeSeparateExceptionStacks 54aeed7e00 MpInitLib: Allocate code buffer for PEI phase 76323c3145 MpInitLib: remove unneeded global ASM_PFX b4d7b9d2b5 MpInitLib: Put SEV logic in separate file 283ab9437a MpInitLib: Only allocate below 1MB memory for 16bit code ccc269756f MpInitLib: Move the Above1Mb vector allocation to MpInitLibInitialize f0b97e165e Revert "OvmfPkg/Sec: fix stack switch" b09ada6edc MdePkg: Remove "assert" from SmmCpuRendevousLibNull.c 92288f4334 MdePkg/BaseLib: Add CRC16-ANSI and CRC32c implementations e2ae0bed29 ArmPkg/ArmExceptionLib: Follow new CpuExceptionHandlerLib APIs 6676162f64 DxeMain: Fix the bug that StackGuard is not enabled 16d97fa601 OvmfPkg: Use PcdOvmfWorkAreaBase instead of PcdSevEsWorkAreaBase 05e57cc9ce SecurityPkg/HashLibTdx: Return EFI_UNSUPPORTED if it is not Tdx guest 92ab049719 BaseTools: output the intermediate library instance when error occurs cc2db6ebfb UefiPayloadPkg: Increase the PcdMaximumUnicodeStringLength e8034b534a UefiPayloadPkg: Always split page table entry to 4K if it covers stack. cfe165140a UefiPayloadPkg: UniversalPayloadBuild.py to support --pcd feature b97243dea3 MdeModulePkg/XhciDxe: Check return value of XHC_PAGESIZE register 3930d1791a ArmPlatformPkg: Remove overly verbose DEBUG lines in LcdGraphicsBlt aa1bce0e5e OvmfPkg: reduce the number of dsc include files for tpm libs 6c9f218bc0 OvmfPkg/Library: Create base HardwareInfoLib for PCI Host Bridges 2b1a5b8c61 Ovmf/HardwareInfoLib: Create Pei lib to parse directly from fw-cfg a1bd79c514 Ovmf/HardwareInfoLib: Add Dxe lib to dynamically parse heterogenous data 3497fd5c26 Ovmf/PlatformPei: Use host-provided GPA end if available 3f5b1b9132 OvmfPkg/PciHostBridgeUtilityLib: Initialize RootBridges apertures with spec f304308e1c ArmPlatformPkg: Add PCD for serial debug port interrupt 4bfd668e5e UefiCpuPkg: CpuDxe: Set RW and P Attributes on Split Pages 2aee08c0b6 UefiPayloadPkg: Backward support with python 3.6 8f0722434b ArmVirtPkg: Include DxeHardwareInfoLib library class in dsc 15b25045e6 Ovmf: Include HardwareInfoLib library classes for IntelTdx b600f253b3 BaseTools/Ecc: Fix grammar in Ecc error message 7f4eca4cc2 MdeModulePkg/XhciDxe: Add access xHCI Extended Capabilities Pointer 5914128871 BaseTools: Fix the GenMake bug for .cpp source file c13377153f MdePkg/Acpi62: Add type 7 NFIT Platform Capabilities Structure support 21e6ef7522 UefiPayloadPkg: Align Attribute value with UPL spec 8d0564deaf pip-requirements.txt: Update basetools version to 0.1.24 f966093f5b OvmfPkg/PlatformCI: add IntelTdxBuild.py 70586d4e3a MdePkg/Acpi62: Add bit definitions to NFIT Platform Capabilities Structure 7861b24dc9 ArmPkg/Drivers: ArmGicIsInterruptEnabled returns incorrect value e1eef3a8b0 NetworkPkg: Add Wi-Fi Wpa3 support in WifiConnectManager 134fbd552c SecurityPkg: UefiSecureBoot: Definitions of cert and payload structures d6bee54c45 SecurityPkg: PlatformPKProtectionLib: Added PK protection interface 56c717aafa SecurityPkg: SecureBootVariableLib: Updated time based payload creator 6de7c084db SecurityPkg: SecureBootVariableLib: Updated signature list creator 6eb4079475 SecurityPkg: SecureBootVariableLib: Added newly supported interfaces fe73e9cd89 SecurityPkg: SecureBootVariableProvisionLib: Updated implementation d2a0f379d5 SecurityPkg: Secure Boot Drivers: Added common header files 5678ebb42b SecurityPkg: SecureBootConfigDxe: Updated invocation pattern dbc4e3675f SecurityPkg: SecureBootVariableLib: Added unit tests 152e37cc5a OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency f193b945ea EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency 9ab18fec82 StandaloneMmPkg: Fix issue about SpPcpuSharedBufSize field 31d3eeb103 StandaloneMmPkg: Replace DEBUG_INFO with DEBUG_ERROR 5496c763aa StandaloneMmPkg: Fix check buffer address failed issue from TF-A e93bc6309b UefiCpuPkg/SecCore: Add debug messages to illuminate data flow 86a0f84470 ArmVirtPkg: Pipeline: Resolving newly introduced dependency c8e30482fd .gitignore: Ignore build tools build logs f6f3cc7ead UefiPayloadPkg: Add CryptoDxe driver to UefiPayload 12dd064a18 MdePkg/include: Update DMAR definitions to Intel VT-d spec ver4.0 9ab389c01b UefiCpuPkg: Update SEC_IDT_TABLE struct 470206ba7f IntelFsp2Pkg: Update SEC_IDT_TABLE struct 0d23c447d6 DynamicTablesPkg: Add support to specify FADT minor revision 07c8e5e59b UefiPayloadPkg/PlatformBootManagerLib: Evenly space boot prompt 176016387f BaseTools: add '-p' for Linux 'cp' command. 039bdb4d3e BaseTools: Fix DSC LibraryClass precedence rule fc4a132c0e DynamicTables: Fix DT PCI interrupt flags parsing 792ebb6374 DynamicTablesPkg: Fix generated _HID value for SBSA c966204049 IntelFsp2Pkg: Add Definition of EDKII_PEI_VARIABLE_PPI 586b4a104b Maintainers.txt: Add IntelFsp2*Pkg Maintainer e18a5f813c Maintainers.txt: Update Maintainers/reviewers for UefiPayloadPkg e21b203911 UefiPayloadPkg: Add macro to support selective driver in UPL f0064ac3af Maintainers.txt: Update email address 6cda306da1 DynamicTablesPkg: AcpiSsdtPcieLibArm: Correct translation value 9ac155bf0b DynamicTablesPkg: AcpiSsdtPcieLibArm: Support UID > 0xF 19a8768365 DynamicTablesPkg: AcpiSsdtPcieLibArm: Create support library 671b0cea51 NetworkPkg/HttpBootDxe: Add Support for HTTP Boot Basic Authentication 140446cd59 IntelFsp2Pkg: Support 64bit FspResetType for X64 build. 24eac4caf3 IntelFsp2WrapperPkg: Support 64bit FspResetType for X64 build. 4824924377 IntelFsp2Pkg/FspSecCore: Add FSP-I API for SMM support. 3b8cee1781 Maintainers.txt: update Gary's email address 7ef91af84c EmulatorPkg/PosixFileSystem: Add NULL check on memory allocation 494f333aba MdeModulePkg/CoreDxe: Allow DXE Drivers to use untested memory 343f37b5c0 MdeModulePkg/SetupBrowserDxe:Follow spec'd way to reconnect driver c8af26627a ArmPkg/CpuDxe: drop ARM_PROCESSOR_TABLE pseudo-ACPI table 5a3641bfcd IntelFsp2Pkg: Add FSPI_ARCH_UPD. bf1ff540d9 MdePkg/UefiDevicePathLib: Add support for PEIMs 6964b5c48c MdeModulePkg/Include: Long debug string is truncated to 104 char d32a84b5ad BaseTools: INF should use latest Pcd value instead of default value 8ee26529d1 BaseTools/VolInfo: Correct alignment attributes display c0b7679aac BaseTools/VolInfo: Increase define for highest section value fca5de51e1 BaseTools/VolInfo: Correct EFI_SECTION_VERSION display 8a5782d704 UefiCpuPkg: Fix nasm warning "signed byte value exceeds" a47241f133 UefiPayloadPkg: Add macro to support selection of CryptoDxe driver 69f76d0f72 Maintainers.txt: Remove OvmfPkg/XenTimerDxe reference a8c4fe23c4 Maintainers.txt: Add missing github ids 7f1c89f167 Maintainers.txt: Remove reviewer Harry Han b68d566439 BaseTools/Capsule: Support signtool input subject name to sign capsule file e3d468acb9 BaseTools/VolInfo: Show encapsulation sections 2677286307 UefiPayloadPkg: Fix RelaAddress type always mismatch in if condition f26b70cb9f UefiPayloadPkg: Add support for logging to CBMEM console 57783adfb5 OvmfPkg: Change default to disable MptScsi and PvScsi 1774a44ad9 Maintainers.txt: Remove MptScsi and PvScsi reviewers 0e7add1d75 OvmfPkg/XenHypercallLib: Fix naming of AArch64 3eca64f157 IntelFsp2Pkg: FSPI_UPD is not mandatory. 0d0bfcb457 IntelFsp2Pkg: Fix GenCfgOpt bug for FSPI_UPD support. 8a210b9ac0 ShellPkg: Acpiview: Abbreviate field names to preserve alignment 65c4f3f2be DynamicTablesPkg: Handle error when IdMappingToken is NULL f5cea604a6 DynamicTablesPkg: IORT set reference to Id array only if present 238f903e8d DynamicTablesPkg: IORT set reference to interrupt array if present 4c55f6394f MdePkg: IORT header update for IORT Rev E.d spec cd67efa1b2 ShellPkg: Acpiview: IORT parser update for IORT Rev E.d spec de200b7e2c DynamicTablesPkg: Update ArmNameSpaceObjects for IORT Rev E.d e9150618ec DynamicTablesPkg: IORT generator updates for Rev E.d spec 6f4e10d6db SecurityPkg: Add retry mechanism for tpm command 19cbfaa431 OvmfPkg/QemuVideoDxe: Zero out PixelInformation in QueryMode a551de0d93 ArmVirtPkg: Fix KVM Guest Firmware 0dc9b78a46 Maintainers.txt: Add missing Github IDs for OvmfPkg TPM/TGC modules d219119721 UefiPayloadPkg/PlatformBootManagerLib: Correct spacing in boot prompt 79aab22fca UefiPayloadPkg: Add a Macro to enable Boot Logo 444260d45e UefiPayloadPkg: Load Boot Logo into ACPI table 86757f0b47 MdeModulePkg: Add EDKII_PCI_DEVICE_PPI definition a8f59e2eb4 MdeModulePkg/AhciPei: Use PCI_DEVICE_PPI to manage AHCI device 3e599bbc10 DynamicTablesPkg: Fix using RmrNodeCount unitlitialised a0a03b5154 BaseTools/GenSec: Fix typo f5f8c08db9 BaseTools/VolInfo: Show FV section boundaries d241a09afb BaseTools/VolInfo: Parse EFI_SECTION_FREEFORM_SUBTYPE_GUID header cf02322c98 BaseTools/GenSec: Support EFI_SECTION_FREEFORM_SUBTYPE_GUID sections 1ee1622817 Basetools/GenFw: Allow AARCH64 builds to use the --prm flag 9f197e44b1 PrmPkg: Enable external visibility on PRM symbols 21200d9fe6 PrmPkg: Build Prm Samples with GCC for AARCH64 57faeb782a PrmPkg: Support AArch64 builds using GCC 1da2012d93 PrmPkg: Add details on AArch64 build to the Readme. 0f7bccf584 UefiCpuPkg: Simplify InitializeSeparateExceptionStacks 9a24c3546e MdeModulePkg: Move CPU_EXCEPTION_INIT_DATA to UefiCpuPkg f1688ec9da UefiCpuPkg: Simplify the struct definition of CPU_EXCEPTION_INIT_DATA 75e3c2435c UefiCpuPkg: Create CpuPageTableLib for manipulating X86 paging structs f336e30ba1 UefiCpuPkg/CpuPageTableLib: Return error on invalid parameters bf334513b3 CpuPageTableLib: Fix a bug when a bit is 1 in Attribute, 0 in Mask 13a0471bfd CpuPageTableLib: Refactor the logic 9cb8974f06 CpuPageTableLib: Split the page entry when LA is aligned but PA is not c16f02f776 CpuPageTableLib: Avoid treating non-leaf entry as leaf one f4c845e46b CpuPageTableLib: Fix parent attributes are not inherited properly 9f53fd4ba7 CpuPageTableLib: Fix a bug to avoid unnecessary changing to page table 927113c83b CpuPageTableLib: Fix bug that wrongly requires extra size for mapping e9e2ecab2d CpuPageTableLib: define IA32_PAGE_LEVEL enum type internally e76496530c MdePkg/Library/UefiDevicePathLib: Add back StandaloneMm INF file bd06717863 MdeModulePkg: Enhance bus scan for all root bridge instances 74f44d920a ShellPkg/SmbiosView: Display extended memory info in smbiosview -t 17 83d5871184 UefiCpuPkg/PiSmmCpuDxeSmm: Add a new mIsShadowStack flag 7b4754904e UefiCpuPkg/PiSmmCpuDxeSmm: Remove mInternalCr3 in PiSmmCpuDxeSmm 62391b4ce9 MdeModulePkg/DxeIpl: Remove clearing CR0.WP when protecting pagetable 803ed060ee UefiPayloadPkg: Remove clearing CR0.WP when protecting pagetable a2b61de2f6 IntelFsp2Pkg: FSPM_ARCH2_UPD mismatching bug. 809b5a3d2a MdeModulePkg: Update the SMBIOS version by UPL 2812668bfc UefiCpuPkg/CpuPageTableLib/UnitTest: Add host based unit test 30d62f5e31 OvmfPkg/PlatformDxe: Check ExtractConfig and RouteConfig arguments b94836b224 OvmfPkg/VirtioGpuDxe: Check QueryMode arguments 3f282f4510 OvmfPkg/VirtioFsDxe: Check GetDriverName arguments 64a20bea97 MdeModulePkg/DumpDynPcd: Remove unsupported format specifiers 9102518d29 MdePkg: Improved Smbios Type9 table and Smbios spec v3.5.0 Changes 35d167ef3c ShellPkg: Improved Smbios Type 9 table changes in PrintInfo.c 68bf712d4f MdePkg: Added support for SMBIOS spec v3.6.0 to Smbios.h e2ac68a23b BaseTools/Source/C/GenSec: Fix EFI_SECTION_FREEFORM_SUBTYPE_GUID header d5fd86f256 ShellPkg: Adds Local APIC parser to AcpiView 2bb0020675 UefiPayloadPkg: Return PciRootBridges instead of NULL c15c9fa420 UefiPayloadPkg: Add macro to control NvmExpressDxe 938430741f RedfishPkg/RedfishDiscoverDxe: USB Redfish host interface is not supported eebef1b3b7 RedfishPkg: Redfish modules may need to use the functions which are private f2bf043aaa RedfishPkg: Redfish functions for REST requests are not fully spec complied dfdba857a6 UefiPayloadPkg: Fix Coverity report defect 4d83ee04f4 ShellPkg: Add revision check for DSDT Header on Arm 0ede7cad73 Maintainers.txt: Update maintainers list 722e03bc2e Revert "UefiCpuPkg/CpuPageTableLib/UnitTest: Add host based unit test" 166c49c212 Revert "ShellPkg: Adds Local APIC parser to AcpiView" 39ff9769ca Revert "BaseTools: Fix DSC LibraryClass precedence rule" ba0e0e4c6a BaseTools: Fix DevicePath GNUmakefile for macOS - Respin the following patches: ovmf-Revert-UefiCpuPkg-Replace-Opcode-with-the-correspond.patch - Change the size of ovmf-x86_64 back to 2MB, and remove EFI shell to reduce the fv image size. - Originally the reason of changing the size of ovmf-x86_64 to 4MB is for preventing OBS exposes the following error: [ 266s] GenFv: ERROR 3000: Invalid [ 266s] the required fv image size 0x1afed8 exceeds the set fv image size 0x1ac000 The fv image size is too big. But we found that change ovmf-x86_64 to 4MB causes live migration problem on qemu. (bsc#1204220) - So let's change the size of ovmf_x86_64 back to 2MB and remove EFI shell to reduce the fv image size. If user wants to use EFI shell, they should move to ovmf-x86_64-4m image. So we add the "-D EXCLUDE_SHELL" build option to ovmf-x86_64 flavor in ovmf.spec. (bsc#1204220) - Add ovmf-Revert-OvmfPkg-OvmfXen-Set-PcdFSBClock.patch to revert 71cdb91f313380152d7bf38cfeebe76f5b2d39ac patch (bsc#1205613) - 71cdb91f313380152d7bf38cfeebe76f5b2d39ac OvmfPkg/OvmfXen: Set PcdFSBClock - We are waiting better upsteam patch, revert the issue patch first. Then PcdFSBClock will back to fixed variable. - Reference: https://edk2.groups.io/g/devel/topic/94891128#96077 https://bugzilla.tianocore.org/show_bug.cgi?id=4340 - Add ovmf-MdeModulePkg-PiSmmCore-SmmEntryPoint-underflow-CVE-2.patch for MdeModulePkg/PiSmmCore: SmmEntryPoint underflow (CVE-2021-38578) (bsc#1196741) - Add ovmf-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch to check result of GetEfiGlobalVariable2 (CVE-2019-14560, bsc#1174246) - Add ovmf-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount (bsc#1225889, CVE-2024-1298) - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - add p11-kit-nss-trust subpackage that serves as drop-in replacement for mozilla-nss-certs - provide libnssckbi.so to replace mozilla-nss-certs - fix 32bit provides of libnssckbi.so - repace p11-kit-extract-trust with update-ca-certificates - new version 0.19.3 * Fix up problems with automake testing * Fix a bunch of memory leaks in newly refactored code * Don't use _GNU_SOURCE and the unportability it brings * Add basic 'trust anchor' command to store a new anchor * Support for writing out trust token objects * Port to use CKA_PUBLIC_KEY_INFO and updated trust store spec * Add option to use freebl for hashing * Implement reloading of token data * Fix warnings and possible minor bugs higlighted by code scanners * Don't load configs in home directories when running setuid or setgid * Support treating ~/.config as $XDG_CONFIG_HOME * Use $XDG_DATA_HOME/pkcs11 as default user config directory * Use $TMPDIR instead of $TEMP while testing * Open files and fds with O_CLOEXEC * Abort initialization if a critical module fails to load * Don't use thread-unsafe functions: strerror, getpwuid * Fix p11_kit_space_strlen() result when empty string * Refactoring of where various components live - new version 0.19.4 * 'trust anchor' now adds/removes certificate anchors * 'trust list' lists trust policy stuff * 'p11-kit extract' is now 'trust extract' * 'p11-kit extract-trust' is now 'trust extract-compat' * Workarounds for working on broken zfsonlinux.org [#68525] * Add --with-module-config parameter to the configure script [#68122] * Add support for removing stored PKCS#11 objects in trust module - upgrade to 0.20.1 which is 0.19 declared stable * Extract compat trust data after we've changes * Skip compat extraction if running as non-root * Better failure messages when removing anchors - trust: allow to also add openssl style hashes to pem-directory 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff - added .sig file. trying to locate source of the keyring. - New version 0.20.2 * Fix bug where blacklist didn't affect extracted ca-anchors if the anchor and blacklist were not in the same trust path (regression) [fdo#73558] * Check for race in BasicConstraints stapled extension [fdo#69314] * Build fixes and cleanup - new version 0.20.3 * Fix problems reinitializing managed modules after fork * Fix bad bookeeping when fail initializing one of the modules * Fix case where module would be unloaded while in use [#74919] * Remove assertions when module used before initialized [#74919] * Fix handling of mmap failure and mapping empty files [#74773] * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions * Require automake 1.12 or later * Build fixes for Windows [#76594 #74149] - apply patches to avoid errors from certificates with invalid public key (fdo#82328, bnc#890908, trust-Dont-use-invalid-public-keys-for-looking-up-.patch, trust-Print-label-of-certificate-when-complaining-.patch) - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - remove patches: * trust-Print-label-of-certificate-when-complaining-.patch * trust-Dont-use-invalid-public-keys-for-looking-up-.patch - new version 0.20.7 (stable) * New public pkcs11x.h header containing extensions [fdo#83495] * Export necessary defines to lookup attached extensions [fdo#83495] * Build fixes - new version 0.20.6 (stable) * Make the p11-kit-proxy.so module respect critical = no [fdo#83651] * Build fix for FreeBSD [fdo#75674] - new version 0.20.5 (stable) * Don't use invalid keys for looking up stapled extensions [fdo#82328] * Better error messages when invalid certificate extensions * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files * Fix some leaks, and memory issues * Silence some clang scanner warnings - new version 0.20.4 (stable) * Don't complain about C_Finalize after a fork * Fix typo - Update to version 0.23.1 (stable) * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582] * Add pem-directory-hash extract format * Build fixes - Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff; fixed on upstream release - Remove autoconf, automake and libtool require; unneeded dependencies - Add gtk-doc require; needed to build html documentation - Remove redundant %clean section - Update to 0.23.2 * Fix forking issues with libffi * Fix various crashes in corner cases * Updated translations * Build fixes - Make building more verbose - Enable tests - Small spec file cleanup with spec-cleaner - 32-bit compatibility fixes: * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39) * Add p11-kit-nss-trust-32bit NSS module * Fix potential bi-arch issue with private binaries (fdo#98817, p11-kit-biarch.patch) - Use %license instead of %doc [bsc#1082318] - support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox detects built in certificates (boo#1154871, 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch, 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch) - Also build documentation (boo#1013125) - Update to version 0.23.22 (bsc#1180064, bsc#1180065, bsc#1180066): * Fix memory-safety issues that affect the RPC protocol (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363), discovered and fixed by David Cook * anchor: Prefer persistent format when storing anchor [PR#329] * common: Fix infloop in p11_path_build [PR#326, PR#327] * proxy: C_CloseAllSessions: Make sure that calloc args are non-zero [PR#325] * common: Check for a NULL locale before freeing it [PR#321] * Build and test fixes [PR#313, PR#315, PR#317, PR#318, PR#319, PR#323, PR#330, PR#333, PR#334, PR#335, PR#338, PR#339] - Changes for version 0.23.21 * proxy: Do not assign duplicate slot IDs [PR#282] * common: Get program name based on executable path if possible [PR#307] * anchor: Exit with non-zero code, if any error occurs [PR#304] * Build and test fixes [PR#283, PR#290, PR#291, PR#292, PR#296, PR#299, PR#305, PR#306, PR#309, PR#311] - Changes for version 0.23.20: * Revert "Fix RPC when length-s are 0" changes [PR#276] - Changes for version 0.23.19: * common: add Russian PKCS#11 extensions to pkcs11x.h header [PR#255] * Add simple bash completion for provided commands [PR#258] * Unbreak list matching in enable-in and disable-in [PR#262] * Fix RPC when length-s are 0 [PR#259] * rpc: Add vsock transport support [PR#270] * trust: Support CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER [PR#265] * Build fixes [PR#271, PR#272, PR#273, ...] - Changes for version 0.23.18: * rpc: Allow empty CK_DATE value [PR#253] * build: Meson fixes [PR#245] * build: Adjust feature parity between meson and autotools [PR#247] - Changes for version 0.23.17: * common: Fix uClibc-ng compilation [PR#237] * trust: do not allow daylight to invalidate date validation [PR#236] * build: Port to meson build system [PR#231, PR#234] * rpc: On UNIX wait on condition variable instead of FD if header is for a different thread [PR#232] * doc: Add 'server' command in help [PR#229] * Build and test fixes [PR#230] - Changes for version 0.23.16: * proxy: Support C_WaitForSlotEvent() if CKF_DONT_BLOCK is specified [PR#225] * conf: Ignore user configuration if the program is running as root [PR#226] * proxy: Refresh slot list on every C_GetSlotList call [PR#224] * modules: Fix index used in call to p11_dict_remove() [PR#219] * Fix Win32 p11_dl_error crash [PR#218] * modules: check gl.modules before iterates on it when freeing [PR#217] * trust: Ignore unreadable content in anchors [PR#215] * extract-jks: Prefer _p11_extract_jks_timestamp to SOURCE_DATE_EPOCH [PR#213] - Changes for version 0.23.15: * trust: Improve error handling if backed trust file is corrupted [PR#206] * url: Prefer upper-case letters in hex characters when encoding [PR#193] * trust/extract-jks.c: also honor SOURCE_DATE_EPOCH time [PR#202] * virtual: Prefer fixed closures to libffi closures [PR#196] * Fix issues spotted by coverity and cppcheck [PR#194, PR#204] * Build and test fixes [PR#164, PR#191, PR#199, PR#201] - Changes for version 0.23.14: * proxy: Avoid invalid memory access when unloading proxy module [PR#180] * Update pkcs11 header to allow SoftHSMv2 to compile [PR#181] * build: Restore libpthread dependency [PR#183] * Build fixes [PR#188] - Changes for version 0.23.13: * server: Enable socket activation through systemd [PR#173] * rpc-server: p11_kit_remote_serve_tokens: Allow exporting all modules [PR#174] * proxy: Fail early if there is no slot mapping [PR#175] * Remove hard dependency on libpthread [PR#177] * Build fixes [PR#170, PR#176] - Changes for version 0.23.12 * Fix compile error when PKCS#11 GNU calling convention is enabled [PR#160] * Fix getauxval() and secure_getenv() emulation on macOS and FreeBSD [PR#167] * Build and test fixes on macOS [PR#162, PR#168] - Changes for version 0.23.11 * trust: Add extractor for edk2/cacerts.bin [PR#139] * modules: Add option to control module visibility from proxy [PR#140] * trust: Prevent trust module being loaded by proxy module [PR#142] * library: Use dedicated locale object for printing error [PR#148] * Treat CKR_CRYPTOKI_ALREADY_INITIALIZED correctly [PR#134] * Improve const correctness for P11KitUri [PR#152] * PKCS#11 URI scheme comparison is now case insensitive [PR#156] * Build and test fixes [PR#151, PR#149, PR#141, PR#138, PR#135] - Changes for version 0.23.10 * filter: Respect "write-protected" vendor-specific attribute in PKCS#11 URI [PR#129] * server: Improve shell integration and documentation [PR#107, PR#108] * proxy: Reuse existing slot ID mapping in after fork() [PR#120] * trust: Forcibly mark "Default Trust" read-only [PR#123] * New function p11_kit_override_system_files() which can be used for testing [PR#110] * trust: Filter out duplicate extensions [PR#69] * Update translations [PR#128] * Bug fixes [PR#125, PR#126] - Changes for version 0.23.9 * Fix p11-kit server regressions [PR#103, PR#104] * trust: Respect anyExtendedKeyUsage in CA certificates [PR#99] * Build fixes related to reallocarray [PR#96, PR#98, PR#100] - Changes for version 0.23.8 * Improve vendor query attributes handling in PKCS#11 URI [PR#92] * Add OTP and GOST mechanisms to pkcs11.h [PR#90, PR#91] * New envvar P11_KIT_NO_USER_CONFIG to stop looking at user configurations [PR#87] * Build fixes for Solaris and 32-bit big-endian platforms [PR#81, PR#86] - Changes for version 0.23.7 * Fix memory issues with "p11-kit server" [PR#78] * Build fixes [PR#77 ...] - Changes for version 0.23.6 * Port "p11-kit server" to Windows and portability fixes of the RPC protocol [PR#67, PR#72, PR#74] * Recover the old behavior of "trust anchor --remove" [PR#70, PR#71] * Build fixes [PR#63 ...] - Changes for version 0.23.5 * Fix license notice of common/unix-peer.c [PR#58] * Remove systemd unit files for now [PR#60] * Build fixes for FreeBSD [PR#56] - Changes for version 0.23.4 * Recognize query attributes defined in PKCS#11 URI (RFC7512) [PR#31, PR#37, PR#52] * The trust policy module now recognizes CKA_NSS_MOZILLA_CA_POLICY attribute, used by Firefox [#99453, PR#46] * Add 'trust dump' command to dump all PKCS#11 objects in the persistence format [PR#44] * New experimental 'p11-kit server' command that allows PKCS#11 forwarding through a Unix domain socket. A client-side module p11-kit-client.so is also provided [PR#15] * Add systemd unit files for exporting the proxy module through a Unix domain socket [PR#35] * New P11KitIter API to iterate over slots, tokens, and modules in addition to objects [PR#28] * libffi dependency is now optional [PR#9] * Build fixes for FreeBSD, macOS, and Windows [PR#32, PR#39, PR#45] - Changes for version 0.23.3 * Install private executables in libexecdir [fdo#98817] * Fix link error of proxy module on macOS [fdo#98022] * Use new PKCS#11 URI specification for URIs [fdo#97245] * Support x-init-reserved argument of C_Initialize() in remote modules [fdo#80519] * Incorporate changes from PKCS#11 2.40 specification * Bump libtool library version * Documentation fixes * Build fixes [fdo#87192 ...] - Move RPM macros to %_rpmmacrodir. - New server subpackage - Change keyring to new maintainer Daiki Ueno - Avoid bareword to fix build failure - Remove obsolete patches: * p11-kit-biarch.patch * 0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch * 0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch - Backport IBM specific mechanism and attributes (Jira#PED-584) 0001-Add-IBM-specific-mechanism-and-attributes.patch 0002-Add-support-for-serializing-CK_ECDH1_DERIVE_PARAMS-m.patch 0003-client-Allow-zero-part-length-at-C_SignUpdate.patch 0004-Fix-support-of-CKA_DERIVE_TEMPLATE.patch 0005-Add-other-SHA-variants-also-for-RSA-and-EC-signature.patch 0006-Add-support-for-missing-AES-and-DES-DES3-mechanisms.patch 0007-Add-support-for-MAC-and-HMAC-general-mechanisms.patch 0008-Add-support-for-CKM_DH_PKCS_DERIVE.patch 0009-rpc-Handle-special-cases-for-buffer-and-length.patch 0010-Add-support-for-CKM_AES_CTR.patch 0011-Add-support-for-CKM_AES_GCM.patch 0012-common-pkcs11x.h-Support-CRYPTOKI_GNU-for-IBM-vendor.patch - Ensure that programs using <p11-kit/pkcs11x.h> can be compiled with CRYPTOKI_GNU. Fixes GnuTLS builds. [jsc#PED-6705] * Add p11-kit-pkcs11-gnu-Enable-testing-with-p11-kit-pkcs11x.h.patch - /usr/bin/xauth chokes on the old user's $HOME being on an NFS file system. Run /usr/bin/xauth using the old user's uid/gid Patch courtesy of Dr. Werner Fink. [bsc#1174593, pam-xauth_ownership.patch] - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - /usr/bin/xauth chokes on the old user's $HOME being on an NFS file system. Run /usr/bin/xauth using the old user's uid/gid Patch courtesy of Dr. Werner Fink. [bsc#1174593, pam-xauth_ownership.patch] - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - /usr/bin/xauth chokes on the old user's $HOME being on an NFS file system. Run /usr/bin/xauth using the old user's uid/gid Patch courtesy of Dr. Werner Fink. [bsc#1174593, pam-xauth_ownership.patch] - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - /usr/bin/xauth chokes on the old user's $HOME being on an NFS file system. Run /usr/bin/xauth using the old user's uid/gid Patch courtesy of Dr. Werner Fink. [bsc#1174593, pam-xauth_ownership.patch] - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - Prevent cursor escape from the login prompt [bsc#1194818] * Added: pam-bsc1194818-cursor-escape.patch - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - Prevent cursor escape from the login prompt [bsc#1194818] * Added: pam-bsc1194818-cursor-escape.patch - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - Prevent cursor escape from the login prompt [bsc#1194818] * Added: pam-bsc1194818-cursor-escape.patch - Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft" to avoid spurious (and misleading) Warning: your password will expire in ... days. fixed upstream with commit db6b293046a [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch] - pam_xauth.c: do not free() a string which has been (successfully) passed to putenv(). [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch] - pam_cracklib: added code to check whether the password contains a substring of of the user's name of at least <N> characters length in some form. This is enabled by the new parameter "usersubstr=<N>" See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4 [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch] - Create macros.pam with definition of %_pamdir so packages which are commonly shared between Factory and SLE can use this macro [pam.spec] - Add a definition for pamdir to pam.spec So that a proper contents of macros.pam can be constructed. [pam.spec] - pam_limits: "unlimited" is not a legitimate value for "nofile" (see setrlimit(2)). So, when "nofile" is set to one of the "unlimited" values, it is set to the contents of "/proc/sys/fs/nr_open" instead. Also changed the manpage of pam_limits to express this. [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch] - If "LOCAL" is configured in access.conf, and a login attempt from a remote host is made, pam_access tries to resolve "LOCAL" as a hostname and logs a failure. Checking explicitly for "LOCAL" and rejecting access in this case resolves this issue. [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch] - In the 32-bit compatibility package for 64-bit architectures, require "systemd-32bit" to be also installed as it contains pam_systemd.so for 32 bit applications. [bsc#1185562, baselibs.conf] - Added pam_faillock to the set of modules. [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch] - Added new file macros.pam on request of systemd. [bsc#1190052, macros.pam] - Corrected macros.pam entry for %_pam_moduledir Cleanup in pam.spec: * Replaced all references to ${_lib}/security in pam.spec by %{_pam_moduledir} * Removed definition of (unused) "amdir". - Added tmpfiles for pam to set up directory for pam_faillock. [pam.conf] - Corrected a bad directive file which resulted in the "securetty" file to be installed as "macros.pam". [pam.spec] - Define _pam_vendordir as "/%{_sysconfdir}/pam.d" The variable is needed by systemd and others. [bsc#1196093, macros.pam] - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch] - Do not include obsolete libselinux header files flask.h and av_permissions.h. [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch] - Update pam_motd to the most current version. This fixes various issues and adds support for mot.d directories [jsc#PED-1712]. * Added: pam-ped1712-pam_motd-directory-feature.patch - pam_lastlog: check localtime_r() return value (bsc#1217000) * Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch - Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module. [bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch] - Prevent cursor escape from the login prompt [bsc#1194818] * Added: pam-bsc1194818-cursor-escape.patch - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - "pam-config --debug --update" in the %post section fails if any /etc/pam.d/common-$TYPE file is not a symlink to /etc/pam.d/common-$TYPE-pc. Fix that by adding '--force'. This is mainly an update issue since fresh configs are created appropriatly - Update to pam-config 0.87 - Add support for pam_access.so - Rervert last change, it will break manually adjusted config files as documented - Update to pam-config 0.88 - Add pam_ecryptfs to password section [bnc#895096] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Change check for existence of modules. If we have a biarch architecture, we check that the 64bit PAM module is there and report an error if not. For the 32bit variant, we only issue a warning. [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Change check for existence of modules. If we have a biarch architecture, we check that the 64bit PAM module is there and report an error if not. For the 32bit variant, we only issue a warning. [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216] - Update to pam-config 0.87 - Add support for pam_access.so - Rervert last change, it will break manually adjusted config files as documented - Update to pam-config 0.88 - Add pam_ecryptfs to password section [bnc#895096] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Change check for existence of modules. If we have a biarch architecture, we check that the 64bit PAM module is there and report an error if not. For the 32bit variant, we only issue a warning. [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216] - Added pam_google_authenticator.patch: support google authentiator [bnc#888149] - fix bashism in postun script - Update to version 0.89 - Includes pam_google_authenticator.patch - Better check for dual-arch PAM stack - Update to version 0.91 - Adjust for Linux-PAM 1.3.0 - Automatically replace obsolete PAM modules no longer installed - Extend error messages - Add gcc7-Add-break-to-a-case-label.patch: fix new warning reported by GCC7. - Update to version 0.92 - add pam_kwallet5 support - move pam_systemd before pam_krb5 [bsc#1014995] - obsoletes gcc7-Add-break-to-a-case-label.patch - Update to version 0.93: Teach pam_cracklib module about enforce_for_root [bnc#929079, FATE#312643]. - Update to version 0.94: add support for keyinit [bsc#1045886] - Update to version 0.95: - fix migration from pam_unix2/pam_pwcheck to pam_unix/pam_cracklib - Use %license instead of %doc [bsc#1082318] - Add triggerun script: update config if pam-modules is removed [bsc#1088863] - Update to version 0.96: * Add missing pam_cracklib options [bsc#1114835] - Update to version 1.0: - Add search in different locations for config files - Add support for pam_mktemp [bsc#1123878] - Update to version 1.1: - enhance comments in common-*-pc files - prior to writing an service-specific config file, the main function calls access() on the destination file in /etc/pam.d. This will fail and no config file will be written when the original config file was installed in /usr/etc/pam.d. A similar problem exists when creating the new service file: create_service_file() wants to give the new service file the same user, group and mode as the old one, but the old one may not exist. In that case, set these to 0(root), 0(root), and 0644. [pam-config-remove-bad-access-call.patch, bsc#1187091] - Add "revoke" to the option list for pam_keyinit (Remove some leftover debugs while we're at it) [pam-config-fix-pam_keyinit-options.patch] - Fix pam_gnome_keyring module for AUTH. [pam-config-fix-pam_gnome_keyring.patch, bsc#1219767] - Change check for existence of modules. If we have a biarch architecture, we check that the 64bit PAM module is there and report an error if not. For the 32bit variant, we only issue a warning. [pam-config-change-check-for-existence-of-modules.patch, bsc#1227216] - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532) - add aa-notify-more-arch-mr809.diff: Add support for reading s390x and aarch64 wtmp files (boo#1181155) - add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and /etc/ssl/engines.d/ in abstractions/openssl which were introduced with the latest openssl update - Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED operation="file_mmap" violation in SLE15-SP4; (bsc#1192336). - add update-samba-abstractions-ldb2.diff: Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684). - add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221, MR 827) - update to AppArmor 3.0.4 - various fixes in profiles, abstractions, apparmor_parser and utils (some of them were already included as patches) - add support for mctp address family - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4 for the full upstream changelog - remove upstream(ed) patches: - aa-notify-more-arch-mr809.diff - ruby-3.1-build-fix.diff - add-samba-bgqd.diff - openssl-engdef-mr818.diff - profiles-python-3.10-mr783.diff - update-samba-abstractions-ldb2.diff - refresh patches: - apparmor-samba-include-permissions-for-shares.diff - ruby-2_0-mkmf-destdir.patch - Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on /proc/{pid}/fd for samba-bgqd (bnc#1196850). - Add update-usr-sbin-smbd.diff to add new rule to allow reading of openssl.cnf (bnc#1195463). - ensure precompiled cache files are newer than (text) profiles - reload profiles in %posttrans instead of %post to ensure both - profiles and -abstractons package are updated before the cache in /var/cache/apparmor/ gets built (boo#1195463 #c20) - add profile for zgrep and xzgrep to prevent CVE-2022-1271 (zgrep-profile-mr870.diff) - Add samba_deny_net_admin.patch to add new rule to deny noisy setsockopt calls from systemd; (bnc#1196850). - Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon which now will spawn new additional services on demand. We need to modify the existing smbd/winbind profiles and additionally add a new set of profiles to cater for the new functionality; (bnc#1198309); - update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531) - Enhance zgrep-profile-mr870.diff to also allow/support zstd (boo#1198922). - add php8-fpm-mr876.patch so that php8 php-fpm can read its config (boo#1186267#c11) - parser: add conflict with apparmor-utils < 3.0 to avoid aa-status file conflict on upgrade (boo#1198958) - utils: add missing dependency on apparmor-parser (boo#1198958#c4) - add profiles-permit-php-fpm-pid-files-directly-under-run.patch https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344) - Add samba-4-17.patch to update the samba profiles for samba version 4.17 (bsc#1206626); - Add pam_apparmor README, referenced from online cha-apparmor-pam.html documentation (bsc#1213472) - update zgrep profile to allow egrep helper use (bsc#1214458) - zgrep-profile-sync-with-master.diff - Fix pam_apparmor %post and %postun scripts to handle pam-config errors (bsc#1215596) - Change nssdb path to /etc/pki/nssdb (bnc#463469). - Make libdir paths in pam_pkcs11.conf biarch-wise. - Updated to version 0.6.8: * Code cleanup. * Bug fixes. * Translation updates. - Fix build for Tumbleweed: * Add pam_pkcs11-0.6.8-fix-crypto-cflags.patch * Rebuild configure with the bootstrap script (add libtool as build dependency) - Updated to version 0.6.9: * Upstream web moved. * pkcs11_listcerts: Do not fail on certificate error. * Do not fail if card was already unlocked. * Other bug fixes. * Translation updates. - Drop upstreamed pam_pkcs11-0.6.8-fix-crypto-cflags.patch. - Work around incorrect upstream release process not calling "make dist". - Split API documentation into a separate package pam_pkcs11-devel-doc. - Add pam_pkcs11-fsf-address.patch. - add service file bsc#1049219 - Repair bulletpoint that skidded in description. Trim description of %name-devel-doc, it does not cotain the programs. - Fix segfault and fetch problems when checking CRLs (pam_pkcs11-crl-check.patch). - Address security issues found by X41 D-Sec audit (bsc#1105012) * Authentication Replay * Buffer Overflow * Memory not cleaned properly before free() - add patches: * 0001-verify-using-a-nonce-from-the-system-not-the-card.patch * 0002-fixed-buffer-overflow-with-long-home-directory.patch * 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch - Update to version 0.6.10: * Fix some security issues (thx @frankmorgner): https://www.x41-dsec.de/lab/advisories/x41-2018-003-pam_pkcs11/ (drop 0001-verify-using-a-nonce-from-the-system-not-the-card.patch, 0002-fixed-buffer-overflow-with-long-home-directory.patch, 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch). * Fix buffer overflow with long home directory. * Fix wiping secrets (now using OpenSSL_cleanse()). * Verify using a nonce from the system, not the card. * Fix segfalt when checking CRLs (drop pam_pkcs11-crl-check.patch). - Add rcpkcs11_eventmgr service symlink. - Fix for bsc#1221255: * Add patch 0001-Set-slot_num-configuration-parameter-to-0-by-default.patch - Change nssdb path to /etc/pki/nssdb (bnc#463469). - Make libdir paths in pam_pkcs11.conf biarch-wise. - Updated to version 0.6.8: * Code cleanup. * Bug fixes. * Translation updates. - Fix build for Tumbleweed: * Add pam_pkcs11-0.6.8-fix-crypto-cflags.patch * Rebuild configure with the bootstrap script (add libtool as build dependency) - Updated to version 0.6.9: * Upstream web moved. * pkcs11_listcerts: Do not fail on certificate error. * Do not fail if card was already unlocked. * Other bug fixes. * Translation updates. - Drop upstreamed pam_pkcs11-0.6.8-fix-crypto-cflags.patch. - Work around incorrect upstream release process not calling "make dist". - Split API documentation into a separate package pam_pkcs11-devel-doc. - Add pam_pkcs11-fsf-address.patch. - add service file bsc#1049219 - Repair bulletpoint that skidded in description. Trim description of %name-devel-doc, it does not cotain the programs. - Fix segfault and fetch problems when checking CRLs (pam_pkcs11-crl-check.patch). - Address security issues found by X41 D-Sec audit (bsc#1105012) * Authentication Replay * Buffer Overflow * Memory not cleaned properly before free() - add patches: * 0001-verify-using-a-nonce-from-the-system-not-the-card.patch * 0002-fixed-buffer-overflow-with-long-home-directory.patch * 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch - Update to version 0.6.10: * Fix some security issues (thx @frankmorgner): https://www.x41-dsec.de/lab/advisories/x41-2018-003-pam_pkcs11/ (drop 0001-verify-using-a-nonce-from-the-system-not-the-card.patch, 0002-fixed-buffer-overflow-with-long-home-directory.patch, 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch). * Fix buffer overflow with long home directory. * Fix wiping secrets (now using OpenSSL_cleanse()). * Verify using a nonce from the system, not the card. * Fix segfalt when checking CRLs (drop pam_pkcs11-crl-check.patch). - Add rcpkcs11_eventmgr service symlink. - Fix for bsc#1221255: * Add patch 0001-Set-slot_num-configuration-parameter-to-0-by-default.patch - Updated to version 0.6.0: * compiler warning fixes * I18N support * new configuration options * support for new environment variables * new tool pkcs11_setup * support for the NSS crypto libraries (off by default) * for more changes see ChangeLog.svn - Build with NSS instead of openssl. - Applied patches from Jacob Berkman: MS UPN OID and NSS configuration. - Fixed implicit declaration. - use the same directory for nssdb as the kerberos pkinit plugin - added baselibs.conf file to build xxbit packages for multilib support - Fixed uninitialized variable (bnc#351207). - Fixed all implicit declarations. - Supplement pam-32bit/pam-64bit in baselibs.conf (bnc#354164). - Updated to version 0.6.1: * Added functions to API. * Fixes from openSUSE packages upstreamed. * Minor fixes. * Translaton updates. - package baselibs.conf - Updated to version 0.6.6: * Compatible with pcsc-lite-1.6. * New mapper API. * Minor fixes. * Translaton updates. - Change nssdb path to /etc/pki/nssdb (bnc#463469). - Make libdir paths in pam_pkcs11.conf biarch-wise. - Updated to version 0.6.8: * Code cleanup. * Bug fixes. * Translation updates. - Fix build for Tumbleweed: * Add pam_pkcs11-0.6.8-fix-crypto-cflags.patch * Rebuild configure with the bootstrap script (add libtool as build dependency) - Updated to version 0.6.9: * Upstream web moved. * pkcs11_listcerts: Do not fail on certificate error. * Do not fail if card was already unlocked. * Other bug fixes. * Translation updates. - Drop upstreamed pam_pkcs11-0.6.8-fix-crypto-cflags.patch. - Work around incorrect upstream release process not calling "make dist". - Split API documentation into a separate package pam_pkcs11-devel-doc. - Add pam_pkcs11-fsf-address.patch. - add service file bsc#1049219 - Repair bulletpoint that skidded in description. Trim description of %name-devel-doc, it does not cotain the programs. - Fix segfault and fetch problems when checking CRLs (pam_pkcs11-crl-check.patch). - Address security issues found by X41 D-Sec audit (bsc#1105012) * Authentication Replay * Buffer Overflow * Memory not cleaned properly before free() - add patches: * 0001-verify-using-a-nonce-from-the-system-not-the-card.patch * 0002-fixed-buffer-overflow-with-long-home-directory.patch * 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch - Update to version 0.6.10: * Fix some security issues (thx @frankmorgner): https://www.x41-dsec.de/lab/advisories/x41-2018-003-pam_pkcs11/ (drop 0001-verify-using-a-nonce-from-the-system-not-the-card.patch, 0002-fixed-buffer-overflow-with-long-home-directory.patch, 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch). * Fix buffer overflow with long home directory. * Fix wiping secrets (now using OpenSSL_cleanse()). * Verify using a nonce from the system, not the card. * Fix segfalt when checking CRLs (drop pam_pkcs11-crl-check.patch). - Add rcpkcs11_eventmgr service symlink. - Fix for bsc#1221255: * Add patch 0001-Set-slot_num-configuration-parameter-to-0-by-default.patch - Change nssdb path to /etc/pki/nssdb (bnc#463469). - Make libdir paths in pam_pkcs11.conf biarch-wise. - Updated to version 0.6.8: * Code cleanup. * Bug fixes. * Translation updates. - Fix build for Tumbleweed: * Add pam_pkcs11-0.6.8-fix-crypto-cflags.patch * Rebuild configure with the bootstrap script (add libtool as build dependency) - Updated to version 0.6.9: * Upstream web moved. * pkcs11_listcerts: Do not fail on certificate error. * Do not fail if card was already unlocked. * Other bug fixes. * Translation updates. - Drop upstreamed pam_pkcs11-0.6.8-fix-crypto-cflags.patch. - Work around incorrect upstream release process not calling "make dist". - Split API documentation into a separate package pam_pkcs11-devel-doc. - Add pam_pkcs11-fsf-address.patch. - add service file bsc#1049219 - Repair bulletpoint that skidded in description. Trim description of %name-devel-doc, it does not cotain the programs. - Fix segfault and fetch problems when checking CRLs (pam_pkcs11-crl-check.patch). - Address security issues found by X41 D-Sec audit (bsc#1105012) * Authentication Replay * Buffer Overflow * Memory not cleaned properly before free() - add patches: * 0001-verify-using-a-nonce-from-the-system-not-the-card.patch * 0002-fixed-buffer-overflow-with-long-home-directory.patch * 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch - Update to version 0.6.10: * Fix some security issues (thx @frankmorgner): https://www.x41-dsec.de/lab/advisories/x41-2018-003-pam_pkcs11/ (drop 0001-verify-using-a-nonce-from-the-system-not-the-card.patch, 0002-fixed-buffer-overflow-with-long-home-directory.patch, 0003-fixed-wiping-secrets-with-OpenSSL_cleanse.patch). * Fix buffer overflow with long home directory. * Fix wiping secrets (now using OpenSSL_cleanse()). * Verify using a nonce from the system, not the card. * Fix segfalt when checking CRLs (drop pam_pkcs11-crl-check.patch). - Add rcpkcs11_eventmgr service symlink. - Fix for bsc#1221255: * Add patch 0001-Set-slot_num-configuration-parameter-to-0-by-default.patch - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Shared library policy: new subpackage libpci3 - pciutils-endianh.patch Use the documented/optimized byteswapping routines from endian.h - Add Source URL, see https://en.opensuse.org/SourceUrls - Update to 3.2.0 * On newer Linux systems, we use libkmod to look up kernel modules (modules.pcimap no longer exists.) To facilitate this, libpci is able to look up module aliases in sysfs. * Various minor bug fixes. * Updated pci.ids to the today's snapshot of the database. - Update to 3.1.10 * Decoding of LTR/OBFF in PCIe capabilities. * Various minor bug fixes. * Updated pci.ids to the today's snapshot of the database. - rebase patches - require libkmod - Remove COPYING from obs it is in tarball directly - Version bump to 3.2.1: * CardBus bridge capabilities are displayed. * PCIe L1 PM substates are decoded. * Various bugs were fixed in decoding of PCIe capabilities. * The sysfs back-end does not spit out unnecessary warnings when empty slots report only a partial device address. This actually happens on IBM pSeries. * Updated pci.ids to the today's snapshot of the database. - Cleanup with spec-cleaner - Add obsoletes/provides to baselibs.conf. - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Version bump to 3.3.0: * Device names exported by BIOS are displayed on Linux. * On Linux systems, HWDB is used to look up device names when our ID database gives no match. (More precisely, HWDB is consulted after local pci.ids, but before using network to query online pci.ids.) Thanks to Tom Gundersen for the initial patch. * Added experimental back-end for OS X / Darwin. Thanks to Richard Yao for providing it. * Filters now support matching by device class. Original patch by Matthew Wilcox, wrappers for ABI compatibility by me. * Interrupt Pin and Interrupt Line registers are displayed for bridge devices, too. * Several portability bugs have been fixed. * Several typos have been fixed. Also, use of questionable constructs in man pages has been reduced. * PCIe link capabilities now include the ASPMOptComp bit. * The "CRS Software Visibility" bit is now decoded properly. * Updated pci.ids to the current snapshot of the database. - Refresh patch: * pciutils-endianh.patch - Update to 3.3.1 * Removed hacks for backward compatibility with Linux libc5, which were breaking newer non-glibc Linux systems. Thanks to Felix Janda. * Display VirtIO vendor-specific capability. Patch by Gerd Hoffmann. * Fixed memory leak in name cache. * Updated pci.ids to the current snapshot of the database. - Update to 3.4.0 * On Linux, we report NUMA nodes of devices. * The sysfs back-end does not die on read errors of optional attributes. Instead, a warning is produced. * Fixed several minor bugs. * Updated pci.ids to the current snapshot of the database. - Summary update - Version update to 3.4.1: * New capabilities decoded: Process Address Space, Page Request Interface, Enhanced Allocation. Thanks to David Daney and David Woodhouse. * DevCap SlotPowerLimit is now decoded for all components with upstream ports. - Update to version 3.5.0: * New capabilities decoded: Downstream Port Containment, Precision Time Measurement. Thanks to Keith Busch and Jonathan Yong. * Domain numbers extended to 31 bits. This will be used by the Linux kernel on some machines in near future. * Enhanced allocation regions are now decoded on Linux. * The NetBSD back-end supports PCIe extended configuration space. * Updated pci.ids to the current snapshot of the database. - Update to version 3.5.1: * Fixed symbol versioning of pci_init(). - Update to version 3.5.4: * Previous version broke compilation on systems, for which lib/types.h did not provide a 64-bit integer type. It is provided everywhere now. - Changes for version 3.5.3: * When lspci looks for Linux kernel modules, it uses the default path to module directory provided by libkmod. Previously, it tried to construct the path explicitly, which need not work on all systems. * Improved formatting of memory and I/O ranges behind a bridge. * PCIe link capabilities now display GEN4 speed (16GT/s). * PCIe device capabilities now show bits related to atomic operations. - Changes for version 3.5.2: * The L1 power management capability is now decoded more thoroughly. Thanks to Rajat Jain for the patch. * The table of configuration registers used by setpci had a bug in the definition of SUBSYSTEM_VENDOR_ID. - Update to version 3.5.5 * Better decoding of AER capability. * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges. * Minor fixes of decoding other capabilities. * As usual, updated pci.ids to the current snapshot of the database. - cleanup with spec-cleaner - switch from ftp to https - track signature - Update to version 3.5.6 * MN VPD keyword is decoded correctly. * As usual, updated pci.ids to the current snapshot of the database. * FreeBSD back-end: read-only access for non-root, support DragonFly BSD, support extended config space. - Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587). Added: * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch * pciutils-VPD-Cleanup.patch * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch - Add decode support for RCECs [jsc#SLE-13735] - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc + pciutils-add-decode-support-for-RCECs.patch - Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch (bsc#1192862) - Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a buffer overflow error that would cause lspci to crash on systems with complex topologies. [bsc#1215265] - Add "pciutils.keyring" so that the tarball's signature can be verified at build time. - Use "%license" tag instead of "%doc" to install the package's license file. - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - Updated to version 1.8.19: * SCardGetStatusChange(): Fix a (rare) race condition * Doxygen updates * pcsc-spy: - fix display of execution time - log the thread number in the results * Some other minor improvements - Updated to version 1.8.20 * Fix a crash and potential security issue in pcscd (bsc#1017902, CVE-2016-10109, CWE-415, CWE-416) - Updated to version 1.8.21 * SCardCancel(): - fix a race condition bug - fix a possible use after free - improve Doxygen documentation * SCardGetStatusChange(): fix a race condition when a reader is removed * SCardDisconnect(): fix status update for SCARD_UNPOWER_CARD * pcsc_stringify_error(): use Thread-local storage * pcsc_stringify_error() now returns a const char * * SCardControl() may return SCARD_E_INSUFFICIENT_BUFFER when pbRecvBuffer is not big enough to receive the card response. * Fix compilation error with GCC 4.9 * UnitaryTests: add support of Python 3 * pcsc-spy: add support of Python 3 * Some other minor improvements - Updated to version 1.8.22 * SCardCancel() was broken in 1.8.21. The call was blocking. * Enable use of info level logging for pcscd using -i/--info - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Rename local defines USER/GROUP to PKG_USER/PKG_GROUP: the variable GROUP (call caps) has been claimed by RPM 4.14. - Updated to version 1.8.23 * use libsystemd instead sd-daemon.{c,h} * spy: add support SCardStatus() with NULL pcbAtrLen * Some other minor improvements - remove --auto-exit from service start even if we have socket activation in place (using it as a lightweight approach to unconditional service enablement (reference boo#1063983 and to help workaround boo#1063985) - Use python3 (bsc#1082129, pcsc-lite-python3.patch). - extended sysconfig template to include PCSCLITE_FILTER_IGNORE_READER_NAMES env variable which is used by pcscd to ignore certain readers (patch by Eric Garreau) - Updated to version 1.8.24 * SCardGetStatusChange(): Fix a rare race condition * SCardReleaseContext(): do not release a lock owned by another context * SCardReconnect(): suspend card auto power off * Allow "=" in serial driver filenames * Add the thread id in the pcscd log lines * pcsc-spy: correctly handle incomplete log file * Simclist: avoid to divide by zero in list_findpos() * Some other minor improvements - Trim filler wording from description. - Updated to version 1.8.25 * Fix a socket issue when pcscd is used inside LXC container * pcsc-spy: always provide a total time of execution * Fix resource leak if SCardEstablishContext() fails * Fix realloc(3) error handling (possible memory leak) * Remove usage of function chmod(2) to use fchmod(2) (fix race condition) - bsc#1130588: Require shadow instead of old pwdutils - Updated to version 1.8.26 * Use poll() instead of select() to allow file descriptor higher than FD_SETSIZE * Enable reader filtering by default * pcsc-spy: - Do not read output buffer after error - Adjust code to handle autoallocated buffers - fix year-2038 issue by using long instead of int * Android: fix compilation * polkit: log the error message if polkit_authority_get_sync() fails * Exit with EXIT_SUCCESS on shutdown to please systemd * Fix a minor memory leak - BuildRequire pkgconfig(libudev) instead of libudev-devel: allow OBS to shortcut through -mini flavors. - Updated to version 1.9.0 * SCardEndTransaction(): greatly improve performances (x300) * tokenparser: accept any Unicode character in a reader name * Use /run instead of /var/run by default * Fix a memory leak from a polkit call * Some other minor improvements - version 1.9.1 * Do not (possibly) lock a reader if allocating hCard fails * Fix a hang in SCardTransmit() * Do not report an error if the wrong interface is used by the driver * Update reader state when a card is removed during an exchange * readerfactory: Make sure a freed Reader Context is not accessed * PHSetProtocol(): supports T=0&1 cards on T=0 reader * hotplug-libusb: . support CCIDCLASSDRIVER . add interface name to reader name . remove obsolete libhal scheme * Some other minor improvements - version 1.9.3 * fix a stupid regression with systemd introduced in the previous version - version 1.9.2 * improve NetBSD support * pcsc-spy: version 1.1 . add option -t|--thread . x10 speed increase . correctly exit at end-of-file . remove, now useless, support of macOS * SetProtocol: Handle IFD_NOT_SUPPORTED from the driver * hotplug_libudev.c: sanitize interface name * pcsc_demo: change licence from GPLv3 to BSD * use Python 3 for Python scripts (psc-spy, UnitaryTests) * Some other minor improvements - remove obsolete pcsc-lite-python3.patch - version 1.9.4 * fix a memory leak when libusb is used for hotplug (i.e. non-Linux systems) - Added hardening to systemd service(s) (bsc#1181400). Added patch(es): * harden_pcscd.service.patch - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - merge gh#openSUSE/perl-bootloader#123 - Accept sysconfig values without quotes - 0.926 - merge gh#openSUSE/perl-bootloader#126 - always install EFI fallback boot for aarch64 (bsc#1167015) - 0.927 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#123 - Accept sysconfig values without quotes - 0.926 - merge gh#openSUSE/perl-bootloader#126 - always install EFI fallback boot for aarch64 (bsc#1167015) - 0.927 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#123 - Accept sysconfig values without quotes - 0.926 - merge gh#openSUSE/perl-bootloader#126 - always install EFI fallback boot for aarch64 (bsc#1167015) - 0.927 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#123 - Accept sysconfig values without quotes - 0.926 - merge gh#openSUSE/perl-bootloader#126 - always install EFI fallback boot for aarch64 (bsc#1167015) - 0.927 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#161 - support old grub versions (<= 2.02) that used /usr/lib (bsc#1218842) - create EFI boot fallback directory if necessary - 0.946 - merge gh#openSUSE/perl-bootloader#166 - log grub2-install errors correctly (bsc#1221470) - 0.947 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#161 - support old grub versions (<= 2.02) that used /usr/lib (bsc#1218842) - create EFI boot fallback directory if necessary - 0.946 - merge gh#openSUSE/perl-bootloader#166 - log grub2-install errors correctly (bsc#1221470) - 0.947 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#161 - support old grub versions (<= 2.02) that used /usr/lib (bsc#1218842) - create EFI boot fallback directory if necessary - 0.946 - merge gh#openSUSE/perl-bootloader#166 - log grub2-install errors correctly (bsc#1221470) - 0.947 - merge gh#openSUSE/perl-bootloader#127 - use correct target name on aarch64 (bsc#1172293) - 0.928 - merge gh#openSUSE/perl-bootloader#128 - Do not warn about missing SECURE_BOOT sysconfig - 0.929 - merge gh#openSUSE/perl-bootloader#130 - Throw less warnings about fstab - 0.930 - merge gh#openSUSE/perl-bootloader#129 - Check tpm.mod in the new grub2 directory (bsc#1174320) - 0.931 - merge gh#openSUSE/perl-bootloader#131 - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader (bsc#1157550 jsc#SLE-11500). - 0.932 - merge gh#openSUSE/perl-bootloader#133 - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020) - 0.933 - merge gh#openSUSE/perl-bootloader#134 - install with --removable if efivars are not writable (bsc#1182749, bsc#1174111, bsc#1184160) - fix whitespace - 0.934 - merge gh#openSUSE/perl-bootloader#135 - fix typo in update-bootloader - 0.935 - merge gh#openSUSE/perl-bootloader#136 - report error if config file could not be updated (bsc#1188768) - 0.936 - merge gh#openSUSE/perl-bootloader#137 - grub2 install: Support secure boot on powerpc (bsc#1192764 jsc#SLE-18271). - 0.937 - merge gh#openSUSE/perl-bootloader#138 - grub2/install: reset error code when passing through recover code (bsc#1198197) - 0.938 - merge gh#openSUSE/perl-bootloader#139 - fix sysconfig parsing (bsc#1198828) - 0.939 - merge gh#openSUSE/perl-bootloader#140 - add basic support for systemd-boot - 0.940 - merge gh#openSUSE/perl-bootloader#141 - systemd-boot: easier initial setup - 0.941 - merge gh#openSUSE/perl-bootloader#142 - use fw_platform_size to distinguish between 32 bit and 64 bit UEFI platforms (bsc#1208003) - 0.942 - merge gh#openSUSE/perl-bootloader#147 - UEFI: update also default location, if it is controlled by SUSE (bsc#1210799, bsc#1201399) - 0.943 - merge gh#openSUSE/perl-bootloader#152 - use signed grub EFI binary when updating grub in default EFI location (bsc#1210799) - check whether grub2-install supports --suse-force-signed option - 0.944 - merge gh#openSUSE/perl-bootloader#157 - bootloader_entry script can have an optional 'force-default' argument (bsc#1215064) - skip warning about unsupported options when in compat mode - 0.945 - merge gh#openSUSE/perl-bootloader#161 - support old grub versions (<= 2.02) that used /usr/lib (bsc#1218842) - create EFI boot fallback directory if necessary - 0.946 - merge gh#openSUSE/perl-bootloader#166 - log grub2-install errors correctly (bsc#1221470) - 0.947 - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.0: * "git send-email" learned the "--sendmail-cmd" command line option and the "sendemail.sendmailCmd" configuration variable, which is a more sensible approach than the current way of repurposing the "smtp-server" that is meant to name the server to instead name the command to talk to the server. * The userdiff pattern for C# learned the token "record". * "git rev-list" learns to omit the "commit <object-name>" header lines from the output with the `--no-commit-header` option. * "git worktree add --lock" learned to record why the worktree is locked with a custom message. * internal improvements including performance optimizations * a number of bug fixes - Added hardening to systemd service(s) (bsc#1181400). Modified: * git-daemon.service - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - git 2.33.1: * fix "git pull" and "git rebase -r" various corner cases and bugs * "git commit --fixup" now works with "--edit" again. * Fix "git send-email" unwanted threading * Fix output from "git fast-export" anonymization feature showing an annotated tag incorrectly. * Fixes for various command output * fix "git difftool --dir-diff" mishandling symbolic links * Redact sensitive data in the HTTP trace for HTTP/2 requests * further bug fixes for various git operations - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Add CONFIG parameter to %sysusers_generate_pre - Remove unneeded SHELL in git-daemon.conf - Fix sysusers usage in spec file - Require nogroup group for %pre (bsc#1192023) - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - git 2.34.0: * Release notes: https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - fix url - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - update to 2.34.1 (bsc#1193722): * "git grep" looking in a blob that has non-UTF8 payload was completely broken when linked with certain versions of PCREv2 library in the latest release. * "git pull" with any strategy when the other side is behind us should succeed as it is a no-op, but doesn't. * An earlier change in 2.34.0 caused JGit application (that abused GIT_EDITOR mechanism when invoking "git config") to get stuck with a SIGTTOU signal; it has been reverted. * An earlier change that broke .gitignore matching has been reverted. * SubmittingPatches document gained a syntactically incorrect mark-up, which has been corrected. - update to 2.35.0: * "_" is now treated as any other URL-valid characters in an URL when matching the per-URL configuration variable names. * The color palette used by "git grep" has been updated to match that of GNU grep. * "git status --porcelain=v2" now show the number of stash entries with --show-stash like the normal output does. * "git stash" learned the "--staged" option to stash away what has been added to the index (and nothing else). * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for the newly created branch if "git init" is run. * Various operating modes of "git reset" have been made to work better with the sparse index. * "git submodule deinit" for a submodule whose .git metadata directory is embedded in its working tree refused to work, until the submodule gets converted to use the "absorbed" form where the metadata directory is stored in superproject, and a gitfile at the top-level of the working tree of the submodule points at it. The command is taught to convert such submodules to the absorbed form as needed. * The completion script (in contrib/) learns that the "--date" option of commands from the "git log" family takes "human" and "auto" as valid values. * "Zealous diff3" style of merge conflict presentation has been added. * The "git log --format=%(describe)" placeholder has been extended to allow passing selected command-line options to the underlying "git describe" command. * "default" and "reset" have been added to our color palette. * The cryptographic signing using ssh keys can specify literal keys for keytypes whose name do not begin with the "ssh-" prefix by using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256"). * "git fetch" without the "--update-head-ok" option ought to protect a checked out branch from getting updated, to prevent the working tree that checks it out to go out of sync. The code was written before the use of "git worktree" got widespread, and only checked the branch that was checked out in the current worktree, which has been updated. * "git name-rev" has been tweaked to give output that is shorter and easier to understand. * "git apply" has been taught to ignore a message without a patch with the "--allow-empty" option. It also learned to honor the "--quiet" option given from the command line. * The "init" and "set" subcommands in "git sparse-checkout" have been unified for a better user experience and performance. * Many git commands that deal with working tree files try to remove a directory that becomes empty (i.e. "git switch" from a branch that has the directory to another branch that does not would attempt remove all files in the directory and the directory itself). This drops users into an unfamiliar situation if the command was run in a subdirectory that becomes subject to removal due to the command. The commands have been taught to keep an empty directory if it is the directory they were started in to avoid surprising users. * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is done to a piece of e-mail without a patch in it. * The default merge message prepared by "git merge" records the name of the current branch; the name can be overridden with a new option to allow users to pretend a merge is made on a different branch. * The way "git p4" shows file sizes in its output has been updated to use human-readable units. * "git -c branch.autosetupmerge=inherit branch new old" makes "new" to have the same upstream as the "old" branch, instead of marking "old" itself as its upstream. - update to 2.35.1: * fix "rebase" and "stash" in a secondary worktree - "Downgrade" git-gui and gitk Recommends to Suggests. - fix deps for SLES 12 - git 2.35.2 (CVE-2022-24765, bsc#1198234): * CVE-2022-24765: git may execute commands defined by other users from unexpected worktrees - Require bash in git-daemon because the service file uses it - Reword git-daemon.service description to get a useful sentence in journalctl -b - git 2.35.3: * usability fix-up for CVE-2022-24765 bsc#1198234: '*' can be used as the value for the `safe.directory` variable to signal that the user considers that any directory is safe. * The code that was meant to parse the new `safe.directory` configuration variable was not checking what configuration variable was being fed to it - Follow up fix for CVE-2022-24765, potential command injection via git worktree. (CVE-2022-29187, bsc#1201431) * fix-CVE-2022-29187.patch - Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution (CVE-2022-39260, bsc#1204456) fix-CVE-2022-39260.patch - Fix CVE-2022-39253, dereference issue with symbolic links via the `--local` clone mechanism (CVE-2022-39253, bsc#1204455) fix-CVE-2022-39253.patch - Fix CVE-2022-41903, heap overflow in `git archive` and `git log --format` (CVE-2022-41903, bsc#1207033) * fix-CVE-2022-41903.patch - Fix CVE-2022-23521, gitattributes parsing integer overflow (CVE-2022-23521, bsc#1207032) - Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked into using its local clone optimization even when using a non-local transport (CVE-2023-22490, bsc#1208027) - Fix CVE-2023-23946, a path outside the working tree can be overwritten as the user who is running "git apply" (CVE-2023-23946, bsc#1208028) * fix-CVE-2023-22490-1.patch * fix-CVE-2023-22490-2.patch * fix-CVE-2023-22490-3.patch * fix-CVE-2023-22490-4.patch - Apply "CVE-2023-25652.patch" to fix a security vulnerability where by feeding a specially crafted input to `git apply - -reject`, a path outside the working tree could be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686] - Apply "CVE-2023-25815.patch" to fix a security vulnerability that exists when Git is compiled with runtime prefix support and runs without translated messages, then it still used the gettext machinery to display messages, which subsequently potentially looked for translated messages in unexpected places. This allowed for malicious placement of crafted messages. [CVE-2023-25815, bsc#1210686] - Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch", "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a security vulnerability that occurred when renaming or deleting a section from a configuration file, then certain malicious configuration values might have been misinterpreted as the beginning of a new configuration section, leading to arbitrary configuration injection. [CVE-2023-29007, bsc#1210686] - Downgrade openssh dependency to recommends (bsc#1215533) - gitweb.cgi AppArmor profile - make the profile a named profile - add local/ include to make custom additions easier - Add rule for /etc/gitconfig in gitweb.cgi apparmor profile (bsc#1216501). - Do not replace apparmor configuration, fixes bsc#1216545 - Fix CVE-2024-32002, recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion, bsc#1224168 * CVE-2024-32002.patch - Fix CVE-2024-32004, arbitrary code execution during local clones, bsc#1224170 * CVE-2024-32004.patch - Fix CVE-2024-32020, file overwriting vulnerability during local clones, bsc#1224171 * CVE-2024-32020-1.patch * CVE-2024-32020-2.patch * CVE-2024-32020-3.patch * CVE-2024-32020-4.patch - Fix CVE-2024-32021, git may create hardlinks to arbitrary user-readable files, bsc#1224172 - Fix CVE-2024-32465, arbitrary code execution during clone operations, bsc#1224173 * CVE-2024-32465.patch - Add CVE-2024-24577.patch * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) - usr.share.git-web.gitweb.cgi: Fix syntax error with old apparmor versions (bsc#1229029) - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - Move parent.pm to perl-base, used by File::Temp - Update to perl-5.24.1 - Di switch is now required for PerlIO debugging output Previously PerlIO debugging output would be sent to the file specified by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid and the -T or -t switches hadn't been parsed yet. If perl performed output at a point where it hadn't yet parsed its switches this could result in perl creating or overwriting the file named by "PERLIO_DEBUG" even when the -T switch had been supplied. Perl now requires the -Di switch to produce PerlIO debugging output. By default this is written to "stderr", but can optionally be redirected to a file by setting the "PERLIO_DEBUG" environment variable. If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG" is ignored and the debugging output is sent to "stderr" as for any other - D switch. Core modules and tools no longer search "." for optional modules The tools and many modules supplied in core no longer search the default current directory entry in @INC for optional modules. For example, Storable will remove the final "." from @INC before trying to load Log::Agent. This prevents an attacker injecting an optional module into a process run by another user where the current directory is writable by the attacker, e.g. the /tmp directory. - Refresh patches - Fix building with zlib-1.2.10 (RT#119762): * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Remove patch from previous commit, does not work: * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch - Add patch taken from upstream release instead: * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.0 * "." no longer in @INC * "do" may now warn * regexp: a literal left brace "{" should be escaped * lexical subroutines are no longer experimental * indented Here-documents * new regular expression modifier /xx * declaring a reference to a variable * unicode 9.0 is now supported * new Hash Function For 64-bit Builds - rename perl-5.24.0.dif to perl-5.26.0.dif - remove obsolete perl-avoid-warnings.patch - remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch - update to perl-5.26.1 * [CVE-2017-12837] Heap buffer overflow in regular expression compiler * [CVE-2017-12883] Buffer over-read in regular expression parser * tons of bug fixes - update list of obsoletes - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add perl-reproducible.patch to make build reproducible (boo#1047218) - ignore make check transient errors for PowerPC that are reported since 20170907 bypass boo#1063176 new patch: perl_skip_flaky_tests_powerpc.patch - posix-sigaction.patch: make sure Perl_sighandler is always installed with SA_SIGINFO (bsc#1064697) - Use %license (boo#1082318) - fix Archive::Tar directory traversal vulnerability [bnc#1096718] [CVE-2018-12015] new patch: perl-archive-tar-dirtrav.diff - fix heap-based buffer overflow in regex [bnc#1114686] [CVE-2018-18314] new patch: perl-extended-charclass-assert.diff - fix heap-buffer-overflow read if regex contains \0 chars [bnc#1114681] [CVE-2018-18313] new patch: perl-regcomp-strchr-memchr.diff - fix reg_node overrun [bnc#1114675] [CVE-2018-18312] new patch: perl-reg-node-overrun.diff - fix integer overflow with oversize environment [bnc#1114674] [CVE-2018-18311] new patch: perl-setenv-integer-wrap.diff - Backport perl-fix2020.patch to make timelocal calls work in the year 2020 [bnc#1102840] [bnc#1160039] new patch: perl-fix2020.patch - Fix various security issues in the study_chunk function [bnc#1171863] [CVE-2020-10543] [bnc#1171864] [CVE-2020-10878] [bnc#1171866] [CVE-2020-12723] new patch: perl-study.diff - Comment out bad warning in features.ph file [bnc#1172348] - Split DB_File module into a seperate perl-core-DB_File package [jsc#SLE-12212] * add Recommends: perl-core-DB_File to the perl package - Fix build with newer glibc versions new patch: perl-saltbits.diff - Stabilize Socket::VERSION comparisons [bnc#1193489] new patch: perl-Stabilize-Socket-VERSION-comparisons.patch - fix File::Path rmtree/remove_tree race condition [bnc#1047178] [CVE-2017-6512] new patch: perl-file_path_rmtree_fchmod.diff - enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484] new patch: perl-cpan_verify_cert.diff - fix space calculation issues in pp_pack.c [bnc#1082216] [CVE-2018-6913] * new patch: perl-pack-overflow.diff - fix heap buffer overflow in regexec.c [bnc#1082233] [CVE-2018-6798] new patch: perl-regexec-heap-overflow.diff - make Net::FTP work with TLS 1.3 [bnc#1213638] new patch: perl-net-ftp-tls13.diff - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Update to version 4.4.2: * Bump to v4.4.2 * Release notes for v4.4.2 * Revert "CI: Temporarily disable all AWS EC2-based tasks" * kube play: only enforce passthrough in Quadlet * Emergency fix for man pages: check for broken includes * CI: Temporarily disable all AWS EC2-based tasks * quadlet system tests: add useful defaults, logging * volume,container: chroot to source before exporting content * install sigproxy before start/attach * Update to c/image 5.24.1 * events + container inspect test: RHEL fixes * Bump to v4.4.2-dev - Remove patches (merged upstream): * volume-container-chroot-to-source-before-exporting-content.patch - podman.spec: add `crun` requirement for quadlet (https://github.com/containers/podman/pull/17601) - Add patch to let quadlet use the default runtime Added patch: * Quadlet-use-the-default-runtime.patch => Remove dependency on crun - Update to version 4.4.3: * Bump to v4.4.3 * Release notes for v4.4.3 * compat: /auth: parse server address correctly * vendor github.com/containers/common@v0.51.1 * pkginstaller: bump Qemu to version 7.2.0 * podman machine: Adjust Chrony makestep config * [v4.4] fix --health-on-failure=restart in transient unit * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * journald: remove initializeJournal() * netavark: only use aardvark ip as nameserver * compat API: network create return 409 for duplicate * fix "podman logs --since --follow" flake * system service --log-level=trace: support hijack * podman-mac-helper: exit 1 on error * bump golang.org/x/net to v0.8.0 * Fix package restore * Quadlet - use the default runtime * Bump to v4.4.3-dev - Remove patch (merged upstream): * Quadlet-use-the-default-runtime.patch (https://github.com/containers/podman/pull/17601) - Update to version 4.4.4: * Bump to v4.4.4 * Release notes for v4.4.4 * libpod: always use direct mapping * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * Bump to v4.4.4-dev - spec: Bump required version for libcontainers-common (bsc#1209495) - Don't build against EoL go versions, fixes bsc#1210299 - Update to version 4.5.0: * Release v4.5.0 * [CI:DOCS] Final release notes for v4.5.0 * Quadlet - do not set log-driver by default * Return title fields as a list * Bump to v4.5.0-dev * Bump to v4.5.0-RC2 * Final release notes for v4.5.0-RC2 * test/e2e: remove unnecessary SkipIfNetavark() calls * test/e2e: deduplicated network test * docs: update podman-network-create.1 * network create: add --interface-name * test/system/252-quadlet.bats: fix flake * Read kube_generate_type from containers.conf * Debian setup: workaround for runc /dev/char/10:200 bug * pkg/rootless: use catatonit from /usr/libexec/podman * rootless: make sure we only use a single pause process * Use atomic config writing strategy for podman machine config files * Add remaining release notes for v4.5.0-RC2 * GHA: Use version instead of SHA for actions * chore(deps): update dependency containers/automation_images to v20230405 * build: pass env by reference * test: retrofit error message * test/system: expect 12 char for short id * vendor: bump containers/(storage, common, buildah, image) * [skip-ci] Update actions/upload-artifact action to v3 * [skip-ci] Update actions/stale action to v8 * [skip-ci] Update actions/setup-go action to v4 * [skip-ci] Update github/issue-labeler action to v2.6 * Fix up codespell errors * Capitalize all uid,gid and id words that are not options in docs * build(deps): bump golang.org/x/tools from 0.7.0 to 0.8.0 in /test/tools * Properly remove the service container during kube down * quadlet: add `UserNS` option key * [CI:DOCS] Release notes for 4.5.0 Part 1 * "podman pull by digest and list --all" test: untag instead of rmi * build(deps): bump golang.org/x/text from 0.8.0 to 0.9.0 * Add renovate.json configuration * CI: postbuild step: skip under nightly treadmill * The `--ulimit` option accepts the name with an `RLIMIT_` prefix both upper and lower case * test/e2e: use custom network config dir where needed * chore: replace `github.com/ghodss/yaml` with `sigs.k8s.io/yaml` * update completion scripts for cobra v1.7.0 * libpod.storageService.CreateContainerStorage(): retrieve ID maps * Fix invalid pod name and hostname during kube generate * e2e tests: fix racy flakes * Cirrus: Enable labeling of EC2 VMs * Cirrus: Fix aarch64 clone_script 404 errors * e2e: GinkgoParallelNode() -> ...Process() * build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.7.0 * build(deps): bump golang.org/x/sys from 0.6.0 to 0.7.0 * [CI:DOCS] --creds and registries * Copr: fix build deps for /usr/bin/envsubst * Don't error when removing non-existant env vars * e2e: healthcheck on stopped container: fix flake * test/apiv2/80-kube.at * test/apiv2/80-kube.at * system service: do not close Body * rm `hack/release.sh` * build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 * add `quadlet -version` flag * add version/rawversion package * quadlet: use `Flag` suffix for variables * quadlet: implement `Tmpfs` option * Bump to v4.5.0-dev * Bump to 4.5.0-rc1 * Update release notes from 4.4 branch * rootless netns: recover from invalid netns * System tests: unverbosify a flake log * Add support for secret exists * Fix Win install task failures with large PR bodies * docs: add `starting` to `HealthCheckResults.Status` * Add support for cgroup_config from containers.conf * libpod: mount safely subpaths * Support Deployment generation with kube generate * Use secret.items to create volume mounts if present * [CI:DOCS] fix typo in --systemd option * rootless: drop preexec hook error message * Edit the docker wrapper to use the install prefix * Update podman-for-windows.md * Quadlet: RemapUsers documentation fixes * speed up image listing * vendor containers/common@e27c30ee9b1b * fix volume-plugin-test flake * Document building Podman remote on Windows hosts * test/e2e: gpg keep stdout/err attached * auto-update: stop+start instead of restart sytemd units * [CI:DOCS] Improve basic tutorial * Update docs/source/markdown/podman-network.1.md * Add debug to --wait test * fix slirp4netns resolv.conf ip with a userns * Quadlet: add support for keep-id with mapping values * Quadlet E2E test - run quadlet as user generator * sqlite: do not `Ping()` after connecting * Quadlet - treat paths starting with systemd specifiers as absolute * Update docs/source/markdown/podman-kube-play.1.md.in * system tests: use CONTAINERS_CONF_OVERRIDE * implement podman machine set for hyperv * [CI:DOCS] Add network subnets info to network man page * CI: retry the golangci install * system tests: fix racey sdnotify test * hyperv: lookup machine on local filesystem first * fix os.IsNotExist() CI check * Ensure that SQLite state handles name-ID collisions * macos pkginstaller: do not fail when podman-mac-helper fails * podman-mac-helper: install: do not error if already installed * build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 * Fix a race around SQLite DB config validation * add CONTAINERS_CONF_OVERRIDE * vendor containers/common@main * docs: minor grammar fix in `--volume` description * sqlite: do not use shared cache * test: podman checkpoint/restore the latest container * stats compat API: return "id" lowercase * Run make codespell * Drop SQLite max connections * sqlite: set connection attributes on open * Fix database locked errors with SQLite * quadlet tests: skip on RHEL8 rootless * Kube Play Doc: Document the support for K8S Secret * New ulimit test: bump up minimum nfiles * logformatter: hide --db-backend, and friendlyize quadlet * Quadlet - add support for relative path in Volume key in .container file * Add service ctr cleanup to PlayKubeDown * fix --health-on-failure=restart in transient unit * Quadlet Doc: Suggest the kill operation for HealthOnFailure * Quadlet - Add support for health checks configuration in .container files * Makefile: allow specifying /lib dir location * Fix option --opts -> --opt * basic hypverv machine implementation * Fix SQLite DB schema migration code * Add support for oom_score_adj value from containers.conf * Use default_ulimits field in containers.conf * CI: test and confirm DESIRED_DATABASE * build(deps): bump github.com/openshift/imagebuilder * logformatter: futureproof output filename * Vendor in latest containers/(storage, common, image) * build(deps): bump google.golang.org/protobuf from 1.29.0 to 1.30.0 * test/system/255-auto-update.bats: add debug logs * Revert "Revert "pasta: Use two connections instead of three in TCP range forward tests"" * Add information for secret inspect * Add format to podman volume ls * Add format to podman volume inspect * Add format to podman secret ls * Add format to podman system df * Add format to podman machine info * Add format table to podman image inspect man page * Cirrus: Store podman machine benchmark data * Update Cirrus display names, and fix get-ci-vm script * Ensure SQLite places uses the runroot in transient mode * Fix various integration test issues with SQLite state * Remove test for pod/container name global uniqueness * Improve handling of existing container names in SQLite * Add SQLite job to CI * buildah treadmill: also run rootless tests * build(deps): bump github.com/vbatts/git-validation in /test/tools * auto update: return restart error * fix: Document removing anonymous volumes * events: no duplicates when streaming during a log rotation * Add search --cert-dir, --creds * podman-mac-helper: exit 1 on error * system service --log-level=trace: support hijack * test/system: fix wait_for_port() to wait for bind * cgroupns: private cgroupns on cgroupv1 breaks --systemd * libpod: remove error stutter * podman events: unhide --stream * test/system/255-auto-update.bats: multiple services * 255-auto-update.bats: turn off rollback where needed * Use append() to add elements to a slice * Revert "pasta: Use two connections instead of three in TCP range forward tests" * Support running nested SELinux container separation * bud tests: rootless remote: use correct socket path * build(deps): bump github.com/vbauerster/mpb/v8 from 8.2.1 to 8.3.0 * compat: /auth: parse server address correctly * docs: fix cmd `set DOCKER_HOST` suggestion * test: reenable idmap test * Must use mountlabel when creating builtin volumes * podman.spec.rpkg: distro conditionals for modulesloaddir * build(deps): bump google.golang.org/protobuf from 1.28.1 to 1.29.0 * podman inspect list network when using --net=host or none * pasta: Re-enable "Local forwarder, IPv4" test, accept NXDOMAIN as response * build(deps): bump golang.org/x/tools from 0.6.0 to 0.7.0 in /test/tools * CI: Switch to c20230307t192532z-f37f36d12 images * Cirrus: Run system & integration tests in parallel * Update checkpointctl v0.1.0 * Quadlet: add support for setting --ip and --ip6 * build(deps): bump golang.org/x/net from 0.7.0 to 0.8.0 * build(deps): bump golang.org/x/sys from 0.5.0 to 0.6.0 * libpod: avoid nil pointer dereference in (*Container).Cleanup * [CI:DOCS] Add image not found info to troubleshooting * cmd: do not require userns for "version" * cmd: drop special handling for "scp" * cmd: clarify meaning of ParentNSRequired * Fix package restore * [CI:DOCS] Fix docs/version-check always requesting updates * sqlite: add a hidden --db-backend flag * fix: update the default machine value when the previously set default machine is deleted * podman machine: Adjust Chrony makestep config * sqlite: add container short ID to network aliases * sqlite: remove dead code * sqlite: addContainer: add named volume only once * sqlite: implement RewriteVolumeConfig * sqlite: LookupVolume: fix partial name match * sqlite: LookupVolume: wrap error * sqlite: fix type rewriting container config * sqlite: return correct error on pod-name conflict * sqlite: RewritePodConfig: update error message * test/system/255-auto-update.bats: wait 10 for update to finish * auto-update test: wait for service to be ready * Vendor in latest containers/(common, storage, image) * play kube: Add --wait option * Cirrus: Fix git config permission denied * Quadlet: Add support for the Mount key in .container files * build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 * fix "podman logs --since --follow" flake * Clarify that replicas are ignored in kubernetes deployment * Revert "Skip all pasta tests" * CI: Switch to c20230223t153813z-f37f36d12 images * Fix user socket path * pkginstaller: bump Qemu to version 7.2.0 * Cirrus: Fix bud tests failing to apply patches * build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.2 * build(deps): bump github.com/coreos/stream-metadata-go * Vendor in latest containers/storage * buildah-bud tests: don't sudo when rootless is desired * Temporarily disable version-check * CI: new rootless buildah-bud tests (cron only) * sqlite: fix volume lookups with partial names * sqlite: fix container lookups with partial IDs * sqlite: fix LookupPod * sqlite: fix pod create/rm * sqlite: LookupContainer: update error message * sqlite: AddContainerExitCode: allow to replace * system: add warning when running rootless on cgroupv1 * sqlite: fix AllContainers with state * sqlite: fix "UPDATE TABLE" typos * sqlite: SaveVolume: fix syntax error updating the volumes table * sqlite: exit code: allow -1 * sqlite: fix typo when removing exec sessions * sqlite: AllContainers: fix inner join * sqlite: move migration after table creation * sqlite: implement pod methods * Quadlet - use the default runtime * docs: context is not optional for build * Fix an incorrect comment on NewSqliteState * Add support for containers.conf database setting * Add support for volume operations to SQLite state * Implement exec session handling in SQL database * Various fixes from code review * Remove `--namespace` flag from Podman root * Get E2E tests to pass * Implement network disconnect for SQLite state * Implement Network Connect/Modify for SQLite state * Fix various lint issues * Some further work on SQLite state * Remove concept of Namespaces from BoltDB * Add initial SQLite-backed state implementation * Cirrus: Support runc testing on debian VMs * Skip all pasta tests * Skip buildah-bud test * Skip buildx test with VFS podman storage driver * Skip 'podman kube --network' test for rootless CGv1 * Skip tests which fail with CGv1 & runc * Skip rootless CGv1 quadlet tests due to issue * Makefile: Define SHELL * Machine refactor for QEMU/AppleHV * machine refactoring preparations for hyperv * [CI:BUILD] spec.rpkg: trim dependency list * Logs follow-until tests: loosen checks * [CI:DOCS] Windows/Mac docs link update * Doc update for docker network options via CLI * compat API: network create return 409 for duplicate * Apply suggestions to man page * vendor c/common@852ca05a1fbb * Quadlet: Add support for LogDriver key in container and kube units * machine refactoring preparations for hyperv * libpod: always use direct mapping * netavark: only use aardvark ip as nameserver * build(deps): bump github.com/container-orchestrated-devices/container-device-interface * podman logs passthrough driver support --cgroups=split * journald logs: simplify entry parsing * podman logs: read journald with passthrough * make docs: sanity check for broken man pages * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.6 to 8.2.0 * build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 * kube: rm secret on down, print secret on play * Fix spacing typo that triggered OCD & indent units in podman-systemd.unit(5) * Update remote_client.md * [CI:DOCS] Add restriction to option README * Revert "CI: Temporarily disable all AWS EC2-based tasks" * build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 * kube play: only enforce passthrough in Quadlet * journald: remove initializeJournal() * auto-update: support pods * Emergency fix for man pages: check for broken includes * System tests: assert(): friendlier failure messages * Cirrus: Fix version-check to only run on `main` job * CI: Temporarily disable all AWS EC2-based tasks * build(deps): bump github.com/containerd/containerd from 1.6.16 to 1.6.18 * volume,container: chroot to source before exporting content * Support sysctl configs via podman kube play * [CI:BUILD] copr: podman.spec.rpkg cleanups * quadlet system tests: add useful defaults, logging * libpod: support relative positions for idmaps * Experimental workaround for cdn03.quay.io flake * system tests: prevent leading tabs * Introduce podman machine os apply * create: add support for --group-entry * fix != filter in volume prune * Allow specification of podman --remote build -f - * Quadlet use crun specified in containers.conf * build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 * Vendor c/image after https://github.com/containers/image/pull/1847 * Don't set hostPort when generating a service * man page --format xref: tighten the autocompletion check * add support for limiting tmpfs size for systemd-specific mnts * build(deps): bump golang.org/x/text from 0.6.0 to 0.7.0 * Add ulimit annotation to kube gen & play * man page xref: validate displayed man page names * quadlet: add ExecStop * install sigproxy before start/attach * build(deps): bump golang.org/x/tools from 0.5.0 to 0.6.0 in /test/tools * Fix typos * Cirrus: Make benchmarks .env file easier to load * Cirrus: Omit functions in env. file * kube play: set service container as main PID when possible * Fix typos. Improve language. * events + container inspect test: RHEL fixes * Add ctrName to network alias during kube play * Run codespell on codebase * podman image scp: added identity for ssh.Exec * [CI:DOCS] Clarify nomap constrains * [CI:DOCS] man-page checker: include --format (Go templates) * Vendor c/image after https://github.com/containers/image/pull/1816 * [CI:DOCS] Cleanup some man pages to display options with line breaks * [CI:DOCS] Add tables to podman-systemd.unit man page * github: remove prefix from bugs/features * Quadlet: Add support for the Secret key in Container group * [CI:DOCS] OWNERS: add @ygalblum and @alexlarsson * build(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 * build(deps): bump github.com/vbauerster/mpb/v8 from 8.1.4 to 8.1.6 * Sort quadlet keys to make it easier to read * e2e: fix some tests on remote * kube play: do not teardown unconditionally on error * Fix typos in comments * Resolve symlink path for qemu directory if possible * #17363 Fix contradicting documentation podman-commit * Fix a potential UID/GID collision in unit tests * golangci-lint: show all errors at once * update golangci-lint to version 1.51.1 * [CI:DOCS] events: document journald identifiers * Quadlet: exit 0 when there are no files to process * network ls: handle removed container * e2e: adapt play kube test on remote rootless * docs/podman-systemd.unit: Explicitely mention network & kube units * docs/podman-systemd.unit: Update example to work out of the box * [CI:BUILD] Cirrus: Fix GraphQL ownerRepository:null error * Add missing return after errors * Revert "Cirrus: Emergency fix to un-stuck PRs" * pasta: Fix ICMPv6 Echo test, skip it for the moment * pasta: Fix ICMP Echo Request (IPv4) test * pasta: Use two connections instead of three in TCP range forward tests * Add SELinux label types support to quadlet * Add quadlet support for rootfs= containers * Cirrus: Emergency fix to un-stuck PRs * Move clean-binaries before podman-remote in podman-remote-docs target * oci: bind mount /sys with --userns=(auto|pod:) * Cleanup podman-systemd.unit file * Install podman-systemd.unit man page, make quadlet discoverable * libpod: allow userns=keep-id for root * system-reset: use CleanCacheMount to clear build cache * vendor: bump buildah to v1.29.1-0.20230201192322-e56eb25575c7 * system tests: fix noexistent labels test in the remote * Expose Podman named pipe in Inspect output * libpod: support idmap for --rootfs * test: adapt test to work on cgroupv1 * Bump to v4.5.0-dev * Update main to reflect v4.4.0 release * Update from /github.com/vbauerster/mpb/v7 to /v8 * hack/perf: cleanup after benchmarks * hack/perf/bz-2162111.sh: use custom network * Update bug_report.yaml * Handle filetype field in kubernetes.yaml files * hack/perf/bz-2162111.sh: measure stop * make hack/markdown-preprocess parallel-safe * system tests: fix volume exec/noexec test * system tests: minor fix for RHEL8 incompatibility * Cirrus: Use versionable IMAGE_SUFFIX * utils: new conversion method * libpod: use GraphRoot for overlay upper dir * vendor: update containers/storage * Do not mount /dev/tty into rootless containers * build(deps): bump go.etcd.io/bbolt from 1.3.6 to 1.3.7 * e2e: fix run_staticip_test about no_proxy * docs: specify order preference for FROM * Fixes port collision issue on use of --publish-all * Support for Windows paths in the source position of the volume mounts * e2e tests: fix incorrect os.User.Name * Log data that we failed to unmarshal * [CI:DOCS] hack/perf: add script for BZ 216111 * container rm: save once for exec removal and state change * [DOCS:CI] podman-events: document verbose create events * e2e: Avoid hard-coding included in quadlet test * e2e: Avoid hard-coding ImageCacheDir * Making gvproxy.exe optional for building Windows installer * Add gvproxy to Windows packages * Add comment to clarify error handling intention * fix #17244: use /etc/timezone where `timedatectl` is missing on Linux * Fix usage of absolute windows paths with --image-path * Match VT device paths to be blocked from mounting exactly * Fix default handling of pids-limit * Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) * journald: podman logs only show logs for current user * journald: podman events only show events for current user * e2e: Remove the cache with "podman unshare rm" when a rootless user * Clean up more language for inclusiveness * e2e: Remove some directories at SynchronizedAfterSuite * fix: don't output "ago" when container is currently up and running * fix: running check error when podman is default in wsl * fix CI: test fail due to merge * Bump Bulidah to v1.29.0 * e2e: reduce dependency on /tmp for e2e tests * Bump cirrus image with easier dependency management * quadlet: Add device support for .volume files * remote,build: error if containerignore is symlink * DB: make loading container states optional * ps: do not sync container * Set runAsNonRoot=true in gen kube * WSL refactoring * kube-play: add support for HostIPC in pod.Spec * Allow --device-cgroup-rule to be passed in by docker API - Update to version 4.5.1: * Release v4.5.1 * [CI:DOCS] Final release notes for v4.5.1 * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * Revert "Resolve symlink path for qemu directory if possible" * no need for podman-next rpm test on maint branch * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * network create/update: allow dns servers comma separated * machine: fix default connection URL to use 127.0.0.1 * compat: accept tag in /images/create?fromSrc * compat container create: match duplicate mounts correctly * machine: qemu only remove connection after confirmation * windows: podman save allow the use of stdout * remote: exec inspect update exec session status * podman-remote logs: handle server error correctly * libpod: stop containers with --restart=always * Do not include image annotations when building spec * [v4.5] system tests: fix race in kube-play read-only * api: fix parsing filters * Support systemd optional prefix '-' for devices. * *: migrate image registry to registry.k8s.io * Makefile: include `release-artifacts` target * [CI:BUILD] Packit: Initial Enablement * Bump to v4.5.1-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Prefer Podman's new network stack (netavark) exclusively on ALP - Remove unused podman-cni-config subpackage, add systemd - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path. - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Update to version 4.6.0: * Bump to v4.6.0 * Update release notes for v4.6.0 * Ensure that we appropriately warn that TCP is insecure * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * api: fix doc for default ps_args * Add more tests for liveness probes with default hostname & named ports * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * [CI:DOCS] fix command incorrect in windows * [CI:DOCS] Reformat and reorder table with --userns options * [CI:DOCS] Better document the default value of --userns * Add missing return after utils.InternalServerError() * Fix markdown in docs for podman-network-create * Fix multiple filter options logic for `podman volume ls ` * Should be checking tmpfs versus type not source * Use constants for mount types * Fix `podman container prune` docs for `--filter` * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * systests: quadlet: fixes for RHEL8 * Fix windows installer * Podmansh: Better error, increase timeout to 30s * Emergency gating-test fixes for RHEL8 * Packit: remove pre-sync action * [CI:DOCS] Update RELEASE_NOTES.md with Makefile change * Bump to v4.6.0-dev * Bump to v4.6.0-rc2 * Makefile: `package` -> `rpm` * Update release notes * system tests: refactor registry code * machine start: qemu: wait for SSH readiness * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * netavark: macvlan networks keep custom nameservers * add hostname to network alias * libpod: set cid network alias in setupContainer() * Fix: cgroup is not set: internal libpod error after os reboot * test/e2e: wait for socket * api: fix slow version endpoint * manifest inspect: support authentication * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * make --syslog errors non fatal * Fixes typo in the path where quadlet looks for files * [CI:DOCS] uidmap man pages: fix corrupt italics * [CI:DOCS] podman-system-service.1.md: document systemd usage * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * pkg/specgen: properly identify image OS on FreeBSD * [CI:DOCS] Document support of pod security context IDs * pkg/specgen: add support for 'podman run --init' on FreeBSD * Remove 'inspecting object' from inspect errors * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Trim whitespace from unit files while parsing * play.go: remove volumes on down -f * Vendor c/common v0.55.2 * system service: unset listen fds on tcp * [CI:DOCS] [Release Notes]: add static routes * [CI:DOCS] tag podmansh as tech preview in RELEASE_NOTES.md * [CI:DOCS] uidmap man pages: fix corrupt tables * libpod: use new libcontainer BlockIO constructors * Bump to v4.6.0-dev * Bump to v4.6.0-rc1 * Bump to v4.6.1-dev * Bump to v4.6.0 * Release notes for v4.6.0 * Update Release Notes for v4.5.1 * rootless: use default_rootless_network_cmd config * tests: fix "Storing signatures" check * Fixes for vendoring Buildah * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Do not use deprecated hook functions from c/common * Bump c/storage to v1.48.0, c/image to v5.26.1, c/common to v0.55.1, buildah to v1.31.0 * pasta: Remove some leftover code from pasta bats tests * pasta: Fix pasta tests to work on hosts with multiple interfaces * fix(command): ignore `--format` in `podman search --list-tags` * Use /proc/self/gid_map as intended, not uid_map * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * pasta: Create /etc/hosts entries for pods using pasta networking * RPM: Fix koji and ELN issues * Cirrus: Update operating branch * system tests: add and use _prefetch * pkg/api: BufferedResponseWriter flush correctly * pkg/api: top return error to client * container wait: support health states * [CI:DOCS] Fix example on PublishPort * container wait API: use string slice instead of state slice * podman wait: update man page * StopContainer(): ignore one more conmon warning * run,create: modify `--env-merge` behavior for non-existent vars * use libnetwork/slirp4netns from c/common * update c/common to latest * e2e: use parallel-safe /dev subdirectories * [CI:BUILD] Help Renovate manage the golangci-lint version * systests: test instrumentation * compat API create/pull: fix error handling * compat API push: fix error handling * GetSafeIPAddress(): discourage its use * libpod: write /etc/{hosts,resolv.conf} once * e2e: fix one of the many log flakes * cmd, push: expose --compression-level * vendor: bump containers/common * compat API container create: handle platform parameter * refactor(machine): remove hard code * vendor in latests containers/common * fix(machine): throw `connect: connection refused` after set proxy * [CI:BUILD] Packit: cleanups * Add console mode to podman machine * e2e: kube test: specify expected exit code * e2e --authfile test: fix test condition * chore(deps): update dependency setuptools to v68 * make lint: re-enable revive * make lint: re-enable ginkgolinter * make lint: enable rowserrcheck * make lint: enable wastedassign * make lint: enable mirror * bump golangci-lint to v1.53.3 * auto update: restart instead of stop+start * cmd/podman/root.go: fix help document issue of the image store * vendor: bump c/storage to v1.46.2-0.20230616083707-cc0d208e5e1c * podman: add support for splitting imagestore * network create --ip-range allow for custom range * fix(ssh): start machine failed to start with exit status 255 * remote wait: fix "removed" condition * [CI:DOCS] Fix service_destinations description in podman man page * quadlet should exit non zero on failures * fix(deps): update module golang.org/x/tools to v0.10.0 * e2e: GetSafeIPAddress() replaces GetRandomIPAddress * pasta: use code from c/common * Add support for setting autoupdate in quadlet * New command: podmansh * vendor: update c/common to latest * Add quadlet container support for Mask,Umask options * libpod: make conmon always log to syslog * Document how to get secret mounts working on RHEL8 * Verify podman pull dup image only prints id once * Vendor in latests containers/common * Apply suggestions from code review * Revert "rootlessport: exclude storage drivers via build tags" * filters: use new FilterID function from c/common * logformatter: ignore 'TOP-LEVEL' headings * test/e2e: fix network ID test * update c/{common,image,storage} to latest * [CI:DOCS] clarify supported transports in manifest push * [CI:DOCS] podman-push: rm confusion on supported transports * container wait: indicate timeout in error * network-create: document new bclim option * fix(deps): update module golang.org/x/text to v0.10.0 * libpod: Podman info output more network information * fix(deps): update module golang.org/x/term to v0.9.0 * quadlet: adjust container unit documentation * e2e: GetRandomIPAddress(): parallelize * Makefile: add support for 'make help' on FreeBSD * criu: return error when checking for min version * Update docs/source/markdown/podman-systemd.unit.5.md * 250-systemd.bats: remove outdated comment * github: add issue type as link to podman-desktop * Add WorkingDir support to quadlet * rootlessport: exclude storage drivers via build tags * Add ability to set static routes * test/upgrade: correctly share mounts between host and container * Update common, image, and storage deps * Fix system service manpage name in API Documentation * style(specgen): omit nil check * fix(specgen): index out of range when unmask=[] * Makefile to force a shell when running command * cirrus,ci: default to overlay for debian env * Quadlet: Add support for --sysctl flag * chore(deps): update dependency requests-mock to ~=1.11.0 * Ignore spurious warnings when killing containers * Makefile: don't hard-code the path for bash * fix(deps): update module github.com/burntsushi/toml to v1.3.2 * GHA: Fix bad job-names & links in monitoring emails * podman-registry: simpler, safer invocations * Ensure our mutexes handle recursive locking properly * Fix an expected error message from pod removal * Fix a race removing multiple containers in the same pod * Discard errors when a pod is already removed * Change Inherit to use a pointer to a container * e2e: add ginkgo decorators to address flakes * filters: better handling of id= * fix(deps): update module github.com/onsi/gomega to v1.27.8 * refactor: improve get ssh path duplicate code * logformatter: better recognition of ginkgo test names * Address review feedback and add manpage notes * Add support for SecurityLabelNested flag in quadlet * fix(deps): update module github.com/burntsushi/toml to v1.3.1 * `system locks` now reports held locks * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.17 * Add a new hidden command, podman system locks * Add number of free locks to `podman info` * Include lock number in pod/container/volume inspect * fix ignition config creation * Makefile binaries target adopted for Mac and Win * fix(deps): update github.com/crc-org/vfkit digest to 3d57f09 * logformatter: proper status color for failed tests * pasta: Test handling of unknown protocols * pasta: Correct handling of unknown protocols * Quadlet - add support for Pull key in .container * fix(deps): update module github.com/sirupsen/logrus to v1.9.3 * Add default ulimit test for gen kube * feat: add insecure registry troubleshooting solution * fix(deps): update module golang.org/x/tools to v0.9.3 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.2 * e2e: GetPort(): safer allocation of random ports * The removeContainer function now accepts a struct * Revert "test/e2e: fix "podman run ipcns ipcmk container test"" * Add a test for removing dependencies with rm -fa * Revert "ginkgo-v2 cleanup workaround for #18180" * Fix a deadlock when removing pods * Pods now return what containers were removed with them * Make RemoveContainer return containers and pods removed * Add an API for removing a container and dependencies * systests: fixes for coping with extra systemd image * libpod: fix timezone handling * fix(deps): update github.com/godbus/dbus/v5 digest to 7623695 * fix(deps): update module golang.org/x/tools to v0.9.2 * test/system: quadlet use correct systemd restart policy * systests: minimize race-condition window * systests: fix improper backgrounding of run_podman * set max ulimits for rootless on each start * Fix: display online_cpus in compat REST API * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.6 * systests: fix race in quadlet tests * fix(deps): update module github.com/burntsushi/toml to v1.3.0 * e2e: make BuildImage parallel-safe * completion: fix panic in simplePathJoinUnix() * Update module github.com/stretchr/testify to v1.8.4 * authfile.md: add default path of file for Windows/macOS. * Update module github.com/rootless-containers/rootlesskit to v1.1.1 * hack: fix typo in hack/podman-registry * man pages and command help: clean up descriptions * RPM: bump gvisor-tap-vsock subpackage and fix packit scripts * Man pages: fix broken tables * test/e2e: add regression testing for comma-containing labels * fix: volume create filters * fix: move filter flags from StringSliceVar to StringArrayVar * pkg/rootless: correctly handle proxy signals on reexec * [CI:BUILD] Packit: set propose-downstream action type to pre-sync * [CI:DOCS] fix Quadlet man page rendering * Quadlet: kube: use ExecStopPost * Quadlet: kube: add ExitCodePropagation field * kube play: exit-code propagation * prune exit codes only when container doesn't exist * podman: Add pasta to podman info * Revert "test/system/255-auto-update.bats: add debug logs" * Quadlet - add support for PodmanArgs to all groups * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * In a concurrent removal test, don't remove concurrently with builds * Consolidate error handling in Runtime.removeContainer * Consolidate error handling in Container.cleanupStorage * Fix reporting errors on container unmount * TEMPORARY(?) instrumentation for unlinkat-ebusy * pkginstaller: bump Qemu to version 8.0.0 * Support podman --remote when Containerfile is not in context directory * chore(deps): update dependency requests to ~=2.31.0 * fix: podman event --filter volume=vol-name should compare the event name with volume name * fix(deps): update module github.com/docker/docker to v24 * wait: look for exit code in stopped state * network create/update: allow dns servers comma separated * source code comments and docs: fix typos, language, Markdown layout * Increase download progress to 80ch * chore(deps): update dependency setuptools to ~=67.8.0 * podman: Added find slirp4netns binary file from helper_binaries_dir [NO NEW TESTS NEEDED] * fix(deps): update module github.com/sirupsen/logrus to v1.9.2 * stats: get mem limit from the cgroup * quadlet tests: enable device.volume test * quadlet tests: remove unused socketactivated.container * fix(deps): update module github.com/stretchr/testify to v1.8.3 * Correct markdown in docs * fix(deps): update module github.com/onsi/gomega to v1.27.7 * [CI:DOCS] Improve security in mysql examples * Cirrus: Record the buildah version for reference * test/e2e: do not call setenforce * Fix discombobulated kubernetes support table * run: ignore PODMAN_USERNS with --pod * Add --configmap to podman-remote kube play * compat: accept tag in /images/create?fromSrc * fix HTMLSpan warnings * generate systemd: error on init containers * Remove future tense from man pages * compat,build: pull must accept string * Cirrus: Add support for `[CI:NEXT]` * Cirrus: Remove support for `[CI:COPR]` magic * system tests: add precision timestamps * Makefile: add ginkgo FOCUS/FOCUS_FILE options * e2e: refactor and document serialization * machine: fix default connection URL to use 127.0.0.1 * e2e: serialize gpg tests * Document podman-machine-default behavior * e2e: fix more test races (missing "wait") * fix(deps): update module github.com/openshift/imagebuilder to v1.2.5 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.5 * Fix documentation of `--network-cmd-path` CLI option * Skip rhel-release branch unnecessary CI tasks * test/e2e: dedup Before/AfterEach nodes * remote-save: fix permissions and dir formats * Set machine docker.sock according to rootful flag * Fix handling of .containenv on tmpfs * Do not include image annotations when building spec * build(deps): bump github.com/docker/distribution * Kube Play - Support multi-doc YAML files for configmap argument * system tests: instrument, to try to catch unlinkat-ebusy * test: check restart policy of init containers * Update sigstore/rekor after https://github.com/sigstore/rekor/pull/1469 * issue template: mention `su` * e2e: logs test: fix flakes * fix(deps): update module github.com/containernetworking/plugins to v1.3.0 * e2e: stop podman.service test: wait for server * logformatter: handle podman-machine test logs * fix(deps): update module golang.org/x/tools to v0.9.1 * [CI:DOCS] Disable Dependabot in favor of Renovate * Ensure the consistent setting of the HOME env variable on container start * Quadlet system tests - fix socket notification * sqlite: disable WAL mode * system tests: timeoutize quadlet, systemd * test: update README for integration tests * libpod/Container.rootFsSize(): use recorded image sizes * quadlet: support `HostName` * e2e: fix race in a play-kube test * Fix preference of user quadlets directories * fix(deps): update module golang.org/x/tools to v0.9.0 * fix(deps): update module golang.org/x/net to v0.10.0 * Check on client side for Containerfile, if none specified * build(deps): bump github.com/docker/docker * Buildah treadmill: several fixes * fix(deps): update github.com/containers/common digest to 3e93a76 * chore(deps): update dependency docker to ~=6.1.0 * Update docs/source/markdown/podman-systemd.unit.5.md * fix(deps): update github.com/containers/common digest to bc15b04 * fix: initContainer restart policy overridden by pod * fix(deps): update module golang.org/x/sync to v0.2.0 * chore(deps): update dependency requests to ~=2.30.0 * ginkgo json output: only in CI, not on laptop runs * Allow user quadlets to be stored under /etc * fix(deps): update github.com/containers/common digest to ea87b34 * libpod: do not Cleanup() more than once * compat container create: match duplicate mounts correctly * Update podman-completion.1.md * fix(deps): update github.com/containers/buildah digest to e925b58 * Run generate.CompleteSpec() for initContainers as well * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.4 * remote: return better connect error * Add missing man page links for Docker man pages * Replace egrep/fgrep with grep -E/-F * remote: exec inspect update exec session status * fix(deps): update github.com/digitalocean/go-qemu digest to f035778 * fix(deps): update github.com/godbus/dbus/v5 digest to 6cc540d * fix(deps): update github.com/containers/buildah digest to f353690 * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.9.3 * MVP for Podman Machine with AppleHV * e2e tests: try writing & preserving ginkgo json artifacts * vendor: bump buildah to v1.30.1-0.20230501124043-3908816d5310 * bindings, build: don't pass invalid platform in case of none * Revert "logformatter: anchors: link to test summary, not name" * More cleanup: volumes: do not export to stdout * e2e test cleanup * Update kube gen & play to use pod restart policy * Add {{.Restarts}} to podman pod ps * Add {{.Restarts}} to podman ps * Add --restart flag to pod create * history: correctly set tags * fix(deps): update module github.com/moby/term to v0.5.0 * Makefile: do not run machine test in parallel * pkg/machine/e2e: switch to GinkgoWriter * api: fix parsing filters * ginkgo-v2 cleanup workaround for #18180 * test/e2e: fix custom timing reporting * logformatter: anchors: link to test summary, not name * WIP: logformatter: handle ginkgo v2 logs * test/e2e: unshare --rootless-netns cleanup slirp4netns * test/e2e: run system reset test serial * test/e2e: fix CleanupVolume/Secrets() * ginkgo v2: fix new Skip() behavior * test/e2e: fix pause tests to unpause before cleanup() * ginkgo v2: drop localbenchmarks * test/e2e: switch to GinkgoWriter * test/e2e: unset CONTAINERS_CONF before Cleanup() * ginkgo: run on all cores * test/e2e: fix Cleanup() * test/e2e: fix "podman run ipcns ipcmk container test" * test/e2e: actually check for cleanup errors * Lower e2e timeout to not waste time when it hangs * test/e2e: containers.conf tests add missing Wait() * ginkgo v2: remove CurrentGinkgoTestDescription() * ginkgo v2: remove deprecated flags * update to ginkgo v2 * test/e2e: do not remove CNI directory * e2e: login_logout: use unique authfile for each test * Fix clashing subuid * [CI:DOCS] troubleshooting: fix subuid example * manifest, push: use source as destination if not specified * Update github.com/moby/term digest to 0564e01 * Add name-generation test * Implement machine provider selection * libpod: improve errors management in cleanupStorage * libpod: report unmount idmapped rootfs errors * test: do not wait 10 seconds before killing myyaml * podman: simplify code with a switch * test: fix typo * build(deps): bump github.com/docker/docker * swagger: fix Info name conflict * Nightly dependency treadmill: remove * Update short description for disconnect cmd * windows: podman save allow the use of stdout * Update c/common and avoid setting umask * Cirrus: Update CI VM Image to F38/37 * Cirrus: Run code validation on rawhide * Fix rand.Seed() deprecation in golang 1.20 * Add sha256: to images history id for docker compatibility * Support systemd optional prefix '-' for devices. * Fix a copy/paste error in an error message * chore(deps): update dependency requests to ~=2.29.0 * Fix simple typo in podman-network-create.md * e2e cleanup: push with auth: add error checks * e2e: remove "-it" from podman run & exec * pkg/machine: rework RemoveConnection() * machine: qemu only remove connection after confirmation * Add file swith for pre-exec * system reset: show graphRoot/runRoot before removal * fix manifest annotate help * Netavark userns test: give aardvark time to come up * sqlite: move first read into a transaction * Recover from failed podman machine start * rootless: support joining contianers that use host ns * auto-update: return errors when checking for updates * [skip-ci] Update dawidd6/action-send-mail action to v3.7.2 * fix(deps): update github.com/containers/common digest to 46c4463 * Add user mode networking feature to Windows * system/reset.go: help: fix typo * e2e create same-IP: try to fix flake * system tests: safer container-stop signaling * Revert "Resolve symlink path for qemu directory if possible" * ps: --format {{.State}} match docker output * test/system/260-sdnotify.bats: fix test flake * [CI:DOCS] Quadlet: clarify overriding user/system services * Eliminate transient container deps from wslkerninst * Wording * fix(deps): update github.com/containers/common digest to 5547996 * cmd/podman/pods: omit superfluous runtime.NumCPU call * support `--digestfile` for remote push * e2e: skip journald test if journald is unavailable * Cirrus: Enable testing on Fedora rawhide * [CI:BUILD] Cirrus: remove copr rpm build task * chore(deps): update dependency setuptools to ~=67.7.0 * Cirrus: Drop benchmarks artifacts * test/e2e: correctly reap service process * test/e2e: add missing options to remote service * test/e2e: fix incorrect usage of CreateTempDirInTempDir() * test/e2e: "podman-remote send correct path to copier" do not leak file * test/e2e: fix network create flake due same subnet * test/e2e: fix SkipIfNotActive() * test/e2e: do not try to use docker as rootless * test/e2e: do not leak "hello" file * podman-remote logs: handle server error correctly * test/e2e: use custom network config v2 * rename ImagePushReport to ImagePushStream * Specify format to buildah before commit * Add eBPF snooper that traces the entire fork/exec graph of podman * libpod: stop containers with --restart=always * test: fix race when listing cgroups * compat: Translate `noprune` into ImageRemoveOptions.NoPrune * [CI:DOCS] Update RELEASE_PROCESS.md * hyperv: add podman socket mapping * e2e networking test: better way to get host IP * Updated system test to be easier to read * bindings tests: bail out early on image errors * libpod: fix TestPostDeleteHooks do not depend on version * chore(deps): update dependency setuptools to v67 * fix(deps): update module github.com/containers/libhvee to v0.0.5 * e2e: quadlet uses PODMAN env for podman binary path * Fixes format inconsistencies with docker for certain history fields * Makefile: do not prefix /etc * libpod: configureNetNS() tear down on errors * libpod: rootlessNetNs.Cleanup() fix error message * HyperV: wait on stop * build(deps): bump github.com/docker/docker * Makefile: include `release-artifacts` target * Enabled network over vsock * fix(deps): update module github.com/microsoft/go-winio to v0.6.1 * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0-rc.2 * fix remote start --filter * Update API reference to include v4.5 * Add missing security options to /info response * Add mention of redir to doc `rootless.md` * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.4.0 * docs(readme): add status badges and remove hardcoded release info * Don't use bytes.NewBuffer to read data * Add support for HVSOCK on hyperv * docs: update network tutorial with netavark DHCP support * bump main to v4.6.0-dev * Remove disused test/install * Return title fields as a list * [CI:BUILD] Packit: Initial Enablement * Quadlet - do not set log-driver by default * system tests: address COPY-hardlink flake * chore(deps): update registry.centos.org/centos/centos docker tag to v8 * system tests: fix race in kube-play read-only * chore(deps): update dependency docker to v6 * CI: enable sqlite system tests * test: enable test_wait_next_exit * Update dependency PyYAML to v6 * test/e2e/systemd_activate_test.go: simplify test * Update docker.io/library/golang Docker tag to v1.20 * api: auth: fix nil deref * Update dependency requests-mock to ~=1.10.0 * Update dependency requests to ~=2.28.2 * fix: Document removing anonymous volumes at create * Use a sane polling interval in WaitContainerDocker * podman: added the --out option for capturing formatted output emitted by various commands * Renovate: Ensure release-note-none label is added * Renovate: Update ignore paths * *: migrate image registry to registry.k8s.io * Do not display the resource limits warning message - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Discard outdated README.SUSE.SLES - Recommend gvisor-tap-vsock, required for `podmand machine` - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.1: * Bump to v4.6.1 * Release notes for v4.6.1 * Vendor buildah v1.31.2 * [4.6] vendor c/common v0.55.3 * [v4.6] Remove zstd:chunked reference * [v4.6] bump golang.org/x/net to v0.13.0 * do not redefine gobuild for eln * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * [v4.6] [CI:BUILD] RPM: separate out gvproxy for copr and fedora >= 38 * System tests: add test tags * API: kill: return 409 on invalid state * Mention TimeoutStartSec in quadlet man page * If quadlets have same name, only use first * Bump to v4.6.1-dev - Fix build error on SLE due to dangling files clause on a discarded file, README.SLE.SUSE - Fix unexpanded RPM macro error - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.6.2: * Bump to v4.6.2 * Release notes for v4.6.2 * Packit: Disable unexpected journal message check for cockpit-podman * Packit: Restrict cockpit tests to recent Fedoras * Packit: run cockpit-podman tests in PRs * rpm: spdx compatible license field * vendor c/storage@v1.48.1 * rpm: depend on man-db * use container restart policy if user specifies one * podmansh man page UID=$(id -u lockedu) is not allowed * packit: Build PRs into default packit COPRs * Skip tests that fail in gating * fix: pull parma parsing for the /build compat ep * [CI:DOCS] Update Release Notes * Bumpt to v4.6.2-dev - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - Update to version 4.7.0: * Bump to v4.7.0 * [CI:DOCS] v4.7.0 RELEASE_NOTES update * rpm: remove gvproxy subpackage * packit: tag @containers/packit-build team on copr build failures * specgen, rootless: fix mount of cgroup without a netns * pass --syslog to the cleanup process * fix --authfile auto-update test * version: switch back from -rc1 to -dev * New pre-release: v4.7.0-rc1 * [CI:DOCS] Update release notes for v4.7.0-rc1 * Cirrus: Update operating branch * Move podman build opts to common file * Add ability for machine rm -f for WSL * Plumbing to run machine tests with hyperv * CI: trace setup and runner scripts * Bump to Buildah v1.32.0 * [CI:DOCS] bump release notes on main with the latest release * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * Add --filter pod= autocompletion * e2e: ExitCleanly(): manual test fixes * e2e: continuing ExitCleanly(): just the replacements * Fix some spelling and formatting * Add support for Ulimit in quadlet * Run codespell on code * wire in new buildah build options * make golangci-lint happy * add !remote tag to pkg/specgen/generate * pkg/specgen: do not depend on libimage for remote * bump buildah to latest * [CI:DOCS] restart.md: migrate to container unit * fix(deps): update module k8s.io/kubernetes to v1.28.2 * Add support for PidsLimit in quadlet * Add DNS fields to Container and Network unit groups * [CI:DOCS] update API docs version list * Try to fix broken CI (gvisor-something) * e2e: more ExitCleanly(): manual test fixes * e2e: more ExitCleanly(): dumb string replacements * e2e: create_test: use ExitCleanly() * e2e: diff_test: use ExitCleanly() * The `podman init` command cannot modify containers. * bump c/common to latest main * Podmansh: use podmansh_timeout * e2e: more ExitCleanly(): low-hanging fruit * vendor: update checkpointctl to v1.1.0 * kube: add DaemonSet support for generate * vendor of containers/(common, storage, image) * libpod: move oom_score_adj clamp to init * e2e: commit_test: use ExitCleanly() * e2e: container_clone_test.go: use ExitCleanly() * e2e: use ExitCleanly() in cleanup_test.go * Ensure HC events fire after logs are written * [CI:DOCS] podman-systemd.unit: fix equivalents * Add support for kube TerminationGracePeriodSeconds * Update podman-kube-play.1.md.in * Split up alt binaries to speed up build * Switch installer task to EC2 * pod: fix duplicate volumes from containers.conf * tests: add test for pod cgroups * libpod: create the cgroup pod before containers * cmd, specgen: allow cgroup resources without --infra * specgen: allow --share-parent with --infra=false * libpod: allow cgroup path without infra container * libpod: check if cgroup exists before creating it * libpod: refactor platformMakePod signature * libpod: destroy pod cgroup on pod stop * utils: export MoveUnderCgroup * libpod: refactor code to new function * e2e: use ExitCleanly() in checkpoint tests * [CI:DOCS]Remove use of --latest|-l from tutorial * CI test runner: upgrade tests rely on system tests * run --rmi: "cannot remove" is a warning, not an error * StopContainer: display signal num when name unknown * URGENT: fix broken CI * Add support for kube securityContext\.procMount * podman: don't restart after kill * Tmpfs should not be mounted noexec * sys tests: run_podman: check for unwanted warnings/errors * chore(deps): update dependency setuptools to ~=68.2.0 * e2e: use ExitCleanly() in attach & build tests * Some distros do not default to docker.io for shortname searches * security: accept empty capabilities list * systests: random_free_port: fix EADDRINUSE flake * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4 * Restrict fcos_test to amd64, arm64 * fix(deps): update github.com/containers/libhvee digest to 56fb235 * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible * fix(deps): update module golang.org/x/tools to v0.13.0 * Ignore spurious container-removal errors * fix(deps): update module golang.org/x/net to v0.15.0 * systests: manifest zstd test: lots of tiny cleanups * vendor: update github.com/opencontainers/runc to main * [skip-ci] Update actions/checkout action to v4 * linux, rootless: clamp oom_score_adj if it is too low * machine: increase max number of inotify instances * fix(deps): update module golang.org/x/term to v0.12.0 * Remove redundant nil checks in system connection remove * fix(deps): update module golang.org/x/text to v0.13.0 * fix(deps): update module golang.org/x/sys to v0.12.0 * fix(deps): update github.com/containers/libhvee digest to 2bf7930 * docs(readme): fix a broken link * [CI:BUILD] Podman FCOS image from main * Update golang.org/x/exp digest to d852ddb * Add port forwarding and gvproxy machine test * libpod: do not parse --hostuser in base 8 * fix: default typo * Add Japanese locale and translation of index * remove rh.container.bot@gmail.com * Tweaks and cleanups to prepare hyperv for CI * system tests: housekeeping: various small fixes * CI: e2e: first use of new ExitCleanly() matcher * CI: e2e: new ginkgo matcher, ExitCleanly() * CI: e2e: fetch the standard system-test image * kube play: fix pull policy * Fix gidmap command in example * vendor containers/common@12405381ff45 * manifest,push: support add_compression from containers.conf * hyperv ignition: use gvforwarder instead of vm * Set remote username earlier for hyperv * Added an additional troubleshooting problem and solution * Remove a dependency on libimage from pkg/bindings * Rename parameter in pkg/bindings * Remove a dependency on libimage from pkg/api/handlers * Don't re-inspect an image * Cirrus: Remove multi-arch podman image builds * uid/gid mapping flags * [DOC] Clarify default behaviour on uidmap * Update containers/common to latest * update libhvee * /_ping handler: return OSType http header * e2e: fix race condition (kube play + logs) * Update module github.com/vbauerster/mpb/v8 to v8.6.0 * Kube - support List documents * kube down/play --replace: handle absent objects * push, manifest-push: --force-compression must be true with - -compression-format * oci: print stderr only after checking state * Updated docs to reflect pod spec sysctls support added in v4.6 * [CI:BUILD] Packit: Disable unexpected journal message check for cockpit-podman * [CI:BUILD] Packit: Restrict cockpit tests to recent Fedoras * Update machine init/set tests * Add rootful status to machine inspect * Dedup and refactor image acquisition * Share podman sock bindings with other WSL distros * Fix user-mode validation check * system tests: try to fix sdnotify flakes * Cirrus: Disable only hello multiarch build * Set StopTimeout for service-container started under podman kube play * Set StopTimeout for compat API if not set by client * podman exec should set umask to match container * [CI:BUILD] Packit: run cockpit-podman tests in PRs * Add infra-name annotations to kube gen/play * kube: notifyproxy: close once * system service: unset NOTIFY_SOCKET * Update module k8s.io/kubernetes to v1.28.1 * API attach: return vnd.docker.multiplexed-stream header * test/apiv2/60-auth.at: use `doesnotexists.podman.io` * e2e tests: use registry:2.8.2 (was 2.8) * create apiutils package * api docs: document stream format * Revert "Remove `hello` multi-arch image build" * manifest-push: add support for --force-compression * push: add support for --force-compression * Update module github.com/onsi/ginkgo/v2 to v2.12.0 * Remove `hello` multi-arch image build * hack/perf/system-df.sh: add `df` benchmarks * Expand env variables for cmds/entrypoint with format $(ENV) * vendor c/storage@6902c2d * Ignore the resource limits on cgroups V1 rootless systems * Fixups for stopping gvproxy * Revert "GHA: Closed issue/PR comment-lock test" * GHA: Closed issue/PR comment-lock test * GHA: Add workflow to lock closed issues/PRs * [CI:DOCS] update auto-update docs * chore(deps): update dependency containers/automation_images to v20230816 * fix(deps): update module github.com/google/uuid to v1.3.1 * libpod: sum per-interface network stats for FreeBSD * Set default Umask for `podman kube play` * [CI:BUILD] rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * Implement automatic port reassignment on Windows * Add support for ramfs as well as tmpfs in volume mounts * Validate current generation of WSL2 with user-mode-networking * use container restart policy if user specifies one * Stop gvproxy on hyperv machine stop * [CI:BUILD] rpm: depend on man-db * Update machine list test * Update machine start tests * Update machine rm tests * libpod: improve conmon error handling * cirrus setup: install en_US.UTF-8 locale * fixup "podman logs with non ASCII log tag" tests * libpod: use /var/run instead of /run on FreeBSD * cirrus/lib.sh: extend env to passthrough at start for locale work * libpod: correctly pass env so alternative locales work * cgroups_linux: use SessionBusPrivateNoAutoStartup * podmansh man page UID=$(id -u lockedu) is not allowed * CI: systests: remove pasta ICMP tests * podman.1.md: Fix formatting of exit code 127, clarify wording of `exit code` example. * document available secret drivers * pkg/specgen: add support for read-only root on FreeBSD * add --module flag * Update dependency setuptools to ~=68.1.0 * Add riscv64 architecture to the cross build target * GetFcosArch add `riscv64` arch * Update WSL backend to be compat with FCOS defaults * enabled hyperv image downloads * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * [CI:DOCS] Fix git build example in build page * CI: e2e manifest_test: use image from quay * Cirrus: Remove EC2 experimental flag * sphinx: skip options include dir * Update rootfs.md: Fix formatting and wording of idmap option * fix: Docker API compatible bool deserialization * Revert "compat,build: pull must accept string" * Add missing verb in machinectl example * [CI:DOCS] Update Release Notes and Release Process * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * fix podman top missing output flake * New partial-line test is flaking * [CI:BUILD] Packit: add back fedora-eln targets * Cirrus: Prune defunct job + fix noop alias * Bump bundled gvproxy to 0.7.0 * systests: tests for --env and --env-file * Update system connection add & remove * Add tests for podman farm * Add podman farm update command * Add podman farm remove command * Add podman farm list command * Add podman farm create command * Add podman farm subcommand * CI: e2e: add delay before podman logs or journalctl * Add completion for Farms * Vendor c/common changes * chore(deps): update dependency golangci/golangci-lint to v1.54.0 * file logger: fix podman logs --tail with partial lines * fix(env): parsing --env incorrect in cli * Update docker.io/library/golang Docker tag to v1.21 * podman stop --cidfile missing --ignore * Skip podman exec cannot be invoked on Debian * Re-enable checkpoint test on Debian SID * Require a non-generic reason for non-Fedora skip * CI FIXME removal/update. * Update dependency containers/automation_images to v20230807 * [skip-ci] Update dawidd6/action-send-mail action to v3.8.0 * [CI:DOCS] fixed couple typos in build docs * Stop timer in function waitPidStop * packit: Build PRs into default packit COPRs * Add support for host-gateway * Ensure volumes-from mounts override image volumes * Minor: Include shasums in GHA workflow artifacts * Minor: Add important comment to windows GHA workflow * Minor: Update/fix dry-run input descriptions * [CI:DOCS] Quadlet - provide more information about network files * man-page xref: check for duplicate entries * cp: close temporary file on error path * Makefile: work around the lack of 'man -l' on FreeBSD * Update module golang.org/x/net to v0.14.0 * libpod: fix a crash in 'kube generate' on FreeBSD * remove temporary files when copy [NO NEW TESTS NEEDED] * Update module golang.org/x/sys to v0.11.0 * [ci] Remove the podman socket in remove_packaged_podman_files() * [ci] Correct the podman systemd file names * Always show RemoteSocket.Exists in json * Fail if ssh key exists * Fix regression for hyperv * [CI:BUILD] Makefile: rpm target generates correct version * Fix nits in #19480 * Add support for passing container stop timeout as -1 (infinite) * pkg/specgen: Add device support for FreeBSD * [CI:DOCS] man: remove duplicate entry .LastUp * CI: e2e: remove useless test * Check tty flag to set default terminal in Env * Run codespell on code * Deprecate podman generate systemd * manifest/push: add support for --add-compression * [CI:DOCS]Update Release Notes * CI: sys: quadlet %T test: do not rely on journal * GHA: Support testing build/sign workflows * Remove unnecessary backslashes * [docs] Use code blocks for commands in podman-completion * Make podman run --rmi automatically set --rm * machine: QEMU: recover from failed start * vendor: bump c/image to v5.26.1-0.20230801083106-fcf7f0e1712a * secret: add support for `--ignore` with rm * Move `writeConfig` logic to shared function * Move some logic of `setRootful` to a common file * move `removeFilesAndConnections` to a common file * Move `waitAPIAndPrintInfo` to common file * Move `addSSHConnectionsToPodmanSocket` code to shared file * Update module golang.org/x/net to v0.13.0 * chore(deps): update dependency containers/automation_images to v20230726 * Skip pasta local forwarder test on debian SID * Skip broken/flaky blkio-weight test * Skip tarball re-inport test in rawhide for CI * Cleanup CIDFile on podman-remote run --rm command * CI: e2e: remove workaround for missing login file * vendor: bump c/image and c/common * Add support for confined users * Cirrus: Temp. disable rawhide validation task * Limit git-validation to 'short-subject' * Fix up man page and add test on globs * Move alternate image acquisition to separate function * Move `getDevNullFiles` into a common file * Update github.com/digitalocean/go-qemu digest to 2e3d018 * Convert QEMU functions to methods with documentation * Update docs/source/markdown/podman-build.1.md.in * do not redefine gobuild for eln * Set default userns from containers.conf file * Mention TimeoutStartSec in quadlet man page * inspect with network=none show SandboxKey netns path * [CI:DOCS] GHA: Use stable go for Mac/Win builds * Breakup AppleHV machine funcs * Codespell fixups * Update docs/source/markdown/podman-stats.1.md.in * CI: e2e: reenable containerized checkpoint tests * docs(env-file): improve document description * Don't log EOF error when using podman --remote build with an empty context directory. * API: kill: return 409 on invalid state * feat(env): support multiline in env-file * Adds documentation to new functions that were added * `startHostNetworking`: get DevNull files * `Remove`: remove network and ready sockets from registry * `Remove`: remove files and connections * `Remove`: collect files to destroy * `Init`: read and split ign file * `Init`: write ign config * `Init`: add network and registry socks to registry * `Init`: add SSH conns to podman sock * Improve the description of fields in podman-stats man page * make /dev & /dev/shm read/only when --read-only - -read-only-tmpfs=false * Mention no comment lines in Containerfile.in podman-build man page * [CI:BUILD] RPM: define gobuild macro for rhel/centos stream * Fix HyperV loadMachineFromJSON function name * machine: QEMU: lock VM on stop/rm/set * libpod: add 'pod top' support on FreeBSD * [CI:DOCS] Build and Sign Mac Pkginstaller * Make sure users changes --authfile before checking * github: add issue type as link to podman github discussions * Break QEMU `config.go` code into its own functions * machine: QEMU: lock VM on start * libpod: fix 'podman kube generate' on FreeBSD * Add glob support to podman run/create --mount * kube: add DaemonSet support * Fix artifacts script after removal of msitools msi build * System tests: quadlet: fix race in %T test * If quadlets have same name, only use first * Add support for mounts listed in containers.conf * Update vendor of containers/common * System tests: add test tags * [CI:DOCS] socket_activation.md: increase socat timeout * go-md2man: use vendored-in version, not system * CI: use different TMPDIR on prior-fedora * system tests: authfile-exists: minor cleanup * start(): don't defer event * Fix: use --all in podman stats to get all containers stats * Verify authfile exists if user specifies it * libpod: don't generate errors for createTimer etc. * add "healthy" sdnotify policy * Remove LICENSE and general doc files that are installed by the main package * Add missing ` * Remove legacy msitools based msi installer * Remove any quotes around distribution id * add a podman-compose command * pkg/specgen: Don't crash for device spec with... * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible * Update vendor of containers/(storage,image) * Clean up /var/tmp/ when using oci-archives when creating containers * [CI:BUILD] RPM: separate out gvproxy for copr and rawhide * Reduce qemu machine function sizes * [CI:DOCS] migrate socket_activation.md to quadlet * [CI:DOCS] Update kube play volume support * Fix language, typos and markdown layout * [CI:DOCS] Add note about QUADLET_UNIT_DIRS to simplify quadlet debug * Add note on debugging quadlet unit files * Remove unnecessary use of the word "please". * libpod: fix FreeBSD 'podman-remote top' default behaviour * fix(deps): update module github.com/onsi/gomega to v1.27.9 * Add support for ShmSize to quadlet * Quadlet system test - force journald log driver for short lived containers * fix(deps): update module github.com/containers/libhvee to v0.4.0 * quadlet recursively scan for unit files * Ensure that we appropriately warn that TCP is insecure * systests: quadlet: fixes for RHEL8 * Quadlet - Allow setting Service WorkingDirectory for Kube units * Quadlet system test - do not rely on journalctl in kube file tests * Fix markdown in docs for podman-network-create * Man pages: check for corrupt tables * quadlet systest: fix broken tmpdir references * Add `since` as valid filter option for `volume` subcommands * Podmansh: Better error, increase timeout to 30s * Fix multiple filter options logic for `podman volume ls ` * Add bash-completion for podman inspect * Fix windows installer * Add missing reserved annotation support to `play` * Avoid progress hang with empty files * Revert the usage of `home.GetConfigHome()` * Fix bug report issue template README link * Replace error check for non-existent file * Emergency gating-test fixes for RHEL8 * Add progress bar for decompress image * refactor: move progressbar to a function * Use pkg/homedir to get the home config directory * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.2 * Should be checking tmpfs versus type not source * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.5.1 * Enabled arm64 arch for podman applehv provider * [CI:BUILD] Packit: remove pre-sync action * Add `--podman-only` flag to `podman generate kube` * Update vendor containers/(common, buildah, image, storage) * Use constants for mount types * libpod: use define.TypeBind when resolving container paths * Tests: remove/update obsolete skips * Fix trust not using local policy file * Fix `podman container prune` docs for `--filter` * Add more tests for liveness probes with default hostname & named ports * docs: podman-build --network add slirp and pasta * docs: podman run --network mention comma separted names * Podman machine AppleHV pass number 3 * Makefile: `package` -> `rpm` * network create: document --internal better * pkg/specgen: fix support for --rootfs on FreeBSD * machine start: qemu: wait for SSH readiness * [CI:BUILD] Packit: downstream task action fix * Fix container errors not being sent via pod removal API * Add missing return after utils.InternalServerError() * Update cmd/podman/login.go * [CI:DOCS] Reformat and reorder table with --userns options * Add secret support to podman login * netavark: macvlan networks keep custom nameservers * remote: fix podman-remote play kube --userns * fix(deps): update container-device-interface to v0.6.0 * go mod: no longer use 1.18 * fix(deps): update module github.com/containers/libhvee to v0.3.0 * chore(deps): update module github.com/gin-gonic/gin to v1.9.1 [security] * Run codespell on code * system service: unset listen fds on tcp * add hostname to network alias * libpod: set cid network alias in setupContainer() * AppleHV enablement pass #2 * e2e: Fetch the correct user name * Add `--no-trunc` flag to maintain original annotation length * Fix TCP probes when the optional host field is not given * Add support for using port names in Kubernetes health probes * Fix: cgroup is not set: internal libpod error after os reboot * Allow setting volume and network names in Quadlet * pasta tests: automatically determine test parameters * test/e2e: wait for socket * manifest inspect: support authentication * api: fix slow version endpoint * libpod: don't make a broken symlink for /etc/mtab on FreeBSD * CI: remove build without cgo task * libpod: use io.Writer vs io.WriteCloser for attach streams * top: do not depend on ps(1) in container * make --syslog errors non fatal * api: fix doc for default ps_args * Fixes typo in the path where quadlet looks for files * Add --replace flag to podman secret create * [CI:DOCS] uidmap man pages: fix corrupt italics * [skip-ci] Update github/issue-labeler action to v3.2 * [CI:DOCS] podman-system-service.1.md: document systemd usage * fix(deps): update module github.com/docker/docker to v24.0.4+incompatible * fix(deps): update module github.com/docker/docker to v24.0.3+incompatible * Use bytes size consistently instead of human size * bugfix: do not try to parse empty ranges * [CI:BUILD] Packit: fix pre-sync action for downstream tasks * fix(deps): update module golang.org/x/tools to v0.11.0 * fix(deps): update module golang.org/x/net to v0.12.0 * fix(deps): update module golang.org/x/term to v0.10.0 * e2e: fix two toolbox flakes * test/e2e: use GinkgoT().TempDir() over MkdirTemp() * test/e2e: use random ImageCacheDir * test/e2e: remove RHEL7 workaround * test/e2e: remove unnecessary code in SynchronizedAfterSuite * test/e2e: do not use /tmp for podman commands * test/tools: vendor ginkgo v2.11 * test/e2e: write timings directly to file * machine start: qemu: adjust backoffs * auto update: fix usage of --authfile * system tests: refactor registry code * fix(deps): update module golang.org/x/text to v0.11.0 * pkg/specgen: properly identify image OS on FreeBSD * libpod: use new libcontainer BlockIO constructors * [CI:BUILD] Minor: Don't confuse osx-debugging * [CI:DOCS] Better document the default value of --userns * Cirrus: build FreeBSD binaries in a VM * Makefile: add support for building freebsd release tarballs * [CI:DOCS] uidmap man pages: fix corrupt tables * fix(deps): update github.com/crc-org/vfkit digest to c9a4b08 * fix(deps): update module github.com/containers/buildah to v1.31.0 * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Use /proc/self/gid_map as intended, not uid_map * fix(command): ignore `--format` in `podman search --list-tags` * podman machine start: fix ready service * Makefile: don't rely on the non-standard -r flag for ln * pasta: Create /etc/hosts entries for pods using pasta networking * fix(deps): update module github.com/containers/libhvee to v0.2.0 * pasta tests: add sanity check for test name vs function * pasta tests: cleanup + 1 new test * cmd/podman, pkg/domain/infra: sockets should live in /var/run on FreeBSD * cmd/podman/system: add API server support on FreeBSD * [CI:DOCS] Document support of pod security context IDs * rootless: use default_rootless_network_cmd config * Revert^3 "pasta: Use two connections instead of three in TCP range forward tests" * pasta: Workaround occasional socat failures in CI * pasta: Remove some leftover code from pasta bats tests * Bump c/image to v5.26.0, c/common 0.54.0 * fix(deps): update module github.com/coreos/stream-metadata-go to v0.4.3 * Display secret to user in inpspect * [CI:BUILD] RPM: Fix koji and ELN issues * e2e: systemd test: major fixes * pkg/specgen: add support for 'podman run --init' on FreeBSD * Bump version after v4.6 branch cut * Remove 'inspecting object' from inspect errors * pasta: Fix pasta tests to work on hosts with multiple interfaces * [CI:DOCS] fix command incorrect in windows * Fix readonly=false failure * pkg/specgen: Add support for Linux emulation on FreeBSD * Fix up podmansh man page * Make Podman/Buildah use same DecryptConfig/EncryptConfig funcs * Fixes for vendoring Buildah * vendor in latest buildah * tests: fix "Storing signatures" check * update c/image and c/storage to latest * Kube quadlets can support autoupdate as well as containers * debug tail 800 lines flake * Pass in correct cwd value for hooks exe * specgen: honor --device-cgroup-rule with a new user namespace * specgen, rootless: raise error with --device-cgroup-rule * make image listing more resilient * Update module google.golang.org/protobuf to v1.31.0 * Trim whitespace from unit files while parsing * Re-organize hypervisor implementations * play.go: remove volumes on down -f - Build against latest stable Go version (bsc#1215807) - podman-docker: Provides docker to avoid conflicts when using podman with docker-compose (bsc#1215926) - Update to version 4.7.1: * New version: v4.7.1 * Update RELEASE_NOTES.md for v4.7.1 * compat API: speed up network list * inspect: ignore ENOENT during device lookup * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * [CI:DOCS] update swagger version on docs.podman.io * Fix locale issues with WSL version detection * switch version to 4.7.1-dev - Use crun on Tumbleweed & ALP for WASM support - crun is not available for armv6 (because of criu), so use runc on armv6 - Update to version 4.7.2: * v4.7.2 * Update RELEASE_NOTES.md for v4.7.2 * compose: try all possible providers before throwing an error * Mask /sys/devices/virtual/powercap * fix: check wsl npipe when executing podman compose * rtd: implement v2 build file * Adjust to path name change for resolved unit * Switch version to 4.7.2-dev - Use crun only on selected archs - Update to version 4.8.0: * Bump to v4.8.0 * Update release notes for 4.8.0 * Add notes on upcoming deprecations to release notes * [v4.8] Bump to Buildah v1.33.2 * [CI:DOCS] Update release notes * machine applehv: create better error on start failure * Bump to v4.8.0-dev * Bump to v4.8.0-rc1 * Create release notes for v4.8.0 * Update release notes from v4.7 branch * Cirrus: Update operating branch * rootless_tutorial: modernize * Bump Buildah to v1.33.1 * Bump Buildah to v1.33.0 * Update to libhvee 0.5.0 * vmtypes names cannot be used as machine names * Add support for --compat-auth-file in login/logout * Update tests for a c/common error message change * Update c/image and c/common to latest, c/buildah to main * CI: test overlay and vfs * [CI:DOCS] Add link to podman py docs * Test fixes for debian * pasta tests: remove some skips * VM images: bump to 2023-11-16 * fix(deps): update module k8s.io/kubernetes to v1.28.4 [security] * [CI:DOCS] Machine test timeout env var * Quadlet - add support for UID and GID Mapping * Quadlet - Allow using symlink on the base search paths * [skip-ci] Update dessant/lock-threads action to v5 * Avoid empty SSH keys on applehv * qemu,parseUSB: minor refactor * fix(deps): update module github.com/gorilla/handlers to v1.5.2 * docs: fix relabeling command * Pass secrets from the host down to internal podman containers * (Temporary) Emergency CI fix: quay search is broken * Update podman-stats.1.md.in * [CI:BUILD] packit: handle builds for RC releases * Quadlet test - add case for multi = sign in mount * set RLIMIT_NOFILE soft limit to match the hard limit on mac * rootless: use functionalities from c/storage * CI: e2e: fix a smattering of test bugs that slipped in * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.1 * vendor: update c/storage * Improve the documentation of quadlet * Fix socket mapping socket mapping nits * fix(deps): update module golang.org/x/tools to v0.15.0 * fix(deps): update github.com/containers/libhvee digest to 9651e31 * [skip-ci] Update github/issue-labeler action to v3.3 * Document --userns=auto behaviour for rootless users * machine: qemu: add usb host passthrough * fix(deps): update module golang.org/x/net to v0.18.0 * fix(deps): update module github.com/onsi/gomega to v1.30.0 * Refactor Ignition configuration for virt providers * [CI:BUILD] rpm: disable GOPROXY * Automatic code cleanups - JetBrains * Refactor key machine objects * systests: add [NNN] prefix in logs, NNN = filename * systests: add a last-minute check for db backend * applehv: allow virtiofs to mount to / * Run codespell on podman * update completion scripts for cobra v1.8.0 * Fix man page display of podman-kube-generate * Try to fix the broken formatting of man podman‐kube‐apply(1). * fix(deps): update module golang.org/x/text to v0.14.0 * docs: make CNI removal explicit * fix(deps): update module github.com/gorilla/mux to v1.8.1 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * fix(deps): update module golang.org/x/sync to v0.5.0 * fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.18 * Podman push --help should reveal default compression * Update container-device-interface (CDI) to v0.6.2 * fix: adjust helper string in machine_common * fix: adjust helper string in machine_common * remote,test: remove .dockerignore which is a symlink * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * fix: adjust helper string in machine_common * vendor: update github.com/coreos/go-systemd/v22 to latest main * CI: default to sqlite * vendor: update c/common * check system connections before machine init * Consume OCI images for machine image * freebsd: drop dead code * libpod: make removePodCgroup linux specific * containers: drop special handling for ErrCgroupV1Rootless * compose: fix compose provider debug message * image: replace GetStoreImage with ResolveReference * vendor: bump c/image to 373c52a9466f * Refactor machine socket mapping * AppleHV: Fix machine rm error message * Add status messages to podman --remote commit * End-of-Life policy for github issues * fix(deps): update module github.com/shirou/gopsutil/v3 to v3.23.10 * Support passing of Ulimits as -1 to mean max * fix(deps): update github.com/docker/go-connections digest to 0b8c1f4 * fix(deps): update github.com/crc-org/vfkit digest to f3c783d * Log gvproxy and server9 to file on log-level=debug * Change to using gopsutil for cross-OS process ops * Initial addition of 9p code to Podman * libpod: fix /etc/hostname with --uts=host * systests: stty test: retry once on flake * systests: pasta: avoid hangs * Fix secrets scanning GHA Workflow * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * docs: clarify systemd cgroup mount * podman build --remote URI Dockerfile shoud not be treated as file * Small fixes for wacko CI environments * Do not add powercap mask if no paths are masked * compose: try all possible providers before throwing an error * podman kube play --replace should force removal of pods and containers * Sort kube options alphabetically * container.conf: support attributed string slices * CI: podman farm tests cleanup * Mask /sys/devices/virtual/powercap * Update module github.com/google/uuid to v1.4.0 * fix(deps): update module github.com/docker/docker to v24.0.7+incompatible * fix(deps): update module go.etcd.io/bbolt to v1.3.8 * CI: systest: safer random_rfc1918_subnet * CI: e2e: safer GetPort() * Fix broken code block markup in Introduction.rst * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * chore: remove npipe const and use vmtype const for checking * Update module github.com/onsi/gomega to v1.29.0 * CI: try to fix more networking flakes * fix: check wsl npipe when executing podman compose * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * Quadlet - explicit support for read-only-tmpfs * compat API: fix image-prune --all * Makefile - allow more control over Ginkgo parameters * Add e2e tests for farm build * vendor c/{buildah,common}: appendable containers.conf strings, Part 1 * Add podman farm build command * Add emulation package * Use buildah default isolation when working with podman play kube * docs(API): Fix compat network (dis-)connect * test/e2e: do not import buildah * pkg/specgen: remove config_unsupported.go * pkg/parallel/ctr: add !remote tag * pkg/domain/filters: add !remote tag * pkg/ps: add !remote tag * pkg/systemd/generate: add !remote tag * libpod: add !remote tag * pkg/autoupdate: add !remote tag * vendor latest c/common * libpod: remove build support non linux/freebsd * Fix typo * test/apiv2: adapt apiv2 test on cgroups v1 environment * ginkgo setup: retry cache pulls * Support size option when creating tmpfs volumes * not mounted layers should be reported as info not error * CI: stop using registry.k8s.io * fix(deps): update module github.com/vbatts/git-validation to v1.2.1 * test fixes for c/common tag chnages * vendor latest c/common * hyperV: Update lastUp time * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * lint: disable testifylint * lint: fix warnings found by perfsprint * lint: fix warnings found by inamedparam * lint: fix warnings found by protogetter * libpod: skip DBUS_SESSION_BUS_ADDRESS in conmon * Use node hostname in kube play when hostNetwork=true * cirrus setup: special-case perl unicode * network: document ports and macvlan interaction * quadlet: document cgroupv2 requirement * [skip-ci] Update actions/checkout digest to b4ffde6 * Revert "Emergency workaround for CI breakage" * remote: exec: do not leak session IDs on errors * fix(deps): update github.com/containers/storage digest to 79aa304 * fix(deps): update module k8s.io/kubernetes to v1.28.3 * System tests: fix broken silence127 * Add TERM iff TERM not defined in container when podman exec -t * Emergency workaround for CI breakage * Kill gvproxy when machine rm -f * Fix path for omvf vars on Darwin/arm64 * Allow systemd specifiers in User and Group Quadlet keys * libpod: rename confusing import name * use FindInitBinary() for init binary * vendor latest c/common * exec: do not leak session IDs on errors * systests: cp test: lots of cleanup * Define better error message for container name conflicts with external storage. * Quadlet - support ImageName for .image files * test/system: ignore 127 if it is the expected rc * test/apiv2/20-containers.at: fix NanoCPUs tests on cgroups v1 * image history: fix walking layers * fix(api): Ensure compatibality for network connect * [CI:DOCS] Add cross-build target info. * machine set: document --rootful better * libpod: restart+userns cleanup netns correctly * Minor log and doc fixes * Quadlet man page - discuss volume removal explicitly * Quadlet - add support for KubeDownForce * System Test - Quadlet kube oneshot * Fix output of podman --remote top * buildah-bud: test relative TMPDIR * Fix handling of --read-only-tmpfs flag * Vendor common and buildah main * remote,build: wire unsetlabels * test: build with TMPDIR as relative * docs: add unsetlabel * vendor: bump buildah to v1.32.1-0.20231012130144-244170240d85 * fix(deps): update module github.com/vbauerster/mpb/v8 to v8.6.2 * fix: pull error response docker rest api compatibility * Show client info even if remote connection fails * fix(deps): update github.com/containers/libhvee digest to e51be96 * Run codespell * SetLock for all virt providers * Machine: Teardown on init failure * healthcheck: make sure to always show health_status events * Apply suggestions from code review * [CI:DOCS]rtd: implement v2 build file * Quadlet - support oneshot .kube files * libpod: fix deadlock while parallel container create * fix(deps): update module golang.org/x/net to v0.17.0 * api: add `compatMode` paramenter to libpod's pull endpoint * api: break out compat image pull * fix(deps): update module github.com/cpuguy83/go-md2man/v2 to v2.0.3 * use sqlite as default database * vendor latest c/common * fix(deps): update module github.com/nxadm/tail to v1.4.11 * Check for image with /libpod/containers/create * container: always check if mountpoint is mounted * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.0 * vendor: update c/storage * api: drop debug statement * Quadlet - add support for global arguments * Add system test * fix(deps): update module golang.org/x/tools to v0.14.0 * Don't ignore containerfiles outside of build context * fix(deps): update github.com/containers/libhvee digest to fcf1cc2 * fix(deps): update module golang.org/x/term to v0.13.0 * Update module golang.org/x/sys to v0.13.0 * [CI:DOCS] Add updating version on podman.io to release process * containers.conf: add `privileged` field to containers table * Implement secrets/credential scanning * Cirrus: Execute Windows podman-machine e2e tests * vendor: bump c/storage * Update module golang.org/x/sync to v0.4.0 * [CI:DOCS] update swagger version on docs.podman.io * Create Qemu command wrapper * Adjust to path name change for resolved unit * Revert "Fix WSL systemd detection" * [CI:BUILD] rpm/copr: gvforwarder recommends for RHEL * [CI:DOCS] update kube play delete endpoint docs * [CI:DOCS] Remove dead link from README * test/system: --env-file test fixes * Revert "feat(env): support multiline in env-file" * Revert "docs(env-file): improve document description" * Revert "fix(env): parsing --env incorrect in cli" * Filter health_check and exec events for logging in console * inspect: ignore ENOENT during device lookup * test, manifest: test push retry * Fix locale issues with WSL version detection * vendor: update module github.com/docker/distribution to v2.8.3+incompatible * vendor: bump c/common to v0.56.1-0.20231002091908-745eaa498509 * Update github.com/containers/libhvee digest to e9b1811 * windows: Use prebuilt gvproxy/win-sshproxy binaries * Volume create - fast exit when ignore is set and volume exists * Update golang.org/x/exp digest to 9212866 * Update github.com/opencontainers/runtime-spec digest to c0e9043 * remove selinux tag as not needed anymore * [skip-ci] Improve podmansh(1) * Build applehv for Intel Macs * Revert "GHA Workflow: Faster discussion-locking" * update vfkit vendored code * Add DefaultMode to kube play * Fix broken podman images filters * Remove `c.ExtraFiles` line in machine * podman: run --replace prints only the new container id * New machines should show Never as LastUp * podman machine: disable zincati update service * Revert "cirrus setup: install en_US.UTF-8 locale" * Cirrus: CI VM images w/ newer automation-library * CI VMs: bump to f39 + f38 * [CI:DOCS] Update podman load doc * Update mac installer to latest gvproxy release * Fix WSL systemd detection * Add documentation for the vrf option on netavark * fix(deps): update github.com/containers/common digest to 9342cdd * fix: typos in links, path and code example * e2e: ExitCleanly(): manual special cases * e2e: ExitCleanly(): the final fron^Wcommit * [CI:DOCS] Add win-sshproxy target to winmake * wsl: enable machine init tests * Update docs/source/markdown/options/rdt-class.md * move IntelRdtClosID to HostConfig * use default when user does not provide rdt-class * Add documentation for Intel RDT support * Add test for Intel RDT support * Add Intel RDT support * [CI:DOCS] Fix podman form update --help examples * Quadlet container mount - support non key=val options * test/e2e: default to netavark * [skip-ci] Update dawidd6/action-send-mail action to v3.9.0 * fix(deps): update module github.com/containers/gvisor-tap-vsock to v0.7.1 * fix(deps): update github.com/containers/common digest to 4619314 * applehv: enable machine tests for start * applehv: machine tests for stop and rm * Update machine tests README * Add podman socket info to machine inspect * Fix podman machine info test for hyperV * libpod: pass entire environment to conmon * e2e: ExitCleanly(): manual fixes to get tests working * e2e: ExitCleanly(): a few more * FCOS+podman-next: correct GHA conditional syntax * pkg/machine/e2e: wsl stop * wsl: machine tests for inspect * wsl: machine tests for ssh * fix(deps): update github.com/containers/common digest to e18cda8 * wsl: machine start test * wsl machine tests: set * wsl: machine tests * Skip proxy test for hyperV * Enable machine e2e test for applehv * hyperV: Respect rootful option on machine init * [CI:BUILD] FCOS image: enable nightly build * e2e: use safe fedora-minimal image * hyperv: machine e2e tests for set command * podman build: correct default pull policy * fix handling of static/volume dir * unbreak CI: useradd not found * hyperv: set more realistic starting state * hyperv: use StopWithForce with remove * Fix all ports exposed by kube play * Fix setting timezone on HyperV * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 97028a6 * Fix farm update to check for connections * Adjust machine CPU tests * Bump version on main * [CI:BUILD] Packit: show SHORT_SHA in `podman --version` for COPR builds * Vendor c/common * pod rm: do not log error if anonymous volume is still used * e2e: ExitCleanly(): manual fixes to get tests passing * e2e: ExitCleanly(): a few more * fixes for pkg/machine/e2e on hyperv * test: fix rootless propagation test * [CI:BUILD] packit: tag @containers/packit-build team on copr build failures * Enable disk resizing for applehv * Various updates for hyperv and machine e2e tests * test: update fedoraMinimal version * specgen, rootless: fix mount of cgroup without a netns * Automatically remove anonymous volumes when removing a container * Use ActiveServiceDestination in ssh remoteConnectionUsername * fix(deps): update github.com/containers/gvisor-tap-vsock digest to 9298405 * e2e: ExitCleanly(): generate_kube_test.go * e2e: generate kube -> kube generate * e2e: ExitCleanly(): generate_kube_test.go * windows cannot "do" extra files * e2e: ExitCleanly(): Fixes for breaking tests * play kube -> kube play * e2e: ExitCleanly(): play_kube_test.go * introduce pkg/strongunits * Makefile equiv Powershell script * pass --syslog to the cleanup process * vendor of containers/common * fix --authfile auto-update test * compat API: speed up network list * Change priority for cli-flags for remotely operating Podman * libpod: remove unused ContainerState() fucntion * [CI:BUILD] Packit: Enable failure notifications for cockpit tests * e2e: ExitCleanly(): more low-hanging fruit * e2e: ExitCleanly(): more low-hanging fruit * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.12.1 * Enable machine e2e tests for WSL * systests: tighter checks for unwanted warnings * GHA Workflow: Faster discussion-locking * [CI:BUILD] FCOS + podman-next image: pull in wasm * [CI:BUILD] rpm: remove gvproxy subpackage * [CI:DOCS] Tweak podman to Podman in a few farm man pages * Docs on sig-proxy are wrong, we support TTY * e2e: ExitCleanly(): low-hanging fruit, part 2 * e2e: ExitCleanly(): low-hanging fruit, part 1 * Buildtag out unix commands for common OS files * systests: clean up after tests; fix missing path in logs * [CI:BUILD] followup PR for fcos with podman-next * Implement gvproxy networking using cmdline wrapper * fix, test: rmi should work with images w/o layers * vendor: bump c/common to v0.56.1-0.20230919073449-d1d9d38d8282 * Quadlet Image test - rearrange test function * e2e: continuing ExitCleanly() work: manual tweaks * e2e: continuing ExitCleanly() work * [CI:DOCS] Improve podman-tag man page * [CI:DOCS] Improve podman-build man page * [CI:DOCS] Include precheck to release process * [CI:DOCS] consistentize filter options in man pages * Quadlet - add support for .image units * --env-host: use default from containers.conf * error when --module is specified on the command level * man page crossrefs: add --filter autocompletes * Fix specification of unix:///run * Add label! filter and tests to containers and pods * Add test for legacy address without two slashes * Use url with scheme and path for the unix address - Update to version 4.8.1: * v4.8.1 * Update RELEASE_NOTES.md for v4.8.1 * Handle symlinks when checking DB vs runtime configs * libpod: Detect whether we have a private UTS namespace on FreeBSD * pkg/bindings: add new APIVersionError error type * fix podman-remote exec regression with v4.8 * sqlite: fix issue in ValidateDBConfig() * sqlite: fix missing Commit() in RemovePodContainers() * sqlite: set busy timeout to 100s * Fix locking error in WSL machine rm -f * Gating test fixes * If API calls for kube play --replace, then replace pod * Fix wsl.conf generation when user-mode-networking is disabled * Bump to v4.8.1-dev - Default to the new networking backend, netavark, on openSUSE (bsc#1217828) - Update to version 4.8.2: * v4.8.2 * [CI:DOCS] Update RELEASE_NOTES.md for v4.8.2 * Kube Play - set ReportWriter when building an image * Fix user-mode net init flag on first time install * bump c/common to v0.57.1 * bump version to v4.8.2-dev - Refactor network backend dependencies: * podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it. * This fixes missing cni-plugins in some scenarios * Default to netavark everywhere where it's available - Update to version 4.8.3: * Release v4.8.3 * Update RELEASE_NOTES.md for v4.8.3 * update module golang.org/x/crypto to v0.17.0 [security] * Error on HyperV VM start when gvproxy has failed to start * bump release to v4.8.3-dev - Add patch for CVE-2024-1753 (bsc#1221677): 0001-CVE-2024-1753-container-escape-fix.patch - Remove upstreamed patches: - 0001-CVE-2024-1753-container-escape-fix.patch - Update to version 4.9.5: * Bump to v4.9.5 * Update release notes for v4.9.5 * fix "concurrent map writes" in network ls compat endpoint * [v4.9] Fix for CVE-2024-3727 (bsc#1224122) * Disable failing bud test * CI Maintenance: Disable machine tests * [CI:DOCS] Allow downgrade of WiX * [CI:DOCS] Force WiX 3.11 * [CI:DOCS] Fix windows installer action * Bump to v4.9.5-dev * Bump to v4.9.4 * Update release notes for v4.9.4 * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786 (bsc#1226136) * Add farm command to commands list * Bump to FreeBSD 13.3 (13.2 vanished) * Update health-start-periods docs * Don't update health check status during initialDelaySeconds * image scp: don't require port for ssh URL * Ignore docker's end point config when the final network mode isn't bridge. * Fix running container from docker client with rootful in rootless podman. * [skip-ci] Packit: remove koji and bodhi tasks for v4.9 * Bump to v4.9.4-dev * Bump to v4.9.3 * Release notes for v4.9.3 * Remove gitleaks scanning * [v4.9] [skip-ci] packit: update fedora downstream branches * @@option volume.image: be specific that -v only affects RUN * Accept a config blob alongside the "changes" slice when committing * container create: use ParseUserNamespace to parse a user namespace setting * Bump to v4.9.3-dev * Bump to v4.9.2 * Release notes for v4.9.2 * Cirrus: Update operating branch * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5 * Fix updated runc dep breaking pod devices cgroup * systests: kube with policies test: fix race * Remove go.mod pin of runc and update to latest * systests: kube with policies test: fix race * Bump to v4.9.2-dev * Bump to v4.9.1 * Release notes for v4.9.1 * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2 * pkginstaller: bump Qemu version to 8.2.1 * Assign separate ports for each appleHV machine * Fix machine inspect test config * AppleHV: update LastUp time * applehv: return socket path from setupAPIForwarding * applehv: Remove unneeded cmd.ExtraFiles assignment * abi: drop check for IsRootless() * system: enhance check for re-exec into rootless userns * system: enhance check for re-exec into rootless userns * Fix `podman machine set --rootful` for applehv * applehv - fix vm lookup * rpm: use go-rpm-macros on RHEL 10 * Bump to v4.9.1-dev * Bump to v4.9.0 * Fix a small grammar error in RELEASE_NOTES.md * Fix push endpoint stream * Finalized release notes for v4.9.0 * farm build: push built images to registry * Move the --farm flag to farm build command * Clean up farm-build miscommit * [CI:DOCS] Add podman farm build doc * Add release notes for v4.9.0 * gvproxy: Update to 0.7.2 release * [v4.9] Bump Buildah to v1.33.3, c/common to v0.57.2, c/image to v5.29.1 * Add a net health recovery service to Qemu machines * Set up podman machine remote user correctly * Remove Libpod special-init conditions * Fix `podman system reset` with external containers * [v4.8] podman kube play: fix broken annotation parsing * feat: disable pid max in the podman machine * systests: cp: add wait_for_ready * System tests: fixes for RHEL8 gating failures * Add API forwarding support for HyperV * bump to v4.8.4-dev - Add patch to fix bsc#1227052 / CVE-2024-6104: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add missing BuildRequires man - Add patch for CVE-2024-9341 (bsc#1231230): * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Rebase patch: * 0001-Backport-fix-for-CVE-2024-6104.patch - Add patch for CVE-2024-9675 (bsc#1231499): * 0004-Properly-validate-cache-IDs-and-sources.patch - Add patch for CVE-2024-9407 (bsc#1231208): * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch - Load ip_tables and ip6_tables kernel module (bsc#1214612) * Required for rootless mode as a regular user has no permission to load kernel modules - Add patch for CVE-2024-9676 (bsc#1231698): * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch - Rebase patches: * 0001-Backport-fix-for-CVE-2024-6104.patch * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch * 0004-Properly-validate-cache-IDs-and-sources.patch - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - polkit-keyinit.patch: add pam_keyinit to the polkit configuration (bsc#1144053) - Fix usage of libexecdir instead of prefix/lib where applicable. - Update to version 0.117: + Activated Gitlab CI. + Updated dependency to mozjs68. + Memory management fixes. + Updated translations. - Replace pkgconfig(mozjs-60) for pkgconfig(mozjs-68) BuildRequires following upstreams port. - Update to version 0.118: + Updated dependency to mozjs78. + Tarball fixes. - Replace pkgconfig(mozjs-68) for pkgconfig(mozjs-78) BuildRequires following upstreams port. - also set libprivdir during build, otherwhise systemd and D-Bus service files contain the wrong path and we'll get runtime errors. - Move /etc/dbus-1/system.d to /usr/share/dbus-1/system.d, the first location is only for admin changes - Move pam configuration to /usr/etc/pam.d - CVE-2021-3560: fixed a local privilege escalation using polkit_system_bus_name_get_creds_sync() (bsc#1186497) CVE-2021-3560.patch - Move /etc/polkit-1/rules.d/50-default.rules to /usr/share/polkit-1/rules.d/50-default.rules. The first location is only for admin changes. - Change to using systemd-sysusers - Remove unneeded shadow dependency, no longer required due to systemd-sysusers - Fix 50-default.rules file-parent-ownership-mismatch warning - Remove --with-pic, no effect with --disable-static - fork libpolkit0 package into libpolkit-agent-1-0 and libpolkit-gobject-1-0 as mandated. bsc#1191781 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) - Fixed pkexec Local Privilege Escalation aka pwnkit (CVE-2021-4034 bsc#1194568) CVE-2021-4034-pkexec-fix.patch - Switch from mozjs to duktape: * Add duktape-support.patch - Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115) 0001-CVE-2021-4115-GHSL-2021-077-fix.patch - split out pkexec into seperate package to make system hardening easier (to avoid installing it jsc#PED-132 jsc#PED-148). - add split-provides for polkit:/usr/bin/pkexec. (bsc#1202070) - Use %_pam_vendordir - Update to version 121: + Addition of duktape as a JS engine backend. + Other small fixes and improvements. For more details, visit: gitlab.freedesktop.org/polkit/polkit/-/blob/121/NEWS.md + Updated translations. - Drop merged-upstream patches: + CVE-2021-4034-pkexec-fix.patch; + 0001-CVE-2021-4115-GHSL-2021-077-fix.patch; + duktape-support.patch; + pkexec.patch. - Replace Intltool with Gettext as a build requirement following the migration from last release (0.120). - Add Meson as a build requirement while dropping Libtool and replace all Autotools macros with Meson ones. And pass the following options to Meson: session_tracking=libsystemd-login; systemdsystemunitdir=%{_unitdir}; os_type=suse; pam_module_dir=%{_pam_moduledir}; pam_prefix=%{_pam_vendordir}; examples=true; tests=true; gtk_doc=true; man=true and js_engine=duktape. - Drop no longer needed Libtool as a build requirement, following Autotools replacement. - Add explicit pkgconfig module build requirements for glib-2.0 and gobject-2.0 that are searched by the build scripts. They were already being pulled by their siblings [pkgconfig(gio-2.0) and pkgconfig(gio-unix-2.0)]. - Drop conditional macro, which was wrapping "BuildArch: noarch" for the doc subpackage, based on long gone EOLed (open)SUSE release (11.2). - Add missing 'Requires(post): permissions' for the pkexec subpackage. - Add python3-dbus-python and python3-python-dbusmock as build requirements in order to run test in the check section. - Add polkit-fix-pam-prefix.patch to use the value of pam_prefix Meson option, like it was designed to, rather than hard-coded path for pam configuration files. - Remove unneeded executable bit from 50-default.rules file. - obsolete libpolkit0 also from baselibs. - Change permissions for rules folders (bsc#1209282) - fix bashisms in redialer script - add patches: * ppp-2.4.7-fix-bashisms.patch - Added ppp-CVE-2015-3310.patch: Fix for bnc#927841, CVE-2015-3310: Fix buffer overflow in radius plug-in's rc_mksid(). - fix-header-conflict.patch: avoid conflict with kernel headers - Use system-wide libatm instead of local copy (boo#1013567). - ppp-2.4.2-pie.patch: also enable PIE for /usr/sbin/pppstats - Add /etc/ppp, this directory is no longer part of filesystem. Most likely requiring sysconfig would be necessary. - Add Requires group(dialout) (boo#1067511). - Refresh spec-file via spec-cleaner. - Add ppp-modem package for automatic redial to mobile provider. - CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname buffer overflow in the eap_request and eap_response functions. - bsc#1197799: Add ppp-2.4.7-DES-openssl.patch to fix build on SLE-15-SP3 and SP4. - bsc#1218251, CVE-2022-4603, ppp-CVE-2022-4603.patch: improper validation of array index of the component pppdump. - fix bashisms in redialer script - add patches: * ppp-2.4.7-fix-bashisms.patch - Added ppp-CVE-2015-3310.patch: Fix for bnc#927841, CVE-2015-3310: Fix buffer overflow in radius plug-in's rc_mksid(). - fix-header-conflict.patch: avoid conflict with kernel headers - Use system-wide libatm instead of local copy (boo#1013567). - ppp-2.4.2-pie.patch: also enable PIE for /usr/sbin/pppstats - Add /etc/ppp, this directory is no longer part of filesystem. Most likely requiring sysconfig would be necessary. - Add Requires group(dialout) (boo#1067511). - Refresh spec-file via spec-cleaner. - Add ppp-modem package for automatic redial to mobile provider. - CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname buffer overflow in the eap_request and eap_response functions. - bsc#1197799: Add ppp-2.4.7-DES-openssl.patch to fix build on SLE-15-SP3 and SP4. - bsc#1218251, CVE-2022-4603, ppp-CVE-2022-4603.patch: improper validation of array index of the component pppdump. - Fix build of pppol2tp - remove local copy of if_pppol2tp.h that is out of sync with kernel definition. - Remove ppp-makedevice.patch, it is obsolete. - refresh patch - remove extra dependencies from doc files - update license to new format - license update: BSD-3-Clause and LGPL-2.1+ and GPL-2.0+ GPL-2.0 matches found in ppp-2.4.5/include/linux/if_pppol2tp.h - ppp-send-padt.patch: Send PADT at the end of a PPPoE session. - Add ppp-terminate-correct.patch, fix the pppd's hang after exit (bnc#693469). - Update to 2.4.6 + Man page updates. + Several bug fixes. + Options files can now set and unset environment variables for scripts. + The timeout for chat scripts can now be taken from an environment variable. + There is a new option, master_detach, which allows pppd to detach from the controlling terminal when it is the multilink bundle master but its own link has terminated, even if the nodetach option has been given. - Removed the following patches; - ppp-2.4.2-logwtmp.diff -- now checks for HAVE_LOGWTMP - ppp-2.4.3-demand-fix.diff -- using 'status' - ppp-terminate-correct.patch -- upstream inclusion - Rebased the following patches: * ppp-2.4.3-make.diff as ppp-2.4.6-make.diff * ppp-2.4.2-misc.diff as ppp-2.4.6-misc.diff * ppp-2.4.2-ifname.diff as ppp-2.4.6-ifname.diff * ppp-2.4.4-lib64.patch as ppp-2.4.6-lib64.patch - Url changed to ppp.samba.org - Use macros in spec file - We dont need to cleanup the buildroot - Update to 2.4.7: * Fixed a potential security issue in parsing option files (CVE-2014-3158, bnc#891489). * There is a new "stop-bits" option, which takes an argument of 1 or 2, indicating the number of stop bits to use for async serial ports. * Various bug fixes. - fix bashisms in redialer script - add patches: * ppp-2.4.7-fix-bashisms.patch - Added ppp-CVE-2015-3310.patch: Fix for bnc#927841, CVE-2015-3310: Fix buffer overflow in radius plug-in's rc_mksid(). - fix-header-conflict.patch: avoid conflict with kernel headers - Use system-wide libatm instead of local copy (boo#1013567). - ppp-2.4.2-pie.patch: also enable PIE for /usr/sbin/pppstats - Add /etc/ppp, this directory is no longer part of filesystem. Most likely requiring sysconfig would be necessary. - Add Requires group(dialout) (boo#1067511). - Refresh spec-file via spec-cleaner. - Add ppp-modem package for automatic redial to mobile provider. - CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname buffer overflow in the eap_request and eap_response functions. - bsc#1197799: Add ppp-2.4.7-DES-openssl.patch to fix build on SLE-15-SP3 and SP4. - bsc#1218251, CVE-2022-4603, ppp-CVE-2022-4603.patch: improper validation of array index of the component pppdump. - fix bashisms in redialer script - add patches: * ppp-2.4.7-fix-bashisms.patch - Added ppp-CVE-2015-3310.patch: Fix for bnc#927841, CVE-2015-3310: Fix buffer overflow in radius plug-in's rc_mksid(). - fix-header-conflict.patch: avoid conflict with kernel headers - Use system-wide libatm instead of local copy (boo#1013567). - ppp-2.4.2-pie.patch: also enable PIE for /usr/sbin/pppstats - Add /etc/ppp, this directory is no longer part of filesystem. Most likely requiring sysconfig would be necessary. - Add Requires group(dialout) (boo#1067511). - Refresh spec-file via spec-cleaner. - Add ppp-modem package for automatic redial to mobile provider. - CVE-2020-8597, bsc#1162610, ppp-CVE-2020-8597.patch: rhostname buffer overflow in the eap_request and eap_response functions. - bsc#1197799: Add ppp-2.4.7-DES-openssl.patch to fix build on SLE-15-SP3 and SP4. - bsc#1218251, CVE-2022-4603, ppp-CVE-2022-4603.patch: improper validation of array index of the component pppdump. - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - Add upstream procps-check-sanity-of-SC_ARG_MAX.patch in order to fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited. - prepare usrmerge (boo#1029961) - Package translations in procps-lang. - Update to procps-ng-3.3.17 * library: Incremented to 8:3:0 (no removals or additions, internal changes only) * all: properly handle utf8 cmdline translations issue #176 * kill: Pass int to signalled process merge #32 * pgrep: Pass int to signalled process merge #32 * pgrep: Check sanity of SG_ARG_MAX issue #152 * pgrep: Add older than selection merge #79 * pidof: Quiet mode merge #83 * pidof: show worker threads Redhat #1803640 * ps.1: Mention stime alias issue #164 * ps: check also match on truncated 16 char comm names * ps: Add exe output option Redhat #1399206 * ps: A lot more sorting available merge #99 * pwait: New command waits for a process merge #97 * sysctl: Match systemd directory order Debian #950788 * sysctl: Document directory order Debian #951550 * top: ensure config file backward compatibility Debian #951335 * top: add command line 'e' for symmetry with 'E' issue #165 * top: add '4' toggle for two abreast cpu display issue #172 * top: add '!' toggle for combining multiple cpus * top: fix potential SEGV involving -p switch merge #114 * vmstat: Wide mode gives wider proc columns merge #48 * watch: Add environment variable for interval merge #62 * watch: Add no linewrap option issue #182 * watch: Support more colors merge #106,#109 * free,uptime,slabtop: complain about extra ops issue #181 - Remove now obsolete upstream patches * procps-check-sanity-of-SC_ARG_MAX.patch * procps-ng-3e1c00d0.patch - Port patches * procps-ng-3.3.10-integer-overflow.patch * procps-ng-3.3.10-large_pcpu.patch * procps-ng-3.3.8-accuracy.dif * procps-ng-3.3.8-bnc634840.patch * procps-ng-3.3.8-petabytes.patch * procps-ng-3.3.8-tinfo.dif * procps-ng-3.3.9-w-notruncate.diff * procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff - Fix directory for Ukrainian man pages translations. - Move localized man pages to lang package. - Remove obsolete conditionals. - Remove obsolete --enable-oomem option. - Run spec-cleaner. - Add /usr/share/man/uk dir to file list for lang sub package - Remove /usr/share/man/uk dir to file list for lang sub package: It's now provided by filesystem. - Don't install translated man pages for non-installed binaries (uptime, kill). - Add upstream patch procps-3.3.17-bsc1181976.patch based on commit 3dd1661a to fix bsc#1181976 that is change descripton of psr, which is for 39th field of /proc/[pid]/stat - Skip test suite on emulated riscv64 systems as the qemu process is unexpected on the command lines of processes - Correct used URLs - Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is ignore SIGURG - Add the patches * procps-3.3.17-library-bsc1181475.patch * procps-3.3.17-top-bsc1181475.patch which are backports of current newlib tree to solve bug bsc#1181475 * 'free' command reports misleading "used" value - Some older products do not know about /usr/share/man/uk - Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412) - Make sure that correct library version is installed (bsc#1206412) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - Add patch CVE-2023-4016.patch * CVE-2023-4016: ps buffer overflow (bsc#1214290) - procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer logind over utmp (jsc#PED-3144) - Modify patches * procps-ng-3.3.9-w-notruncate.diff * procps-ng-3.3.17-logind.patch to real to not truncate output of w with option -n - Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244 and jira#PED-6369 - The patches now upstream had been dropped meanwhile * procps-vmstat-1b9ea611.patch (bsc#1185417) - For support up to 2048 CPU as well * bsc1209122-a6c0795d.patch (bnc#1209122) - allow `-´ as leading character to ignore possible errors on systctl entries * patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) - was a backport of an upstream fix to get the first CPU summary correct - Enable pidof for SLE-15 as this is provided by sysvinit-tools - Use a check on syscall __NR_pidfd_open to decide if the pwait tool and its manual page will be build - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - add 10355.patch to fix soversioning - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - update to 21.5: PHP * Added getContainingOneof and getRealContainingOneof to descriptor. * fix PHP readonly legacy files for nested messages Python * Fixed comparison of maps in Python. - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - update to 21.6: C++: * Reduce memory consumption of MessageSet parsing - update to 21.9: * Ruby * Replace libc strdup usage with internal impl to restore musl compat (#10818) * Auto capitalize enums name in Ruby (#10454) (#10763) * Other * Fix for grpc.tools #17995 & protobuf #7474 (handle UTF-8 paths in argumentfile) (#10721) * C++ * 21.x No longer define no_threadlocal on OpenBSD (#10743) * Java * Mark default instance as immutable first to avoid race during static initialization of default instances (#10771) * Refactoring java full runtime to reuse sub-message builders and prepare to migrate parsing logic from parse constructor to builder. * Move proto wireformat parsing functionality from the private "parsing constructor" to the Builder class. * Change the Lite runtime to prefer merging from the wireformat into mutable messages rather than building up a new immutable object before merging. This way results in fewer allocations and copy operations. * Make message-type extensions merge from wire-format instead of building up instances and merging afterwards. This has much better performance. * Fix TextFormat parser to build up recurring (but supposedly not repeated) sub-messages directly from text rather than building a new sub-message and merging the fully formed message into the existing field. - update to 21.10: * Java * Use bit-field int values in buildPartial to skip work on unset groups of fields. (#10960) * Mark nested builder as clean after clear is called (#10984) - update to 21.11: * Python * Add license file to pypi wheels (#10936) * Fix round-trip bug (#10158) - update to v21.12: * Python * Fix broken enum ranges (#11171) * Stop requiring extension fields to have a sythetic oneof (#11091) * Python runtime 4.21.10 not works generated code can not load valid proto. - Enable LTO (boo#1133277). - update to v22.3 UPB (Python/PHP/Ruby C-Extension) * Remove src prefix from proto import * Fix .gitmodules to use the correct absl branch * Remove erroneous dependency on googletest - update to 22.2: Java * Add version to intra proto dependencies and add kotlin stdlib dependency * Add $ back for osgi header * Remove $ in pom files - update to 22.1: * Add visibility of plugin.proto to python directory * Strip "src" from file name of plugin.proto * Add OSGi headers to pom files. * Remove errorprone dependency from kotlin protos. * Version protoc according to the compiler version number. - update to 22.0: * This version includes breaking changes to: Cpp. Please refer to the migration guide for information: https://protobuf.dev/support/migration/#compiler-22 * [Cpp] Migrate to Abseil's logging library. * [Cpp] `proto2::Map::value_type` changes to `std::pair`. * [Cpp] Mark final ZeroCopyInputStream, ZeroCopyOutputStream, and DefaultFieldComparator classes. * [Cpp] Add a dependency on Abseil (#10416) * [Cpp] Remove all autotools usage (#10132) * [Cpp] Add C++20 reserved keywords * [Cpp] Dropped C++11 Support * [Cpp] Delete Arena::Init * [Cpp] Replace JSON parser with new implementation * [Cpp] Make RepeatedField::GetArena non-const in order to support split RepeatedFields. * long list of bindings specific fixes see https://github.com/protocolbuffers/protobuf/releases/tag/v22.0 - python sub packages version is set 4.22.3 as defined in python/google/protobuf/__init__.py to stay compatible - skip python2 builds by default - drop patches: * 10355.patch, * gcc12-disable-__constinit-with-c++-11.patch (merged upstream) - added patches: * add-missing-stdint-header.patch added for compile fixes - Make possible to build on older systems, like SLE12 that miss some of the used macros. - Mention the rpmlintrc file in the spec. - Fix confusion in versions - drop python2 handling - fix version handling and package the private libs again - update to 22.5: C++ * Add missing cstdint header * Fix: missing -DPROTOBUF_USE_DLLS in pkg-config (#12700) * Avoid using string(JOIN..., which requires cmake 3.12 * Explicitly include GTest package in examples * Bump Abseil submodule to 20230125.3 (#12660) - update to 22.4: C++ * Fix libprotoc: export useful symbols from .so * Fix btree issue in map tests. Python * Fix bug in _internal_copy_files where the rule would fail in downstream repositories. Other * Bump utf8_range to version with working pkg-config (#12584) * Fix declared dependencies for pkg-config * Update abseil dependency and reorder dependencies to ensure we use the version specified in protobuf_deps. * Turn off clang::musttail on i386 - Add patch to fix linking ThreadSafeArena: * 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch - Drop the protobuf-source package, no longer used - update to 23.3: C++ * Regenerate stale files * Use the same ABI for static and shared libraries on non- Windows platforms * Add a workaround for GCC constexpr bug Objective-C * Regenerate stale files UPB (Python/PHP/Ruby C-Extension) * Fixed a bug in `upb_Map_Delete()` that caused crashes in map.delete(k) for Ruby when string-keyed maps were in use. Compiler * Add missing header to Objective-c generator * Add a workaround for GCC constexpr bug Java * Rollback of: Simplify protobuf Java message builder by removing methods that calls the super class only. Csharp * [C#] Replace regex that validates descriptor names - drop 0001-Use-the-same-ABI-for-static-and-shared-libraries-on-.patch (upstream) - update to 23.4: * Add dllexport_decl for generated default instance. * Deps: Update Guava to 32.0.1 - Build with source and target levels 8 * fixes build with JDK21 - Install the pom file with the new %%mvn_install_pom macro - Do not install the pom-only artifacts, since the %%mvn_install_pom macro resolves the variables at the install time - build against modern python on sle15 - update to 25.1: * Raise warnings for deprecated python syntax usages * Add support for extensions in CRuby, JRuby, and FFI Ruby * Add support for options in CRuby, JRuby and FFI (#14594) - update to 25.0: * Implement proto2/proto3 with editions * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Editions: Introduce functionality to protoc for generating edition feature set defaults. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Editions: Refactor feature resolution to use an intermediate message. * Publish extension declarations with declaration verifications. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Protoc: parser rejects explicit use of map_entry option * Protoc: validate that reserved range start is before end * Protoc: support identifiers as reserved names in addition to string literals (only in editions) * Drop support for Bazel 5. * Allow code generators to specify whether or not they support editions. [#] C++ * Set `PROTOBUF_EXPORT` on `InternalOutOfLineDeleteMessageLite()` * Update stale checked-in files * Apply PROTOBUF_NOINLINE to declarations of some functions that want it. * Implement proto2/proto3 with editions * Make JSON UTF-8 boundary check inclusive of the largest possible UTF-8 character. * Reduce `Map::size_type` to 32-bits. Protobuf containers can't have more than that * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Fix bug in reflection based Swap of map fields. * Add utf8_validation feature back to the global feature set. * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Add prefetching to arena allocations. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated repeated and map field accessors. * Editions: Migrate edition strings to enum in C++ code. * Create a reflection helper for ExtensionIdentifier. * Editions: Provide an API for C++ generators to specify their features. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated string field accessors. * Editions: Refactor feature resolution to use an intermediate message. * Fixes for 32-bit MSVC. * Publish extension declarations with declaration verifications. * Export the constants in protobuf's any.h to support DLL builds. * Implement AbslStringify for the Descriptor family of types. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated message field accessors. * Editions: Stop propagating partially resolved feature sets to plugins. * Editions: Migrate string_field_validation to a C++ feature * Editions: Include defaults for any features in the generated pool. * Introduce C++ feature for UTF8 validation. * Protoc: validate that reserved range start is before end * Remove option to disable the table-driven parser in protoc. * Lock down ctype=CORD in proto file. * Support split repeated fields. * In OSS mode omit some extern template specializations. * Allow code generators to specify whether or not they support editions. [#] Java * Implement proto2/proto3 with editions * Remove synthetic oneofs from Java gencode field accessor tables. * Timestamps.parse: Add error handling for invalid hours/minutes in the timezone offset. * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Add missing debugging version info to Protobuf Java gencode when multiple files are generated. * Fix a bad cast in putBuilderIfAbsent when already present due to using the result of put() directly (which is null if it currently has no value) * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Fix a NPE in putBuilderIfAbsent due to using the result of put() directly (which is null if it currently has no value) * Update Kotlin compiler to escape package names * Add MapFieldBuilder and change codegen to generate it and the put{field}BuilderIfAbsent method. * Introduce recursion limit in Java text format parsing * Consider the protobuf.Any invalid if typeUrl.split("/") returns an empty array. * Mark `FieldDescriptor.hasOptionalKeyword()` as deprecated. * Fixed Python memory leak in map lookup. * Loosen upb for json name conflict check in proto2 between json name and field * Defines Protobuf compiler version strings as macros and separates out suffix string definition. * Add `ABSL_ATTRIBUTE_LIFETIME_BOUND` attribute on generated oneof accessors. * Ensure Timestamp.ToDatetime(tz) has correct offset * Do not check required field for upb python MergeFrom * Setting up version updater to prepare for poison pills and embedding version info into C++, Python and Java gencode. * Merge the protobuf and upb Bazel repos * Comparing a proto message with an object of unknown returns NotImplemented * Emit __slots__ in pyi output as a tuple rather than a list for --pyi_out. * Fix a bug that strips options from descriptor.proto in Python. * Raise warings for message.UnknownFields() usages and navigate to the new add * Add protobuf python keyword support in path for stub generator. * Add tuple support to set Struct * ### Python C-Extension (Default) * Comparing a proto message with an object of unknown returns NotImplemented * Check that ffi-compiler loads before using it to define tasks. [#] UPB (Python/PHP/Ruby C-Extension) * Include .inc files directly instead of through a filegroup * Loosen upb for json name conflict check in proto2 between json name and field * Add utf8_validation feature back to the global feature set. * Do not check required field for upb python MergeFrom * Merge the protobuf and upb Bazel repos * Added malloc_trim() calls to Python allocator so RSS will decrease when memory is freed * Upb: fix a Python memory leak in ByteSize() * Support ASAN detection on clang * Upb: bugfix for importing a proto3 enum from within a proto2 file * Expose methods needed by Ruby FFI using UPB_API * Fix `PyUpb_Message_MergeInternal` segfault - Add patch to fix StackOverflow vulnerability in Protocol Buffers * CVE-2024-7254.patch (bsc#1230778, CVE-2024-7254) - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - Conditionalize python2 and python3 in order to be able to build without python2 present in distribution * Use singlespec macros to simplify the logic - Run fdupes on python modules to avoid duplicates - Remove shebangs from import-only code - Add adding-Release_CompareAndSwap-64-bit-variant.patch * Fix compile error undefined reference to `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)' on s390x https://github.com/google/protobuf/issues/3937 update to version v3.5.2: * Update release date * Disable pip cache when testing uploaded packages * Replace private timelib_update_ts with public date_timestamp_get * Remove py2.6 support. * Cherrypick for csharp, including: * Update changelog * Update changelog for 3.5.1 * Fix uploading binary wheel. * Fix memory leak when creating map field via array. * Update rake file to build of 2.1.6. * Avoid using php_date_get_date_ce() in case date extension is not * Update protoc-artfacts * Fix string::back() usage in googletest.cc * Fix memory leak in php7 * Support ruby2.5 * io_win32: support non-ASCII paths * Explicitly propagate the status of Flush(). * Add discard unknown API in ruby. (#3990) * Update version for 3.5.0.post1 * remove nullptr * Fix more memory leak for php c extension (#4211) * Bumping number to fix ruby 2.1 on mac * io_win32_unittest: remove incorrect error check * Fix memory leak when creating repeated field via array. * Update version number for php c extension (#3896) * Fix file permission for python package. * Create containing directory before generating well_known_types_embed.cc * Replace C++11 only method std::map::at * Recursively clear unknown fields in submessages. (#3982) * Update version number to 3.5.1 * io_win32_unittest: fix condition in GetCwdAsUtf8 * Add release log * io_win32_unittest: use CWD as last tempdir * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util * Add support for Windows ARM64 build * Add protobuf-all in post release * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886) * Add _file_desc_by_toplevel_extension back * Fix setup.py for windows build. * io_win32_unittest: make //:win32_test run again * Provide discardUnknonwnFields API in php (#3976) * Update php c extension version number to 3.5.0.1 * Fix ruby gc_test in ruby 2.4 (#4011) * Remove duplicate typedef. (#3975) * Accept DatetimeInterface in fromDatetime * io_win32: add more encoding-related tests * Bump version number to 3.5.2 * Bump protoc-artifact version for a patch rebuild * Call php method via function name instead of calling directly. * Well known types are not initialized properly. (#4139) * Use matching enum type for IsPOD. * Fix several more memory leak * Fix for php5.5 * Add backslach to make class explict in global namespace - update to version v3.6.1: * PHP namespaces for nested messages and enums (#4536) * Allows the json marshaller to be passed json marshal options (#4252) * Make sure to delete temporary maps used by FileDescriptorTables * fix python cpp kokoro build * Change C# reflection to avoid using expression trees * Updated checked-in generated code * Removed unused variables in repeated_scalar_container.cc * Removed unused code pertaining to shared_ptr * Include no_package.proto in Python test * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262) * Convert descriptortype to type for upb_msgval_sizeof (#4357) * Removed duplicate using statement from ReflectionUtil.cs * Add support for power ppc64le * Cat the test-suite.log on errors for presubits * Address review comments * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword. * Delete javanano kokoro build configs. * Updated Ruby conformance test failure list * Removed use of some type traits * Adopt php_metadata_namespace in php code generator (#4622) * Move to Xcode 9.3 which also means a High Sierra image. * Add protoc release script for Linux build. * protoc-artifacts: Avoid storing temporary files and use fewer layers * Rewrite go_benchmark * Add files to build ruby artifact for mac on kokoro (#4814) * Remove javanano. * Comment out unused command from release script. * Avoid direct check of class name (#4601) * The JsonParseOptions::ignore_unknown_fields option behavior treats * Fix php memory leak test (#4692) * Fix benchmark build * Add VS2017 optional component dependency details to the C# readme (#4128) * Fix initialization with Visual Studio * For windows, all python version should use /MT (#4468) * use brew install instead of easy_install in OSX (#4537) * Sync upb change (#4373) * Always add -std=c++11 for mac (#4684) * Add kokoro build status badges. * Removed unrecognized option from no_package.proto * Fixed up proto3_lite_unittest.cc * Update Xcode settings * Cleanup LICENSE file. * Remove js_embed binary. (#4709) * Fixed JS parsing of unspecified map keys * Update version number to 3.6.0 * Deliberately call simple code to avoid Unity linker pruning * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources." * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1 * MinGW build failed * Support using MSVC intrinsics in Log2FloorNonZero * Fix array constructor in c extension for compatibility (#4667) * Add space between class name and concat message (#4577) * fix python * Add performance.md and add instruction for linking tcmalloc * Add script for run and upload the benchmark result to bq * Add test for failing write of raw pointer to output stream * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556) * Remove stray indent on normal imports. * Fix python ext build on kokoro (#4527) * Add compile test sources for to test include order. * Fixed a Visual Studio 2017 build error. (#4488) * fix linux kokoro build in docker * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350) * Updated Docker setup to use GCC 4.8 * Remove broken build status icons. * Run autogen.sh in release script. * Output *_pb2_grpc.py when use_grpc_plugin=True * Adopt ruby_package in ruby generated code. (#4627) * Cygwin build failed * Work around an "old runtime" issue with reflection * Added Kokoro protoc release build for OS X (#4770) * Updated change log for 3.6.1 release * Move methods out of class (#4697) * Fix to allow AOT compilers to play nicely with reflection * Update Makefile.am for Java lite files. * Added map_lite_test.proto to fix LiteTest * Introduce a compatiblity shim to support .NET 3.5 delegate creation * Revert "Removed mention of Buffer in byteSourceToUint8Array" * Add gogo benchmark * Set ext.no_native = true for non mac platform * Removed atomicops.h since it is no longer used * Rename a shadowed variable. * Add kokoro bazel configs for 3.6.x branch. * Deleted scoped_ptr.h * Check the message to be encoded is the wrong type. (#4885) (#4949) * protoc-artifacts: Avoid checking out protobuf code * Add conformance test for null value in list JSON * Build ruby gem on kokoro (#4819) * Try using a new version of Visual Studio on AppVeyor * Make ruby release configs consistent with protoc. * fix for API change in PHP 7.3 (#4898) * Add .proto files to extract_includes.bat * Update protoc build scripts. * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation. * Additional support for building and deploying ppcle_64 artifacts * Fix php tests * Cleanup + documentation for Java Lite runtime. * Added Kokoro Windows release build config for protoc (#4766) * typo * fix golang kokoro linux build * Fix spelling error of __GNUC_MINOR__ * Update code to work for Xcode 10b1 (#4729) * Added pyext/thread_unsafe_shared_ptr.h * Added missing .inc files to BUILD * js message support for jstype string on integers (#4332) * Improve error message when googletest is missing. * Make assertEquals pass for message (#4947) * Sync internal benchmark changes * Removed some unused C++ source files * Fix missing LIBPROTOC_EXPORT. * Added new test source files to Makefile.am * Update php version to 3.6.0 (#4736) * Fix RepeatedField#delete_if (#4292) * Merge branch (#4466) * Implement array constructor in php c extension. * protoc-artifacts: Update centos base from 6.6 to 6.9 * PHP array constructors for protobuf messages (#4530) * Fix problem: cmake build failed in c++11 by clang * Don't assume Windows builds use MSVC. * Use legacy name in php runtime (#4741) * Add file option php_metadata_namespace and ruby_package (#4609) * Fix cpp benchmark dependency on mac * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault * Check return value on write of raw pointer * Delete unused directories. * Replace //:protoc and similar default macro arguments with * Add extra C# file to Makefile.am * includes the expected class in the exception, otherwise the error is harder to track down (#3371) * Update instructions about getting protobuf source. * Add cpp tests under release docker image. * fix java benchmark, fix dashboard build * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang. * Rename build_artifacts.cfg to release.cfg (#4818) * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings * source code info for interpreted options; fix source code info for extension range options (#4342) * Updated version numbers to 3.6.1 * Trim imports for bundled generated protos. * Require C++11 and pass -std=c++11 * Remove the iOS Test App. * fix duplicate mkdir in update_file_lists.sh * Updated csharp/README.md to reflect testing changes * Fix bazel build of examples. * Add missing ruby/tests/test_ruby_package.proto * Fix cpp_distcheck * Updated the change log with changes for 3.6.0 * some fix * CMake: Update CXX Standard management * Add the files added in #4485. * Change to deal all messages in one loop * Fix php conformance test. * Add __init__.py files to compiler and util subpackages (#4117) * Updated .gitignore to exclude downloaded gmock/ directory * Fix error in Clang UndefinedBehaviorSanitizer * Work around MSVC issue with std::atomic initialization (#4777) * Updated conformance failure lists * Add back GeneratedClassName to public (#4686) * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829) * Throw error if user want to access message properties (#4603) * fix json_decode call parameters (#4381) * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources. * PHP: fixed typo in message.c * Add go benchmark * Allow list values to be null when parsing * Added instruction for existing ZLIB configuration * Fix 32bit php tests * Removed javanano from post_process_dist.sh * Don't generate imports for the WKTs unless generating the WKTs. * For encoding upb needs descriptor type instead of type. (#4354) * Include googletest as a submodule (#3993) * Write messages to backing field in generated C# cloning code (#4440) * Integrated internal changes from Google - Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied upstream. - bump soname version - Add maven pom files to the protobuf-java package - Add protobuf-source package - some programs using gRPC and protobuf need protobuf definitions which are included inside the source code, but are not included in the devel package. - Add upstream patch which fixes build with Bazel 0.22.0. * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch - Disable LTO (boo#1133277). - Update to new upstream release 3.8.0 * Introduced new MOMI (maybe-outside-memory-interval) parser. * Added use of C++ override keyword where appropriate. * Always declare enums to be int-sized. * Append '_' to C++ reserved keywords for message, enum, extension. - Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch (upstreamed) - Specify java source and target levels in order to build compatible protobuf-java binaries - Update to new upstream release 3.9.1 * Optimized the implementation of RepeatedPtrFieldBase. * Added delimited parse and serialize util. * Added FieldDescriptor::PrintableNameForExtension() and DescriptorPool::FindExtensionByPrintableName(). The latter will replace Reflection::FindKnownExtensionByName(). * Created a new Add method in repeated field that allows adding a range of elements all at once. * Drop building wheel for Python 3.4. - Package also the protobuf-bom pom file - Updated to version 3.9.2 (bsc#1162343) (Objective-C) * Remove OSReadLittle* due to alignment requirements. (#6678) * Don't use unions and instead use memcpy for the type swaps. (#6672) - Use tarball provided by upstream - Small package cleanup - Add missing dependency of python subpackages on python-six (bsc#1177127). - Fix Requires for python3 to python3-six. - Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570, bsc#1195258 * Add protobuf-CVE-2021-22570.patch - Fix potential Denial of Service in protobuf-java in the parsing procedure for binary data, CVE-2021-22569, bsc#1194530 * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch - Fix a potential DoS issue in protobuf-cpp and protobuf-python, CVE-2022-1941, bsc#1203681 * Add protobuf-CVE-2022-1941.patch - Fix a potential DoS issue when parsing with binary data in protobuf-java, CVE-2022-3171, bsc#1204256 * Add protobuf-CVE-2022-3171.patch - Refresh protobuf-CVE-2021-22570.patch - Backport changes from 3.16.x tree for apply recent CVE patches * Add protobuf-51026d922970e06475f005b39287963594134b96.patch * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch - Reorganize patch set ordering - Build the java part with maven, so that we create artifacts that correspond to upstream distributed ones. - Add maven artifact metadata to the protoc binary - Package also the bom and pom artifacts - Replace negative list %nopeek with positive list %have_peekfd - Modify psmisc-22.21.dif to enforce the usage of `m' flag in sscanf() instead of `a' for allocation. Also avoid to small buffers and include sys/sysmacros.h for makedev macro. - Add the patch psmisc-22.21-lessnfs.patch to support device files of mount points as well (boo#1044638) - Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision only for NFS shares - Update to version 23.0 * killall: Fix process age race condition !11 Debian #822861 * killall: only use scope of current namespace by default * killall: better parsing of command names * pstree: add cgroup namespaces !10 * peekfd: Help give long options too !5 * killall: correctly report when 32+ procs match !8 * prtat: Remove duplicate options in man page !3 Debian #846387 * pslog: New program to check what logs are open merge !1 * fuser: increase path length for octal escaping SF [#37] * Make usage of linked lists of devices found in /proc/self/mountinfo optional * Make timeout() in timeout.c work with shared mmap to reduce the load due write/read the stat buffers * Add list_sort() to lists.h to be able to sort lists * fuser: Fixed typo for -M flag. Debian #740275 * pstree: by default doesn't show threadnames, use -t to show as it disables compaction. SF [#33] Debian #815902 * pstree: Removed need for PATH_MAX Debian #750405 * pstree: ignores disappeared processes. SF [#34] * killall: -o and -y work with -r flags. SF [#64] * m4/gettext.m4: Upgrade to gettext-0.19.4. * m4/iconv.m4: Upgrade to gettext-0.19.4. * m4/lib-ld.m4: Upgrade to gettext-0.19.4. * m4/lib-link.m4: Upgrade to gettext-0.19.4. * m4/lib-prefix.m4: Upgrade to gettext-0.19.4. * m4/nls.m4: Upgrade to gettext-0.19.4. * m4/po.m4: Upgrade to gettext-0.19.4. * m4/progtest.m4: Upgrade to gettext-0.19.4. * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4. - Make it build, that is create a po/POTFILES.in - Remove obsolete patches * psmisc-22.21-boo908063.patch * psmisc-22.12-tigetstr.patch * psmisc-22.21-upstream.patch * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch - Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif - Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973) - Last revision was 78 - Add patch psmisc-23.0-killall.patch to remove left over debug output in killall utility (boo#1046237) - Add patch psmisc-23.0-net.patch to reenable network support broken to my own upstream commit - Remove patches * psmisc-22.21-lessnfs.patch * psmisc-22.21-mntpt.patch * psmisc-23.0-net.patch - Add patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo which is a heavily rework fuser used on NFS * Use mountinfo to be able to use the mount identity which allows to distinguish different mounts with the same device number as it happens with NFS shares. * Smaller cleanup as support of chroot environments and older systems. * Add support for name_to_handle_at() system call to get the real mount ID for each file - Use test suite of psmisc in %check rpm section - Update patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990 by prior scanning for signal names in the arguments of killall - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to run even on older kernels missing mnt_id tag in fdinfo - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to let fuser -m also work for private mounts as well (boo#1093665) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to make fuser option -m <block_device> work even with mountinfo (bsc#1098697) - Support also btrFS entries in mountinfo, that is use stat(2) to determine the device of the mounted subvolume (bsc#1098697, bsc#1112780) this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to handle sub volumes of the btrFS (bsc#1112780) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Always initialize head of simple linked list (bsc#1098697) * stat(2) on binary does not see subvol dev - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Allow not unique mounts as well as not unique mountpoint (bsc#1170247) - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1178407: fuser does not show open kvm storage image files such as qcow2 files. Patch from Ali Abdallah <ali.abdallah@suse.com> - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1185208 to make private mount namespaces work as well as to distinguish NFS mounts from same remote device share. - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Determine the namespace of a process only once to speed up the parsing of fdinfo (bsc#1194172). - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Add a fallback if the system call name_to_handle_at() is not supported by the used file system. - Add patch psmisc-22.21-semaphores.patch * Replace the synchronizing over pipes of the sub process for the stat(2) system call with mutex and conditions from pthreads(7) (bsc#1194172) - Add patch psmisc-22.21-statx.patch * Use statx(2) or SYS_statx system call to replace the stat(2) system call and avoid the sub process at all (bsc#1194172) - Fix version at configure time as there was no .tarball-version - Replace negative list %nopeek with positive list %have_peekfd - Modify psmisc-22.21.dif to enforce the usage of `m' flag in sscanf() instead of `a' for allocation. Also avoid to small buffers and include sys/sysmacros.h for makedev macro. - Add the patch psmisc-22.21-lessnfs.patch to support device files of mount points as well (boo#1044638) - Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision only for NFS shares - Update to version 23.0 * killall: Fix process age race condition !11 Debian #822861 * killall: only use scope of current namespace by default * killall: better parsing of command names * pstree: add cgroup namespaces !10 * peekfd: Help give long options too !5 * killall: correctly report when 32+ procs match !8 * prtat: Remove duplicate options in man page !3 Debian #846387 * pslog: New program to check what logs are open merge !1 * fuser: increase path length for octal escaping SF [#37] * Make usage of linked lists of devices found in /proc/self/mountinfo optional * Make timeout() in timeout.c work with shared mmap to reduce the load due write/read the stat buffers * Add list_sort() to lists.h to be able to sort lists * fuser: Fixed typo for -M flag. Debian #740275 * pstree: by default doesn't show threadnames, use -t to show as it disables compaction. SF [#33] Debian #815902 * pstree: Removed need for PATH_MAX Debian #750405 * pstree: ignores disappeared processes. SF [#34] * killall: -o and -y work with -r flags. SF [#64] * m4/gettext.m4: Upgrade to gettext-0.19.4. * m4/iconv.m4: Upgrade to gettext-0.19.4. * m4/lib-ld.m4: Upgrade to gettext-0.19.4. * m4/lib-link.m4: Upgrade to gettext-0.19.4. * m4/lib-prefix.m4: Upgrade to gettext-0.19.4. * m4/nls.m4: Upgrade to gettext-0.19.4. * m4/po.m4: Upgrade to gettext-0.19.4. * m4/progtest.m4: Upgrade to gettext-0.19.4. * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4. - Make it build, that is create a po/POTFILES.in - Remove obsolete patches * psmisc-22.21-boo908063.patch * psmisc-22.12-tigetstr.patch * psmisc-22.21-upstream.patch * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch - Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif - Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973) - Last revision was 78 - Add patch psmisc-23.0-killall.patch to remove left over debug output in killall utility (boo#1046237) - Add patch psmisc-23.0-net.patch to reenable network support broken to my own upstream commit - Remove patches * psmisc-22.21-lessnfs.patch * psmisc-22.21-mntpt.patch * psmisc-23.0-net.patch - Add patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo which is a heavily rework fuser used on NFS * Use mountinfo to be able to use the mount identity which allows to distinguish different mounts with the same device number as it happens with NFS shares. * Smaller cleanup as support of chroot environments and older systems. * Add support for name_to_handle_at() system call to get the real mount ID for each file - Use test suite of psmisc in %check rpm section - Update patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990 by prior scanning for signal names in the arguments of killall - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to run even on older kernels missing mnt_id tag in fdinfo - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to let fuser -m also work for private mounts as well (boo#1093665) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to make fuser option -m <block_device> work even with mountinfo (bsc#1098697) - Support also btrFS entries in mountinfo, that is use stat(2) to determine the device of the mounted subvolume (bsc#1098697, bsc#1112780) this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to handle sub volumes of the btrFS (bsc#1112780) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Always initialize head of simple linked list (bsc#1098697) * stat(2) on binary does not see subvol dev - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Allow not unique mounts as well as not unique mountpoint (bsc#1170247) - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1178407: fuser does not show open kvm storage image files such as qcow2 files. Patch from Ali Abdallah <ali.abdallah@suse.com> - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1185208 to make private mount namespaces work as well as to distinguish NFS mounts from same remote device share. - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Determine the namespace of a process only once to speed up the parsing of fdinfo (bsc#1194172). - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Add a fallback if the system call name_to_handle_at() is not supported by the used file system. - Add patch psmisc-22.21-semaphores.patch * Replace the synchronizing over pipes of the sub process for the stat(2) system call with mutex and conditions from pthreads(7) (bsc#1194172) - Add patch psmisc-22.21-statx.patch * Use statx(2) or SYS_statx system call to replace the stat(2) system call and avoid the sub process at all (bsc#1194172) - Fix version at configure time as there was no .tarball-version - Replace negative list %nopeek with positive list %have_peekfd - Modify psmisc-22.21.dif to enforce the usage of `m' flag in sscanf() instead of `a' for allocation. Also avoid to small buffers and include sys/sysmacros.h for makedev macro. - Add the patch psmisc-22.21-lessnfs.patch to support device files of mount points as well (boo#1044638) - Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision only for NFS shares - Update to version 23.0 * killall: Fix process age race condition !11 Debian #822861 * killall: only use scope of current namespace by default * killall: better parsing of command names * pstree: add cgroup namespaces !10 * peekfd: Help give long options too !5 * killall: correctly report when 32+ procs match !8 * prtat: Remove duplicate options in man page !3 Debian #846387 * pslog: New program to check what logs are open merge !1 * fuser: increase path length for octal escaping SF [#37] * Make usage of linked lists of devices found in /proc/self/mountinfo optional * Make timeout() in timeout.c work with shared mmap to reduce the load due write/read the stat buffers * Add list_sort() to lists.h to be able to sort lists * fuser: Fixed typo for -M flag. Debian #740275 * pstree: by default doesn't show threadnames, use -t to show as it disables compaction. SF [#33] Debian #815902 * pstree: Removed need for PATH_MAX Debian #750405 * pstree: ignores disappeared processes. SF [#34] * killall: -o and -y work with -r flags. SF [#64] * m4/gettext.m4: Upgrade to gettext-0.19.4. * m4/iconv.m4: Upgrade to gettext-0.19.4. * m4/lib-ld.m4: Upgrade to gettext-0.19.4. * m4/lib-link.m4: Upgrade to gettext-0.19.4. * m4/lib-prefix.m4: Upgrade to gettext-0.19.4. * m4/nls.m4: Upgrade to gettext-0.19.4. * m4/po.m4: Upgrade to gettext-0.19.4. * m4/progtest.m4: Upgrade to gettext-0.19.4. * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4. - Make it build, that is create a po/POTFILES.in - Remove obsolete patches * psmisc-22.21-boo908063.patch * psmisc-22.12-tigetstr.patch * psmisc-22.21-upstream.patch * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch - Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif - Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973) - Last revision was 78 - Add patch psmisc-23.0-killall.patch to remove left over debug output in killall utility (boo#1046237) - Add patch psmisc-23.0-net.patch to reenable network support broken to my own upstream commit - Remove patches * psmisc-22.21-lessnfs.patch * psmisc-22.21-mntpt.patch * psmisc-23.0-net.patch - Add patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo which is a heavily rework fuser used on NFS * Use mountinfo to be able to use the mount identity which allows to distinguish different mounts with the same device number as it happens with NFS shares. * Smaller cleanup as support of chroot environments and older systems. * Add support for name_to_handle_at() system call to get the real mount ID for each file - Use test suite of psmisc in %check rpm section - Update patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990 by prior scanning for signal names in the arguments of killall - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to run even on older kernels missing mnt_id tag in fdinfo - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to let fuser -m also work for private mounts as well (boo#1093665) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to make fuser option -m <block_device> work even with mountinfo (bsc#1098697) - Support also btrFS entries in mountinfo, that is use stat(2) to determine the device of the mounted subvolume (bsc#1098697, bsc#1112780) this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to handle sub volumes of the btrFS (bsc#1112780) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Always initialize head of simple linked list (bsc#1098697) * stat(2) on binary does not see subvol dev - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Allow not unique mounts as well as not unique mountpoint (bsc#1170247) - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1178407: fuser does not show open kvm storage image files such as qcow2 files. Patch from Ali Abdallah <ali.abdallah@suse.com> - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1185208 to make private mount namespaces work as well as to distinguish NFS mounts from same remote device share. - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Determine the namespace of a process only once to speed up the parsing of fdinfo (bsc#1194172). - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Add a fallback if the system call name_to_handle_at() is not supported by the used file system. - Add patch psmisc-22.21-semaphores.patch * Replace the synchronizing over pipes of the sub process for the stat(2) system call with mutex and conditions from pthreads(7) (bsc#1194172) - Add patch psmisc-22.21-statx.patch * Use statx(2) or SYS_statx system call to replace the stat(2) system call and avoid the sub process at all (bsc#1194172) - Fix version at configure time as there was no .tarball-version - Replace negative list %nopeek with positive list %have_peekfd - Modify psmisc-22.21.dif to enforce the usage of `m' flag in sscanf() instead of `a' for allocation. Also avoid to small buffers and include sys/sysmacros.h for makedev macro. - Add the patch psmisc-22.21-lessnfs.patch to support device files of mount points as well (boo#1044638) - Add the patch psmisc-22.21-mntpt.patch to do strinfg comparision only for NFS shares - Update to version 23.0 * killall: Fix process age race condition !11 Debian #822861 * killall: only use scope of current namespace by default * killall: better parsing of command names * pstree: add cgroup namespaces !10 * peekfd: Help give long options too !5 * killall: correctly report when 32+ procs match !8 * prtat: Remove duplicate options in man page !3 Debian #846387 * pslog: New program to check what logs are open merge !1 * fuser: increase path length for octal escaping SF [#37] * Make usage of linked lists of devices found in /proc/self/mountinfo optional * Make timeout() in timeout.c work with shared mmap to reduce the load due write/read the stat buffers * Add list_sort() to lists.h to be able to sort lists * fuser: Fixed typo for -M flag. Debian #740275 * pstree: by default doesn't show threadnames, use -t to show as it disables compaction. SF [#33] Debian #815902 * pstree: Removed need for PATH_MAX Debian #750405 * pstree: ignores disappeared processes. SF [#34] * killall: -o and -y work with -r flags. SF [#64] * m4/gettext.m4: Upgrade to gettext-0.19.4. * m4/iconv.m4: Upgrade to gettext-0.19.4. * m4/lib-ld.m4: Upgrade to gettext-0.19.4. * m4/lib-link.m4: Upgrade to gettext-0.19.4. * m4/lib-prefix.m4: Upgrade to gettext-0.19.4. * m4/nls.m4: Upgrade to gettext-0.19.4. * m4/po.m4: Upgrade to gettext-0.19.4. * m4/progtest.m4: Upgrade to gettext-0.19.4. * configure.ac (AM_GNU_GETTEXT_VERSION): Bump to 0.19.4. - Make it build, that is create a po/POTFILES.in - Remove obsolete patches * psmisc-22.21-boo908063.patch * psmisc-22.12-tigetstr.patch * psmisc-22.21-upstream.patch * psmisc-git-3638cc55b4d08851faba46635d737b24d016665b.patch - Rename patch psmisc-22.21.dif which becomes psmisc-23.0.dif - Make /bin/fuser a symblic link of /usr/bin/fuser (boo#1029973) - Last revision was 78 - Add patch psmisc-23.0-killall.patch to remove left over debug output in killall utility (boo#1046237) - Add patch psmisc-23.0-net.patch to reenable network support broken to my own upstream commit - Remove patches * psmisc-22.21-lessnfs.patch * psmisc-22.21-mntpt.patch * psmisc-23.0-net.patch - Add patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch from https://gitlab.com/bitstreamout/psmisc/tree/mountinfo which is a heavily rework fuser used on NFS * Use mountinfo to be able to use the mount identity which allows to distinguish different mounts with the same device number as it happens with NFS shares. * Smaller cleanup as support of chroot environments and older systems. * Add support for name_to_handle_at() system call to get the real mount ID for each file - Use test suite of psmisc in %check rpm section - Update patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Add patch psmisc-23.0-killall-signals.patch to fix boo#1058990 by prior scanning for signal names in the arguments of killall - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to run even on older kernels missing mnt_id tag in fdinfo - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to let fuser -m also work for private mounts as well (boo#1093665) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to make fuser option -m <block_device> work even with mountinfo (bsc#1098697) - Support also btrFS entries in mountinfo, that is use stat(2) to determine the device of the mounted subvolume (bsc#1098697, bsc#1112780) this modifies patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch to handle sub volumes of the btrFS (bsc#1112780) - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Always initialize head of simple linked list (bsc#1098697) * stat(2) on binary does not see subvol dev - Modify patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Allow not unique mounts as well as not unique mountpoint (bsc#1170247) - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1178407: fuser does not show open kvm storage image files such as qcow2 files. Patch from Ali Abdallah <ali.abdallah@suse.com> - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Fix bsc#1185208 to make private mount namespaces work as well as to distinguish NFS mounts from same remote device share. - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Determine the namespace of a process only once to speed up the parsing of fdinfo (bsc#1194172). - Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch * Add a fallback if the system call name_to_handle_at() is not supported by the used file system. - Add patch psmisc-22.21-semaphores.patch * Replace the synchronizing over pipes of the sub process for the stat(2) system call with mutex and conditions from pthreads(7) (bsc#1194172) - Add patch psmisc-22.21-statx.patch * Use statx(2) or SYS_statx system call to replace the stat(2) system call and avoid the sub process at all (bsc#1194172) - Fix version at configure time as there was no .tarball-version - update to 2.7: - Choice and prefix loaders now dispatch source and template lookup separately in order to work in combination with module loaders as advertised. - Fixed filesizeformat. - Added a non-silent option for babel extraction. - Added `urlencode` filter that automatically quotes values for URL safe usage with utf-8 as only supported encoding. If applications want to change this encoding they can override the filter. - Added `keep-trailing-newline` configuration to environments and templates to optionally preserve the final trailing newline. - Accessing `last` on the loop context no longer causes the iterator to be consumed into a list. - Python requirement changed: 2.6, 2.7 or >= 3.3 are required now, supported by same source code, using the "six" compatibility library. - Allow `contextfunction` and other decorators to be applied to `__call__`. - Added support for changing from newline to different signs in the `wordwrap` filter. - Added support for ignoring memcache errors silently. - Added support for keeping the trailing newline in templates. - Added finer grained support for stripping whitespace on the left side of blocks. - Added `map`, `select`, `reject`, `selectattr` and `rejectattr` filters. - Added support for `loop.depth` to figure out how deep inside a recursive loop the code is. - Disabled py_compile for pypy and python 3. - update to 2.7.1: - Fixed a bug with ``call_filter`` not working properly on environment and context filters. - Fixed lack of Python 3 support for bytecode caches. - Reverted support for defining blocks in included templates as this broke existing templates for users. - Fixed some warnings with hashing of undefineds and nodes if Python is run with warnings for Python 3. - Added support for properly hashing undefined objects. - Fixed a bug with the title filter not working on already uppercase strings. - Avoid "Recommends:" on old rpm distros - Require python-setuptools instead of distribute (upstreams merged) - update to 2.7.2: - Prefix loader was not forwarding the locals properly to inner loaders. This is now fixed. - Security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems. See `Debian bug 734747`_ for more information. - avoid rebuildcycle with vim - fix package build (file selection missing) - Update to 2.7.3 (bnc#858239, CVE-2014-0012) - Security issue: Corrected the security fix for the cache folder. This fix was provided by RedHat. - adjust dependency to use up to date package name for python-MarkupSafe - run testsuite during build - Use %python_version over %py_ver: better portability to RHEL - Update to 2.8 - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Tests are removed from the package (not distributed in the tar.gz) - Update to 2.9.5 (bsc#1132174, CVE-2016-10745) (see the changes in /usr/share/doc/packages/python-Jinja2/CHANGES) - updated source URL - fix requires - update for singlespec - update to 2.9.6 * fixed custom context behavior in fast resolve mode - specfile: * CHANGES -> CHANGES.rst * added README.rst to %doc section - update to version 2.10: * Added a new extension node called "OverlayScope" which can be used to create an unoptimized scope that will look up all variables from a derived context. * Added an "in" test that works like the in operator. This can be used in combination with "reject" and "select". * Added "previtem" and "nextitem" to loop contexts, providing access to the previous/next item in the loop. If such an item does not exist, the value is undefined. * Added "changed(*values)" to loop contexts, providing an easy way of checking whether a value has changed since the last iteration (or rather since the last call of the method) * Added a "namespace" function that creates a special object which allows attribute assignment using the "set" tag. This can be used to carry data across scopes, e.g. from a loop body to code that comes after the loop. * Added a "trimmed" modifier to "{% trans %}" to strip linebreaks and surrounding whitespace. Also added a new policy to enable this for all "trans" blocks. * The "random" filter is no longer incorrectly constant folded and will produce a new random choice each time the template is rendered. (`#478`_) * Added a "unique" filter. (`#469`_) * Added "min" and "max" filters. (`#475`_) * Added tests for all comparison operators: "eq", "ne", "lt", "le", "gt", "ge". (`#665`_) * "import" statement cannot end with a trailing comma. (`#617`_, `#618`_) * "indent" filter will not indent blank lines by default. (`#685`_) * Add "reverse" argument for "dictsort" filter. (`#692`_) * Add a "NativeEnvironment" that renders templates to native Python types instead of strings. (`#708`_) * Added filter support to the block "set" tag. (`#489`_) * "tojson" filter marks output as safe to match documented behavior. (`#718`_) * Resolved a bug where getting debug locals for tracebacks could modify template context. * Fixed a bug where having many "{% elif ... %}" blocks resulted in a "too many levels of indentation" error. These blocks now compile to native "elif ..:" instead of "else: if ..:" (`#759`_) - update to version 2.10.1 (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341): * "SandboxedEnvironment" securely handles "str.format_map" in order to prevent code execution through untrusted format strings. The sandbox already handled "str.format". - CVE-2020-28493: Fixed a ReDOS vulnerability where urlize could have been called with untrusted user data (bsc#1181944). Added CVE-2020-28493.patch - Fixed IndentationError in CVE-2020-28493.patch (bsc#1182244) - Add CVE-2024-34064.patch upstream patch (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4) Also fixes (CVE-2024-22195, bsc#1218722) - update to 2.7.1: - Fixed a bug with ``call_filter`` not working properly on environment and context filters. - Fixed lack of Python 3 support for bytecode caches. - Reverted support for defining blocks in included templates as this broke existing templates for users. - Fixed some warnings with hashing of undefineds and nodes if Python is run with warnings for Python 3. - Added support for properly hashing undefined objects. - Fixed a bug with the title filter not working on already uppercase strings. - Avoid "Recommends:" on old rpm distros - Require python-setuptools instead of distribute (upstreams merged) - update to 2.7.2: - Prefix loader was not forwarding the locals properly to inner loaders. This is now fixed. - Security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems. See `Debian bug 734747`_ for more information. - avoid rebuildcycle with vim - fix package build (file selection missing) - Update to 2.7.3 (bnc#858239, CVE-2014-0012) - Security issue: Corrected the security fix for the cache folder. This fix was provided by RedHat. - adjust dependency to use up to date package name for python-MarkupSafe - run testsuite during build - Use %python_version over %py_ver: better portability to RHEL - Update to 2.8 - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Tests are removed from the package (not distributed in the tar.gz) - Update to 2.9.5 (bsc#1132174, CVE-2016-10745) (see the changes in /usr/share/doc/packages/python-Jinja2/CHANGES) - updated source URL - fix requires - update for singlespec - update to 2.9.6 * fixed custom context behavior in fast resolve mode - specfile: * CHANGES -> CHANGES.rst * added README.rst to %doc section - update to version 2.10: * Added a new extension node called "OverlayScope" which can be used to create an unoptimized scope that will look up all variables from a derived context. * Added an "in" test that works like the in operator. This can be used in combination with "reject" and "select". * Added "previtem" and "nextitem" to loop contexts, providing access to the previous/next item in the loop. If such an item does not exist, the value is undefined. * Added "changed(*values)" to loop contexts, providing an easy way of checking whether a value has changed since the last iteration (or rather since the last call of the method) * Added a "namespace" function that creates a special object which allows attribute assignment using the "set" tag. This can be used to carry data across scopes, e.g. from a loop body to code that comes after the loop. * Added a "trimmed" modifier to "{% trans %}" to strip linebreaks and surrounding whitespace. Also added a new policy to enable this for all "trans" blocks. * The "random" filter is no longer incorrectly constant folded and will produce a new random choice each time the template is rendered. (`#478`_) * Added a "unique" filter. (`#469`_) * Added "min" and "max" filters. (`#475`_) * Added tests for all comparison operators: "eq", "ne", "lt", "le", "gt", "ge". (`#665`_) * "import" statement cannot end with a trailing comma. (`#617`_, `#618`_) * "indent" filter will not indent blank lines by default. (`#685`_) * Add "reverse" argument for "dictsort" filter. (`#692`_) * Add a "NativeEnvironment" that renders templates to native Python types instead of strings. (`#708`_) * Added filter support to the block "set" tag. (`#489`_) * "tojson" filter marks output as safe to match documented behavior. (`#718`_) * Resolved a bug where getting debug locals for tracebacks could modify template context. * Fixed a bug where having many "{% elif ... %}" blocks resulted in a "too many levels of indentation" error. These blocks now compile to native "elif ..:" instead of "else: if ..:" (`#759`_) - update to version 2.10.1 (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341): * "SandboxedEnvironment" securely handles "str.format_map" in order to prevent code execution through untrusted format strings. The sandbox already handled "str.format". - CVE-2020-28493: Fixed a ReDOS vulnerability where urlize could have been called with untrusted user data (bsc#1181944). Added CVE-2020-28493.patch - Fixed IndentationError in CVE-2020-28493.patch (bsc#1182244) - Add CVE-2024-34064.patch upstream patch (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4) Also fixes (CVE-2024-22195, bsc#1218722) - Add security patch CVE-2024-56326.patch (bsc#1234809) - Initial version - Build against libyaml to get the faster module - Initial python3 support - increase file-descriptor-count for ppc to make tests happy - increase file-descriptor-count for s390 to make tests happy - Update to 3.11 - Source and binary distributions are rebuilt against the latest versions of Cython and LibYAML. - Update to 3.12 - Adding an implicit resolver to a derived loader should not affect the base loader (fixes issue #57). - Uniform representation for OrderedDict? across different versions of Python (fixes issue #61). - Fixed comparison to None warning (closes issue #64). - fix Source URL - update for multipython build - Use pythonhosted.org for the reference link. - Provide python-yaml instead of python2-yaml again. - update to 3.13 * fix compactibility with python 3.7 - Use %license instead of %doc [bsc#1082318] - Update to 5.1: * many changes, see CHANGES * bsc#1099308 CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code - update to 5.1.1 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8 - update to 5.1.2 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+ - update to 5.2 * A more flexible fix for custom tag constructors * Change default loader for yaml.add_constructor * Change default loader for add_implicit_resolver, add_path_resolver * Move constructor for object/apply to UnsafeConstructor * Fix logic for quoting special characters - update to 5.3 * Use `is` instead of equality for comparing with `None` * fix typos and stylistic nit * Fix up small typo * Fix handling of __slots__ * Allow calling add_multi_constructor with None * Add use of safe_load() function in README * Fix reader for Unicode code points over 0xFFFF * Enable certain unicode tests when maxunicode not > 0xffff * Use full_load in yaml-highlight example * Document that PyYAML is implemented with Cython * Fix for Python 3.10 * increase size of index, line, and column fields * remove some unused imports * Create timezone-aware datetimes when parsed as such * Add tests for timezone - update to 5.3.1 * fixes boo#1165439 (cve-2020-1747) Prevents arbitrary code execution during python/object/new constructor - update to 5.4.1 (bsc#1174514, CVE-2020-14343): * Fix stub compat with older pyyaml versions that may unwittingly load it * Build modernization, remove distutils, fix metadata, build wheels, CI to GHA * Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader * Fix memory leak in implicit resolver setup * Fix py2 copy support for timezone objects * Fix compatibility with Jython - reenable the cython yaml loader (bsc#1225641) - Initial package (2.0.1) for openSUSE. - Regenerate spec file with py2pack; - Bzip2 source file. - the license seems to be LGPL-2.1+ - Standard in spec file; - Remove CFLAGS and %clean section from spec file. - Update to 1.1: - Sorry, no changelog. - Update to 2.1.1: - Sorry, no changelog. - Require python-setuptools instead of distribute (upstreams merged) - Update to version 2.3.0 * Added support for CP932 detection (thanks to @hashy) * Fixed an issue where UTF-8 with a BOM would not be detected as UTF-8-SIG (#8) * Modified chardetect to use argparse for argument parsing * Moved docs to a gh-pages branch. You can now access them at http://chardet.github.io - Changelog on https://github.com/chardet/chardet/commits/2.3.0 - Other minor changes - specfile: * added update alternative to prevent conflicts with python3 version * add tests - Include in SLE 12 (bsc#1002895, FATE#321630) - Converted to single spec. - do not use %py_ver, replace with %python_version - update to 3.0.4 - fix source link - add update-alternative support for py2/py3 coinstallability - Fix build for Leap-42.3 - add update-alternatives post-requires - Fix update-alternative in %postun, bsc#1218765 - Initial package 0.7.1 - Minimal cleanup - updated to 0.8 Changelog (http://pythonhosted.org/cssselect/#changelog): Released on 2013-03-15. Improvements: [#22] Let extended translators override what XPathExpr class is used [#19] Use the built-in lang() XPath function for implementing the :lang() pseudo-class with XML documents. This is probably faster than ancestor-or-self::. Bug fixes: [#14] Fix non-ASCII pseudo-classes. (Invalid selector instead of crash.) [#20] As per the spec, elements containing only whitespace are not considered empty for the :empty pseudo-class. - Packaged LICENSE file fixes bnc#828513 Bug 828513 - LICENSE not packaged in python3-cssselect 0.8 - Update to version 0.9.1 + **Backward incompatible change from 0.9**: :meth:`~GenericTranslator.selector_to_xpath` defaults to ignoring pseudo-elements, as it did in 0.8 and previous versions. (:meth:`~GenericTranslator.css_to_xpath` doesn’t change.) + Drop official support for Python 2.4 and 3.1, as testing was becoming difficult. Nothing will break overnight, but future releases may on may not work on these versions. Older releases will remain available on PyPI. - Changes from 0.9 + Add parser support for :attr:`functional pseudo-elements <Selector.pseudo_element>`. + This version accidentally introduced a backward incompatible change: :meth:`~GenericTranslator.selector_to_xpath` defaults to rejecting pseudo-elements instead of ignoring them. - Remove useless CFLAGS definition - Add README.rst, CHANGES and AUTHORS in package documentation - update to 1.0.1: * Add support for Python 3.6. * Documentation hosted `on Read the Docs <https://cssselect.readthedocs.io/>`_ * Add code coverage reports. * Fix ``:nth-*(an+b)`` pseudo-classes selectors. (except ``*:nth-child()`` which looks untranslatable to XPath 1.0.) * Distribute as universal wheel. * Add support for Python 3.3, 3.4 and 3.5. * Drop support for Python 2.5 as testing is getting difficult. * Improve tests on pseudo-elements. - Switch to singlespec approach - specfile: * update copyright year - update to version 1.0.3: * Fix artifact uploads to pypi - changes from version 1.0.2: * Drop support for Python 2.6 and Python 3.3. * Fix deprecation warning in Python 3.6. * Minor cleanups. - Initial package 0.7.1 - Minimal cleanup - updated to 0.8 Changelog (http://pythonhosted.org/cssselect/#changelog): Released on 2013-03-15. Improvements: [#22] Let extended translators override what XPathExpr class is used [#19] Use the built-in lang() XPath function for implementing the :lang() pseudo-class with XML documents. This is probably faster than ancestor-or-self::. Bug fixes: [#14] Fix non-ASCII pseudo-classes. (Invalid selector instead of crash.) [#20] As per the spec, elements containing only whitespace are not considered empty for the :empty pseudo-class. - Packaged LICENSE file fixes bnc#828513 Bug 828513 - LICENSE not packaged in python3-cssselect 0.8 - Update to version 0.9.1 + **Backward incompatible change from 0.9**: :meth:`~GenericTranslator.selector_to_xpath` defaults to ignoring pseudo-elements, as it did in 0.8 and previous versions. (:meth:`~GenericTranslator.css_to_xpath` doesn’t change.) + Drop official support for Python 2.4 and 3.1, as testing was becoming difficult. Nothing will break overnight, but future releases may on may not work on these versions. Older releases will remain available on PyPI. - Changes from 0.9 + Add parser support for :attr:`functional pseudo-elements <Selector.pseudo_element>`. + This version accidentally introduced a backward incompatible change: :meth:`~GenericTranslator.selector_to_xpath` defaults to rejecting pseudo-elements instead of ignoring them. - Remove useless CFLAGS definition - Add README.rst, CHANGES and AUTHORS in package documentation - update to 1.0.1: * Add support for Python 3.6. * Documentation hosted `on Read the Docs <https://cssselect.readthedocs.io/>`_ * Add code coverage reports. * Fix ``:nth-*(an+b)`` pseudo-classes selectors. (except ``*:nth-child()`` which looks untranslatable to XPath 1.0.) * Distribute as universal wheel. * Add support for Python 3.3, 3.4 and 3.5. * Drop support for Python 2.5 as testing is getting difficult. * Improve tests on pseudo-elements. - Switch to singlespec approach - specfile: * update copyright year - update to version 1.0.3: * Fix artifact uploads to pypi - changes from version 1.0.2: * Drop support for Python 2.6 and Python 3.3. * Fix deprecation warning in Python 3.6. * Minor cleanups. - Update to 1.9.0: New since 1.8.0: - dnspython now uses poll() instead of select() when available. - Basic DNSSEC validation can be done using dns.dnsec.validate() and dns.dnssec.validate_rrsig() if you have PyCrypto 2.3 or later installed. Complete secure resolution is not yet available. - Added key_id() to the DNSSEC module, which computes the DNSSEC key id of a DNSKEY rdata. - Added make_ds() to the DNSSEC module, which returns the DS RR for a given DNSKEY rdata. - dnspython now raises an exception if HMAC-SHA284 or HMAC-SHA512 are used with a Python older than 2.5.2. (Older Pythons do not compute the correct value.) - Symbolic constants are now available for TSIG algorithm names. Bugs fixed since 1.8.0: - dns.resolver.zone_for_name() didn't handle a query response with a CNAME or DNAME correctly in some cases. - When specifying rdata types and classes as text, Unicode strings may now be used. - Hashlib compatibility issues have been fixed. - dns.message now imports dns.edns. - The TSIG algorithm value was passed incorrectly to use_tsig() in some cases. - Update to 1.9.1: Bugs fixed since 1.9.0: - The dns.dnssec module didn't work with DSA due to namespace contamination from a "from"-style import. - Update to 1.9.2: - The fix for the import problems was actually bad, but didn't show up in testing because the test suite's conditional importing code hid the problem. - Update to 1.9.3: Bugs fixed since 1.9.2: - Dnspython was erroneously doing case-insensitive comparisons of the names in NSEC and RRSIG RRs. - We now use "is" and not "==" when testing what section an RR is in. - The resolver now disallows metaqueries. New since 1.9.2: - A boolean parameter, 'raise_on_no_answer', has been added to the query() methods. In no-error, no-data situations, this parameter determines whether NoAnswer should be raised or not. If True, NoAnswer is raised. If False, then an Answer() object with a None rrset will be returned. - Resolver Answer() objects now have a canonical_name field. - Rdata now have a __hash__ method. - Regenerated spec file with py2pack; - Removed LICENSE PKG-INFO and TODO files from documentation. - Fix SLE_10 build. - Update to 1.9.4: - There is no new functionality in this release; just a few bug fixes in RRSIG and SIG code. - Legacy code will be eliminated for earlier versions of DNSSEC in a future release of dnspython. - Update to new upstream release 1.10.0 * Added dns.resolver.LRUCache. * dns.resolver.query() will try TCP if a UDP response is truncated. * The python socket module's DNS methods can be now be overriden with implementations that use dnspython's resolver. - Remove redundant tags/sections from specfile - Correct license field - license update: ISC See LICENSE (and compare http://www.spdx.org/licenses/MIT with http://www.spdx.org/licenses/ISC) - update to 1.11.0: * TLSA RR support * Added set_flags() method to dns.resolver.Resolver * Names with offsets >= 2^14 are no longer added to the compression table. * The "::" syntax is not used to shorten a single 16-bit section of the text form an IPv6 address. * Empty rdatasets are not printed. * DNSKEY key tags are no longer assumed to be unique. - Package LICENSE, use proper upstream URL - Run testsuite - Cleanup macro usage - update to 1.11.1: * fix syntax error exception on dns server failure * various fixlets for DNSSEC support - update to 1.12.0: * The test system can now run the tests without requiring dnspython to be installed. * When reading from a masterfile, if the first content line started with leading whitespace, we raised an ugly exception instead of doing the right thing, namely using the zone origin as the name. [#73] Thanks to Tassatux for reporting the issue. * Added dns.zone.to_text() convenience method. Thanks to Brandon Whaley <redkrieg@gmail.com> for the patch. * The /etc/resolv.conf setting "options rotate" is now understood by the resolver. If present, the resolver will shuffle the nameserver list each time dns.resolver.query() is called. Thanks to underrun for the patch. Note that you don't want to add "options rotate" to your /etc/resolv.conf if your system's resolver library does not understand it. In this case, just set resolver.rotate = True by hand. * Escaping of Unicode has been corrected. Previously we escaped and then converted to Unicode, but the right thing to do is convert to Unicode, then escape. Also, characters > 0x7f should NOT be escaped in Unicode mode. Thanks to Martin Basti for the patch. * dns.rdtypes.ANY.DNSKEY now has helpers functions to convert between the numeric form of the flags and a set of human-friendly strings. Thanks to Petr Spacek for the patch. * RRSIGs did not respect relativization settings in to_text(). Thanks to Brian Smith for reporting the bug and submitting a (slightly different) patch. * dns/rdtypes/IN/APL.py: The APL from_wire() method did not accept an rdata length of 0 as valid. Thanks to salzmdan for reporting the problem. * dns/ipv6.py: Add is_mapped() * dns/reversename.py: Lookup IPv6 mapped IPv4 addresses in the v4 reverse namespace. Thanks to Devin Bayer. Yes, I finally fixed this one :) * dns/zone.py: Do not put back an unescaped token. This was causing escape processing for domain names to break. Thanks to connormclaud for reporting the problem. * dns/message.py: Making a response didn't work correctly if the query was signed with TSIG and we knew the key. Thanks to Jeffrey Stiles for reporting the problem. * dns/query.py: Fix problems with the IXFR state machine which caused long diffs to fail. Thanks to James Raftery for the fix and the repeated prodding to get it applied :) - enable some tests - add python-dnspython-rpmlintrc file - add python-ecdsa and python-pycrypto to BuildRequires for the DNSSec tests - use /usr/bin/python instead of /usr/bin/env python for the example scripts to avoid additional dependencies - fix build on SLE11 - New upstream release 1.13.0 - New upstream release 1.14.0 - New upstream release 1.15.0 * IDNA 2008 support is now available if the "idna" module has been installed and IDNA 2008 is requested. The default IDNA behavior is still IDNA 2003. The new IDNA codec mechanism is currently only useful for direct calls to dns.name.from_text() or dns.name.from_unicode(), but in future releases it will be deployed throughout dnspython, e.g. so that you can read a masterfile with an IDNA 2008 codec in force. * By default, dns.name.to_unicode() is not strict about which version of IDNA the input complies with. Strictness can be requested by using one of the strict IDNA codecs. * Add AVC RR support. * Some problems with newlines in various output modes have been addressed. * dns.name.to_text() now returns text and not bytes on Python 3.x * More miscellaneous fixes for the Python 2/3 codeline merge. - Include readme with readme.patch as not included in upstream tarball - Fix a bug in the tests code with 210.patch with upstream pull request #210 - use and recommend python-ecdsa and python-pycrypto for dnssec support - Update for the multipython build. - Rename python-dnspython.asc to python-dnspython.keyring. - Spec cleanup. - Add new patches to solve DoS: - CVE-2023-29483-pre1.patch - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) - Fix CVE-2023-29483-pre1.patch (bsc#1230353, gh#rthalley/dnspython@6d590f0a2e1b, gh#nrhall/dnspython@55d6a9d81930) - Update to 1.8.0; - Building as noarch for openSUSE >= 11.2. - Update to 1.9.0: New since 1.8.0: - dnspython now uses poll() instead of select() when available. - Basic DNSSEC validation can be done using dns.dnsec.validate() and dns.dnssec.validate_rrsig() if you have PyCrypto 2.3 or later installed. Complete secure resolution is not yet available. - Added key_id() to the DNSSEC module, which computes the DNSSEC key id of a DNSKEY rdata. - Added make_ds() to the DNSSEC module, which returns the DS RR for a given DNSKEY rdata. - dnspython now raises an exception if HMAC-SHA284 or HMAC-SHA512 are used with a Python older than 2.5.2. (Older Pythons do not compute the correct value.) - Symbolic constants are now available for TSIG algorithm names. Bugs fixed since 1.8.0: - dns.resolver.zone_for_name() didn't handle a query response with a CNAME or DNAME correctly in some cases. - When specifying rdata types and classes as text, Unicode strings may now be used. - Hashlib compatibility issues have been fixed. - dns.message now imports dns.edns. - The TSIG algorithm value was passed incorrectly to use_tsig() in some cases. - Update to 1.9.1: Bugs fixed since 1.9.0: - The dns.dnssec module didn't work with DSA due to namespace contamination from a "from"-style import. - Update to 1.9.2: - The fix for the import problems was actually bad, but didn't show up in testing because the test suite's conditional importing code hid the problem. - Update to 1.9.3: Bugs fixed since 1.9.2: - Dnspython was erroneously doing case-insensitive comparisons of the names in NSEC and RRSIG RRs. - We now use "is" and not "==" when testing what section an RR is in. - The resolver now disallows metaqueries. New since 1.9.2: - A boolean parameter, 'raise_on_no_answer', has been added to the query() methods. In no-error, no-data situations, this parameter determines whether NoAnswer should be raised or not. If True, NoAnswer is raised. If False, then an Answer() object with a None rrset will be returned. - Resolver Answer() objects now have a canonical_name field. - Rdata now have a __hash__ method. - Regenerated spec file with py2pack; - Removed LICENSE PKG-INFO and TODO files from documentation. - Fix SLE_10 build. - Update to 1.9.4: - There is no new functionality in this release; just a few bug fixes in RRSIG and SIG code. - Legacy code will be eliminated for earlier versions of DNSSEC in a future release of dnspython. - Update to new upstream release 1.10.0 * Added dns.resolver.LRUCache. * dns.resolver.query() will try TCP if a UDP response is truncated. * The python socket module's DNS methods can be now be overriden with implementations that use dnspython's resolver. - Remove redundant tags/sections from specfile - Correct license field - license update: ISC See LICENSE (and compare http://www.spdx.org/licenses/MIT with http://www.spdx.org/licenses/ISC) - update to 1.11.0: * TLSA RR support * Added set_flags() method to dns.resolver.Resolver * Names with offsets >= 2^14 are no longer added to the compression table. * The "::" syntax is not used to shorten a single 16-bit section of the text form an IPv6 address. * Empty rdatasets are not printed. * DNSKEY key tags are no longer assumed to be unique. - Package LICENSE, use proper upstream URL - Run testsuite - Cleanup macro usage - update to 1.11.1: * fix syntax error exception on dns server failure * various fixlets for DNSSEC support - update to 1.12.0: * The test system can now run the tests without requiring dnspython to be installed. * When reading from a masterfile, if the first content line started with leading whitespace, we raised an ugly exception instead of doing the right thing, namely using the zone origin as the name. [#73] Thanks to Tassatux for reporting the issue. * Added dns.zone.to_text() convenience method. Thanks to Brandon Whaley <redkrieg@gmail.com> for the patch. * The /etc/resolv.conf setting "options rotate" is now understood by the resolver. If present, the resolver will shuffle the nameserver list each time dns.resolver.query() is called. Thanks to underrun for the patch. Note that you don't want to add "options rotate" to your /etc/resolv.conf if your system's resolver library does not understand it. In this case, just set resolver.rotate = True by hand. * Escaping of Unicode has been corrected. Previously we escaped and then converted to Unicode, but the right thing to do is convert to Unicode, then escape. Also, characters > 0x7f should NOT be escaped in Unicode mode. Thanks to Martin Basti for the patch. * dns.rdtypes.ANY.DNSKEY now has helpers functions to convert between the numeric form of the flags and a set of human-friendly strings. Thanks to Petr Spacek for the patch. * RRSIGs did not respect relativization settings in to_text(). Thanks to Brian Smith for reporting the bug and submitting a (slightly different) patch. * dns/rdtypes/IN/APL.py: The APL from_wire() method did not accept an rdata length of 0 as valid. Thanks to salzmdan for reporting the problem. * dns/ipv6.py: Add is_mapped() * dns/reversename.py: Lookup IPv6 mapped IPv4 addresses in the v4 reverse namespace. Thanks to Devin Bayer. Yes, I finally fixed this one :) * dns/zone.py: Do not put back an unescaped token. This was causing escape processing for domain names to break. Thanks to connormclaud for reporting the problem. * dns/message.py: Making a response didn't work correctly if the query was signed with TSIG and we knew the key. Thanks to Jeffrey Stiles for reporting the problem. * dns/query.py: Fix problems with the IXFR state machine which caused long diffs to fail. Thanks to James Raftery for the fix and the repeated prodding to get it applied :) - enable some tests - add python-dnspython-rpmlintrc file - add python-ecdsa and python-pycrypto to BuildRequires for the DNSSec tests - use /usr/bin/python instead of /usr/bin/env python for the example scripts to avoid additional dependencies - fix build on SLE11 - New upstream release 1.13.0 - New upstream release 1.14.0 - New upstream release 1.15.0 * IDNA 2008 support is now available if the "idna" module has been installed and IDNA 2008 is requested. The default IDNA behavior is still IDNA 2003. The new IDNA codec mechanism is currently only useful for direct calls to dns.name.from_text() or dns.name.from_unicode(), but in future releases it will be deployed throughout dnspython, e.g. so that you can read a masterfile with an IDNA 2008 codec in force. * By default, dns.name.to_unicode() is not strict about which version of IDNA the input complies with. Strictness can be requested by using one of the strict IDNA codecs. * Add AVC RR support. * Some problems with newlines in various output modes have been addressed. * dns.name.to_text() now returns text and not bytes on Python 3.x * More miscellaneous fixes for the Python 2/3 codeline merge. - Include readme with readme.patch as not included in upstream tarball - Fix a bug in the tests code with 210.patch with upstream pull request #210 - use and recommend python-ecdsa and python-pycrypto for dnssec support - Update for the multipython build. - Rename python-dnspython.asc to python-dnspython.keyring. - Spec cleanup. - Add new patches to solve DoS: - CVE-2023-29483-pre1.patch - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) - Update to 1.8.0; - Building as noarch for openSUSE >= 11.2. - Update to 1.9.0: New since 1.8.0: - dnspython now uses poll() instead of select() when available. - Basic DNSSEC validation can be done using dns.dnsec.validate() and dns.dnssec.validate_rrsig() if you have PyCrypto 2.3 or later installed. Complete secure resolution is not yet available. - Added key_id() to the DNSSEC module, which computes the DNSSEC key id of a DNSKEY rdata. - Added make_ds() to the DNSSEC module, which returns the DS RR for a given DNSKEY rdata. - dnspython now raises an exception if HMAC-SHA284 or HMAC-SHA512 are used with a Python older than 2.5.2. (Older Pythons do not compute the correct value.) - Symbolic constants are now available for TSIG algorithm names. Bugs fixed since 1.8.0: - dns.resolver.zone_for_name() didn't handle a query response with a CNAME or DNAME correctly in some cases. - When specifying rdata types and classes as text, Unicode strings may now be used. - Hashlib compatibility issues have been fixed. - dns.message now imports dns.edns. - The TSIG algorithm value was passed incorrectly to use_tsig() in some cases. - Update to 1.9.1: Bugs fixed since 1.9.0: - The dns.dnssec module didn't work with DSA due to namespace contamination from a "from"-style import. - Update to 1.9.2: - The fix for the import problems was actually bad, but didn't show up in testing because the test suite's conditional importing code hid the problem. - Update to 1.9.3: Bugs fixed since 1.9.2: - Dnspython was erroneously doing case-insensitive comparisons of the names in NSEC and RRSIG RRs. - We now use "is" and not "==" when testing what section an RR is in. - The resolver now disallows metaqueries. New since 1.9.2: - A boolean parameter, 'raise_on_no_answer', has been added to the query() methods. In no-error, no-data situations, this parameter determines whether NoAnswer should be raised or not. If True, NoAnswer is raised. If False, then an Answer() object with a None rrset will be returned. - Resolver Answer() objects now have a canonical_name field. - Rdata now have a __hash__ method. - Regenerated spec file with py2pack; - Removed LICENSE PKG-INFO and TODO files from documentation. - Fix SLE_10 build. - Update to 1.9.4: - There is no new functionality in this release; just a few bug fixes in RRSIG and SIG code. - Legacy code will be eliminated for earlier versions of DNSSEC in a future release of dnspython. - Update to new upstream release 1.10.0 * Added dns.resolver.LRUCache. * dns.resolver.query() will try TCP if a UDP response is truncated. * The python socket module's DNS methods can be now be overriden with implementations that use dnspython's resolver. - Remove redundant tags/sections from specfile - Correct license field - license update: ISC See LICENSE (and compare http://www.spdx.org/licenses/MIT with http://www.spdx.org/licenses/ISC) - update to 1.11.0: * TLSA RR support * Added set_flags() method to dns.resolver.Resolver * Names with offsets >= 2^14 are no longer added to the compression table. * The "::" syntax is not used to shorten a single 16-bit section of the text form an IPv6 address. * Empty rdatasets are not printed. * DNSKEY key tags are no longer assumed to be unique. - Package LICENSE, use proper upstream URL - Run testsuite - Cleanup macro usage - update to 1.11.1: * fix syntax error exception on dns server failure * various fixlets for DNSSEC support - update to 1.12.0: * The test system can now run the tests without requiring dnspython to be installed. * When reading from a masterfile, if the first content line started with leading whitespace, we raised an ugly exception instead of doing the right thing, namely using the zone origin as the name. [#73] Thanks to Tassatux for reporting the issue. * Added dns.zone.to_text() convenience method. Thanks to Brandon Whaley <redkrieg@gmail.com> for the patch. * The /etc/resolv.conf setting "options rotate" is now understood by the resolver. If present, the resolver will shuffle the nameserver list each time dns.resolver.query() is called. Thanks to underrun for the patch. Note that you don't want to add "options rotate" to your /etc/resolv.conf if your system's resolver library does not understand it. In this case, just set resolver.rotate = True by hand. * Escaping of Unicode has been corrected. Previously we escaped and then converted to Unicode, but the right thing to do is convert to Unicode, then escape. Also, characters > 0x7f should NOT be escaped in Unicode mode. Thanks to Martin Basti for the patch. * dns.rdtypes.ANY.DNSKEY now has helpers functions to convert between the numeric form of the flags and a set of human-friendly strings. Thanks to Petr Spacek for the patch. * RRSIGs did not respect relativization settings in to_text(). Thanks to Brian Smith for reporting the bug and submitting a (slightly different) patch. * dns/rdtypes/IN/APL.py: The APL from_wire() method did not accept an rdata length of 0 as valid. Thanks to salzmdan for reporting the problem. * dns/ipv6.py: Add is_mapped() * dns/reversename.py: Lookup IPv6 mapped IPv4 addresses in the v4 reverse namespace. Thanks to Devin Bayer. Yes, I finally fixed this one :) * dns/zone.py: Do not put back an unescaped token. This was causing escape processing for domain names to break. Thanks to connormclaud for reporting the problem. * dns/message.py: Making a response didn't work correctly if the query was signed with TSIG and we knew the key. Thanks to Jeffrey Stiles for reporting the problem. * dns/query.py: Fix problems with the IXFR state machine which caused long diffs to fail. Thanks to James Raftery for the fix and the repeated prodding to get it applied :) - enable some tests - add python-dnspython-rpmlintrc file - add python-ecdsa and python-pycrypto to BuildRequires for the DNSSec tests - use /usr/bin/python instead of /usr/bin/env python for the example scripts to avoid additional dependencies - fix build on SLE11 - New upstream release 1.13.0 - New upstream release 1.14.0 - New upstream release 1.15.0 * IDNA 2008 support is now available if the "idna" module has been installed and IDNA 2008 is requested. The default IDNA behavior is still IDNA 2003. The new IDNA codec mechanism is currently only useful for direct calls to dns.name.from_text() or dns.name.from_unicode(), but in future releases it will be deployed throughout dnspython, e.g. so that you can read a masterfile with an IDNA 2008 codec in force. * By default, dns.name.to_unicode() is not strict about which version of IDNA the input complies with. Strictness can be requested by using one of the strict IDNA codecs. * Add AVC RR support. * Some problems with newlines in various output modes have been addressed. * dns.name.to_text() now returns text and not bytes on Python 3.x * More miscellaneous fixes for the Python 2/3 codeline merge. - Include readme with readme.patch as not included in upstream tarball - Fix a bug in the tests code with 210.patch with upstream pull request #210 - use and recommend python-ecdsa and python-pycrypto for dnssec support - Update for the multipython build. - Rename python-dnspython.asc to python-dnspython.keyring. - Spec cleanup. - Add new patches to solve DoS: - CVE-2023-29483-pre1.patch - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) - Fix building python 3 package on openSUSE 11.4 x86_64 - license update: Python-2.0 and BSD-2-Clause and GPL-2.0+ and GPL-3.0+ and SUSE-Public-Domain tools/editors/emacs/rst.el is GPL-3.0+ - see also COPYING file - Update to version 0.9: * reStructuredText "code" role and directive with syntax highlighting by Pygments_. * "code" option of the "include" directive. * Fix [ 3402314 ] allow non-ASCII whitespace, punctuation characters and "international" quotes around inline markup. * Fix handling of missing stylesheets. * Fix [ 2971827 ] and [ 3442827 ] extras/roman.py moved to docutils/utils/roman.py * docutils.utils is now a package (providing a place for sub-modules) * change default for `math-output` setting to MathJax * Support the `abbreviation` and `acronym` standard roles. * Record only files required to generate the LaTeX source as dependencies. * Use ``\setcounter{secnumdepth}{0}`` instead of ``*``-versions when suppressing LaTeX section numbering. - Cleaned up spec files - Fix rpmlint warnings - patch from upstream for python3.3 support * Fix [3541369] Relative __import__ also with Python 3.3 - Run testsuite - Correctly fix non-excutable script warning - Remove outdated macros - Also remove "*.py" ending in egg-info files - update to 0.10: - add rpmlint-non-executable-scripts.diff * SmartQuotes transform for typographic quotes and dashes. * FileInput/FileOutput: no system-exit on IOError. The handle_io_errors option is ignored. * <code> tag for inline "code", do not drop nested inline nodes (syntax highlight tokens). * Customizable MathJax URL (based on patch by Dmitry Shachnev). * No line break after opening inline math tag. - Use update-alternatives to allow switching between py2 and py3 version of doctool binaries. - Drop r7486-python33-compat.patch as it is not needed. - Fix the symlink creation. - Update to 0.11 * Fix for the overwritting of document attributes. * Support embedded aliases within hyperlink references. * try local import of docutils components (reader, writer, parser, language module) before global search. * Python 3.3 checks CVS syntax only if "strict" is True. * Now, it is easy to add a custom stylesheet to Docutils' default stylesheet with, e.g., - -stylesheet_path='html4css1.css, mystyle.css' * If there is a file html4css1.css in the working directory of the process at launch, it is used instead of the one provided by Docutils in the writer source directory. * New default for math-output: HTML math.css. * Avoid repeated class declarations in html4css1 writer * Drop the simple algorithm replacing straight double quotes with English typographic ones. Activate the SmartQuotes transform if you want this feature. * New setting stylesheet_dirs: Comma-separated list of directories where stylesheets are found. Used by stylesheet_path when expanding relative path arguments. * handle lines starting with a period. * Fix option separating comma was bold (thanks to Bill Morris). - Use pypi url and download - Replace rpmlint-non-executable-scripts.diff with sed in the spec file - Update to 0.12 * docs/ref/rst/directives.txt - Update "math" and "csv-table" descriptions. * docutils/parsers/rst/directives/images.py - Fix [258] figwidth="image" generates unitless width value. * docutils/parsers/rst/states.py - Improve error report when a non-ASCII character is specified as delimiter, quote or escape character under Python 2. Fixes [ 249 ] and [ 250 ]. * docutils/writers/html4css1/__init__.py - Don't add newline after inline math. Thanks to Yury G. Kudryashov for the patch. * docutils/writers/latex2e/__init__.py - Fix [ 239 ] Latex writer glues paragraphs with figure floats. - Apply [ 116 ] by Kirill Smelkov. Don't hardcode \large for subtitle. * docutils/writers/odf_odt/__init__.py - Apply patch by Jakub Wilk to fix bug [ 100 ]. * test/test_error_reporting.py - Fix [ 223 ] by removing redundant tests we do not have control over. * test/test_nodes.py - Apply [ 115 ] respect fixed 2to3 string literal conversion behavior. - fix bashisms in pre script - Fix update-alternatives implementation. - update to 0.13.1: * New HTML writer generating HTML 5. * languages: persian/farsi (fa) and latvian (la) mappings. * change default base url for :rfc: to http://tools.ietf.org/html/ latex2e: Fix admonition width, remove deprecated options, better tablewidth auto, ... - Converted to single-spec - Added python-docutils-rpmlintrc - Fix url - Executables are python-independent so only have the python3 version provide them. - Implement update-alternatives to avoid conflict with rst2html5 - Make only the python2 package provide the "docutils" package. - only emit rst2html5 alternatives for python 3 - switch the "docutils" provides to the python 3 package (all the comands live there) (this fixes bsc#1039394) - specfile: * add binary rst2html4 - update to version 0.14: * Enable validation of Docutils XML documents against the DTD: Use attribute type NMTOKEN instead of REFID for the `refid` attribute and NMTOKENS for `backrefs`: REFID refers to an ID type instance, however, the `ids` attribute cannot use the ID type because `XML only allows one ID per Element Type`__ and doesn't support a multiple-ID "IDS" attribute type. * Added documentation for escaped whitespace in URI contexts. * Clarify use of Unicode character categories. * Added functionality: escaped whitespace in URI contexts. * Consistent handling of all whitespace characters in inline markup recognition. Fixes [ 307 ] and [ 3402314 ] (now [ 173 ]). * Added support for escaped whitespace in URI contexts. * Rework patch [ 120 ] (revert change to "Table.get_column_widths()" that led to problems in an application with a custom table directive). * Fix [ 320 ] Russian docinfo fields not recognized. * Don't add a second ID to problematic references. * Fix SmartQuotes: warn only once if language is unsupported, keep "rawsource" when "educating" quotes. * Added "split_escaped_whitespace" function, support for escaped whitespace in URI contexts. * Fix [ 321 ] Import block might cause name error. * Update quote definitions for languages et, fi, fr, ro, sv, tr, uk. * New quote definitions for hr, hsb, hu, lv, sh, sl, sr. * Fix [ 313 ] Differentiate apostrophe from closing single quote (if possible). * Fix [ 317 ] Extra space inserted with French smartquotes. * Add command line interface for stand-alone use (requires 2.7). * Provide default title in metadata (required by HTML5). * Fix [ 312 ] HTML writer generates invalid HTML if the table has two tags. * Fix [ 319 ] The MathJax CDN shut down on April 30, 2017. For security reasons, we don't use a third party public installation as default but warn if math-output_ is set to MathJax without specifying a URL. * Apply [ 125 ] HTML writer: respect automatic table column sizing. * Handle class arguments for block-level elements by wrapping them in a "DUclass" environment. This replaces the special handling for "epigraph" and "topic" elements. * Apply [ 141 ] Handling inline in manpage writer. * Command setting "language" now sets the default language of the generated ODF document. * The use of image directive options :width: (%), :scale:, etc now set the width/height/size of images in the generated ODF documents. * The heading/title of admonitions now reflects the language specified by the "language" setting. * Fixed [ 306 ] only first of multiple "image" directives with the same URL shown in output. * Fixed [ 282 ] python3: AttributeError. * tools/rst2html4.py: New front-end. * tools/dev/generate_punctuation_chars.py: New skript to test and update utils.punctuation_chars. - Use update-alternatives for all binary scripts and provide /usr/bin/docutils to avoid conflict with python311-docutils bsc#1219501 - Initial package creation - update to version v2.5 * only store scripts that are specifically referenced in logic * Fix validation for U+30FB KATAKANA MIDDLE DOT code point (#47) * range-based integer containment code * Documentation Updates * Make test runners Python 2.6 compatible (issue #20) * remove DISALLOWED codepoints from datafile, since they're unread * Avoid using bare 'except' (#39) * Add Python 3.5 support * Mark Python Wheels as universal (supports Python 2 and 3) * Skip tests that won't work on Python 2.6 (fixes #20) * Update Travis configuration to test against Python 2.6 and 3.6 * Use relative imports (fixes #26) * Documentation tidy up * Revert to basing IDNAError on UnicodeError (issue #43) (#45) * rebuild idnadata * Update history with Java-related change * ignore vim swapfiles * Update Travis CI coverage to 3.6 and 3.7-dev * Reduce memory usage even further. (#41) * Update trove classifier for Python 3.6 * Properly report label length exceptions (issue #36) * Segment uts46data to avoid Jython limits (#28) - Switch to singlespec approach - point download url to PyPI - drop %oname - update to version 2.6: * Allows generation of IDNA and UTS 46 table data for different versions of Unicode, by deriving properties directly from Unicode data. * Ability to generate RFC 5892/IANA-style table data * Diagnostic output of IDNA-related Unicode properties and derived calculations for a given codepoint * Support for idna.__version__ to report version * Support for idna.idnadata.__version__ and idna.uts46data.__version__ to report Unicode version of underlying IDNA and UTS 46 data respectively. - Add CVE-2024-3651.patch, backported from upstream commit gh#kjd/idna#172/commits/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7 (bsc#1222842, CVE-2024-3651) - Initial build - Update to version 0.4.1 + No upstream changelog - Update to version 0.5.0 + No upstream changelog + Update in support for fix of bnc#905354 - Updated to version 0.6.1 + No Upstream Changelog - update to version 0.7.0: * Add support for JEP-12, raw string literals * Support .whl files - additional changes from version 0.6.2: * Implement JEP-10, slice projections * Fix bug with filter projection parsing * Add to_array function * Add merge function * Fix error messages for function argument type errors - point source URL to pypi - Update to version 0.7.1: * Rename ``bin/jp`` to ``bin/jp.py`` * Fix issue with precedence when parsing wildcard projections * Remove ordereddict and simplejson as py2.6 dependencies. These were never actually used in the jmespath code base, only in the unit tests. Unittests requirements are handled via requirements26.txt. - Manage the jp executable with update-alternatives now that python3-jmespath exists - spec file improvements - Fix build issues for SLE 11 + More test dependencies required - Update to version 0.9.0 * Add support for new lines with tokens in an expression * Add support for JEP 9 which introduces "and" expressions, "unary" expressions, "not" expressions, and "paren" expressions * Fix issue with hardcoded path in ``jp.py`` executable (issue 90, issue 88, issue 82) - Update to version 0.8.0 * Improve lexing performance (issue 84) * Fix parsing error for multiselect lists (issue 86) * Fix issue with escaping single quotes in literal strings (issue 85) * Add support for providing your own dict cls to support ordered dictionaries (issue 94) * Add map() function (issue 95) - Fix update-alternatives implementation. - Switch to single-spec build - Update to version 0.9.2 + Fix regression when using ordering comparators on strings (issue 124) - From 0.9.1 + Raise LexerError on invalid numbers (issue 98) + Add support for custom functions (#100) (issue 100) + Fix ZeroDivisionError for built-in function avg() on empty lists (#115) (issue 115) + Properly handle non numerical ordering operators (#117) (issue 117) - Only BuildRequire unittest2 for python2 - properly Requires(postun) for %postun section - Update to 0.9.3: + Fix issue where long types in py2 and Decimal types were not being evaluated as numbers (issue 125) + Handle numbers in scientific notation in to_number() function (issue 120) + Fix issue where custom functions would override the function table of the builtin function class (issue 133) - Bump version: 9.23.20 → 9.24.2 This version upgrade includes several fixes: * Fixed secure boot fallback setup Make sure MokManager gets copied. The name and location of the mok manager is distribution specific in the same way as the shim loader. Thus we need to apply a similar concept for looking it up. This Fixes bsc#1187515 * Allow creation of LUKS system with empty key To support cloud platforms better we should allow the creation of an initial(insecure) LUKS encrypted image with an empty passphrase/keyfile. This Fixes bsc#1187461 and bsc#1187460 * Delete obsolete ddb.adapterType patching When building a vmdk image with pvscsi as adapter type, kiwi implicitly changed the adapter_type from pvscsi to lsilogic because qemu only knows lsilogic. At the end kiwi patched the adapter type in the descriptor of the vmdk header back to pvscsi. That patching seems to be wrong according to information from users and VMware support. This commit deletes the descriptor patching and only leaves the pvscsi setting in the guest configuration(vmx). This Fixes bsc#1180539 and Fixes #1847 * Make dracut version check more robust The check_dracut_module_versions_compatible_to_kiwi() runtime check calls the package manager from the host and reads the package database from the image root. Doing this requires the package database in the image to be compatible with the package manager on the host. However this cannot be guarenteed and it is more robust to chroot into the image root and call the package manager from there. However, this change also comes with the cost that it's required to have a package manager available in the image root tree. Therefore along with the chroot based call, eventual exceptions from the call are now catched and leads to a debug message in the log file but will not lead the runtime check to fail. I consider the cases without a package database inside of the image to be less critical than the incompatibility issue between the host tooling and the package database in the image. This Fixes bsc#1185937 * Fixed setup of repository architecture Unfortunately the architecture reported by uname is not necessarily the same name as used in the repository metadata. Therefore it was not a good idea to set the architecture and manage the name via a mapping table. It also has turned out that repo arch names are distro specific which causes more complexity on an eventual mapping table. In the end this commit changes the way how the repository architecture is setup in a way that we only set the architecture if a name was explicitly specified such that the user keeps full control over it without any mapping magic included This Fixes bsc#1185287 * Do not apply default subcommand for derivate containers This commit does not apply the default subcommand for derivate containers. Fixes bsc#1184823 * Added openssl to the core requires openssl is used in kiwi to construct a password hash if the plaintext password feature for user settings is used. This Fixes bsc#1184128 - Bump version: 9.24.15 → 9.24.16 This version upgrade includes several fixes: * Fixed regression in compression detection The change from 282529de8f612dee32d54ee868c2365dcd829220 Introduced a bad regression. The assumption was made that the xz tool could be used to detect if a file is compressed or not. However, this requires the file to be locally present. In the scope of the method call is_compressed() and within a remote deployment e.g PXE this is not the case. Therefore the former way to "detect" the compression according to the .xz postfix of the source filename was restored. In addition the function name was changed to is_xz_compressed() because that's what the method can do and not more. This Fixes #2015 Fixes a regression in the scope of bsc#1192975 (#c16) * index.rst: Change title (bsc#1189294#c2) * 'KIWI NG 9: KIWI NG Documentation' -> 'Building Linux System Appliances with KIWI Next Generation (KIWI NG <VERSION>) * suggested in bsc#1189294#c2 for more clarity * change has been discussed with and approved by main author (Marcus S.) * Care for different snapper template locations snapper recently changed their config template location from etc/ to usr/. This commit handles the two locations and Fixes bsc#1192940 * Do not force dracut into a compression setting So far we called dracut with --xz which forces the initrd to be xz compressed. There are other compression formats used by the distributions and they might differe from xz. The selection for a compression tool is done by a dist configuration in dracut.conf.d which is provided by the distributions as they see fit. For us this means not forcing dracut into a specific compression setting allows to make use of the distro provided setting and also allows to change/override this setting by an overlay file. This Fixes bsc#1192975 - Ensure backward compatibility on deprecated methods This commit ensures backward compatibility for deprecated config bash script utilities. Fixes bsc#1195229 Signed-off-by: David Cassany <dcassany@suse.com> - Don't exit the script on deprecated function use (bsc#1196644) The "exit 0" there stops processing of the calling script with a success exit code, which leads to incomplete and broken images. - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Stick to pytest v6.x.y Signed-off-by: David Cassany <dcassany@suse.com> - Bump version: 9.24.16 → 9.24.17 This version includes fixes for: * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi) Variables assigned with "set" are not visible in submenus for some reason. Export $linux and $initrd, so that they also work in submenu entries. Fixes bsc#1192523 - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Bump version up to v9.24.36 This version includes fixes for: * Preserve LABEL setting (#2108) Preserve the LABEL= setting when the grub config file is re-generated. the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and not in any SUSE distribution. Set the grub setting such that LABEL is preserved on SUSE distros. (bsc#1197616) * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783) Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from built images. This causes problems for some containers, notably Ceph when deployed in a Rook/k8s environment, which needs to have certain directories present inside /run/. This commit adds the ability to return to the previous behaviour and *not* empty those temporary directories, if you specify <image><preferences><type [...] ensure_empty_tmpdirs="false">. Fixes: https://github.com/OSInside/kiwi/issues/2093 Signed-off-by: Tim Serong <tserong@suse.com> * Set /.snapshots subvolume to mode 0700 (bsc#1194992) Avoid that users other than root can enter or even change the content. This is what snapper does as well. - Remove mailmap so email is not updated for old changelog entries in IBS Signed-off-by: David Cassany <dcassany@suse.com> - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Bump version up to 9.24.43 This version includes: * Fixed error handling for setfiles policy lookup Errors from os.scandir were not catched. In addition the path to run scandir was not properly created * Prefer file based syscall in kexec when possible (bsc#1203896) Use file based syscall in kexec if available. This is needed to support boot on an secure boot enabled system and is in general more reliable to boot into the system on real hardware platforms * Correct setfiles relabeling This change was inspired by a change done on Fedora's livecd-tools from here: livecd-tools/livecd-tools#236. The patch corrects issues with the setfiles SELinux relabel command. The issues become apparent when the host and guest policies differ. Thus it becomes required to explicitly set the policy to decouple from eventual unwanted host settings. * Fix helper method to detect dracut outfile format The method _get_boot_image_output_file_format_from_dracut_code is used in kiwi to match parts of the dracut code for the used output file format. Beginning with dracut-056 the code part checked has changed syntactically such that the match did no longer work. This commit increases the scope of the match and replace pattern and Fixes #2149 * Fixed handling of signing_keys in cmdline options When passing signing_keys with the --add-repo|--set-repo commandline options the delimiter to separate the single key information is a colon(:). However, this is stupid when kiwi expects the signing key to be references as an URI format like file://... Therefore this patch changes the delimiter from colon(:) to semicolon(;) * Setup SELinux on every system prepare / build (#2148) Setup SELinux on every system prepare / build such that all image types benefit from it not only the disk (oem) type * Install all of QEMU to Ubuntu arm integration test * rename user to ubuntu for Ubuntu integration test * Move to sphinx>=5.0.0 * Fixed sphinx extlinks rendering In Sphinx v5 warning will be treated as errors. This results in the following warning to be an error: extlinks: Sphinx-6.0 will require a caption string to contain exactly one '%s' and all other '%' need to be escaped as '%%'. This commit applies the required quoting * Added example aarch64 integration test for Ubuntu Created a RaspberryPI image description for Ubuntu(jammy) as integration test for building aarch64 images and added it to the integration test matrix * Added --target-arch for image info Allow cross arch dependency solving * Add support for group id in users setting Allow to specify the group id in the groups list a user should belong to. The group id can be placed as part of the group name separated by a colon like in the following example: <users> <user groups="kiwi,admin:42,users" password="..." name="kiwi"/> </users> Please note kiwi checks if the provided group already exists and only creates a group if it is not already present in the system. As default groups are usually provided by the OS itself including its preferred group id, you will intentionally not be able to overwrite group id for existing groups. This Fixes #2064 - Fixed kexec options setup in kiwi-dump-reboot The dracut module 99kiwi-dump-reboot creates an options list for kexec. Under certain conditions the options list can contain multiple spaces which leads to an error when calling kexec. This commit makes sure to trim white spaces. This Fixes #2178 Backported from upstream c694e25b22 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Add parted dependency for s390 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6) - Expand DASD partition table with parted Fixes bsc#1209247 Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9) - Use parted only in s390 arch This commit ensures parted is only called in dracut-kiwi-lib for s390 arch. It also fixes the spec to only require parted for s390 builds. In addition parted requirement has been removed from dracut-kiwi-live package since parted is not used in any other dracut module beyond kiwi-lib. Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488) - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Adding a comment to explain the s390 specific path Signed-off-by: David Cassany <dcassany@suse.com> (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90) - Add alternative re-reading of the partition table To inform the kernel about disk geometry changes, kiwi uses partprobe as a primary tool. However it is provided by parted and not necessarily available due to the package requirements on the dracut module. A second attempt via blockdev which is expected to exist is therefore made by this commit Part of bsc#1216465 (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7) - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Add SECURE_BOOT no when the firmware is efi This Fixes bsc#1211102 - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Cleanup condition for SECURE_BOOT=yes|no The statement serves the purpose for an if/else construction to become a better read. In addition delete the probably left-over print statement from the test - Update CI workflows Update tox and workflow files to run with a newer tox version as it's been used upstream - Temporary disable mypy checking The current code base is not mypy clean when called on newer versions of mypy. This will be fixed with the next full upstream port - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Fixed unit tests - Fixed linter errors Fixed white space issues now reported by flake8 - Create live persistent storage without busy state With the former logic the live ISO was already mounted when an eventual persistent storage partition was created. This leads to an issue on re-reading the partition table, not for all but several tools. This commit changes the order of tasks such that the setup of the persistent write storage is performed prior mounting the live ISO. In addition to this change an alternative method using blockdev to re-read the partition was added in case partprobe is not present. This also allows to get rid of the parted dependency which provides partprobe Part of bsc#1216465 (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657) - Change partprobe fallback to partx Informing the kernel about a new partition geometry can be done in a busy state and is also effective for new devices and new mounts based on the new geometry. busy state mounts of course will not see it until swap of the busy state but a complete refuse of operation like it happens with blockdev is imho not required. Just as partprobe, partx is less restrictive on the busy state. That's why this commit changes the partprobe fallback to use partx instead of blockdev Part of bsc#1216465 (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901) - Add partx to module-setup of kiwi-lib too Part of bsc#1216465 (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367) - Allow install disk overwrite from cmdline Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device that should be used in an OEM installation. This overwrites any other oem device setting, e.g device filter or maxdisk and just continues the installation on the given device. However, the device must exist and must be a block special. This Fixes jira#PED-7180 - Fix overwrite of kiwi_oemunattended In case rd.kiwi.oem.installdevice is set, there is an overwrite of the kiwi_oemunattended setting. However the variable was set in local scope of a function and therefore the change was not effective in other methods which also evaluates this variable. This commit fixes it such that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module. This is related to jira#PED-7180 - Fixed regression in GRUB_SERIAL_COMMAND setup The condition to write the serial line setup was broken. This commit fixes it. Related to Issue #2419 and Fixes bsc#1228808 - Fixed grub terminal setup The grub terminal setup is divided into the setting for the output and the input console. For both settings different parameters exists. So far kiwi did not differentiate between the two parts of the console setup and that could lead to a wrong setting if only one value is provided in kiwi's console= attribute which lead to the grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm grub takes this for both input and output and it's obviously wrong for the input. To make this less error prune the kiwi code changes with this commit to set GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity checks on the provided values if they are applicable. The information for setting up the console in the schema stays untouched though. That's because it's used for all bootloaders and also because grub supports multiple values for the console in/out setting in one GRUB_TERMINAL variable even though kiwi does no longer use it. To make this clear for the users also the documentation for the console attribute setup has been updated. If we want to wish two distinct attributes for input and output console settings a schema change and also differentiation between bootloaders is needed and that I only see for the kiwi-10 branch if at all. This Fixes #2419 and Fixes bsc#1218095 - Fixup cleanup of zipl templates Make sure temporary modifications to the zipl template and config file are not effective in the later system. This Fixes bsc#1221469 - Live ISO Wait for udev events after repart Make sure to wait for the event queue to become empty after the creation of the write partition. When kiwi calls the code to create the write partition this emits new udev events. It's important to wait for the event queue to become empty to avoid a potential regression on the use of the device nodes. In the processing of the events it can happen that a device gets removed and re-added. If we don't want for udev to process the entire queue it can happen that the wrong block device is used. This wrong selection is only possible because the way how hybrid ISOs are designed exposes both, the disk and the partition for the root device with the same label. This Fixes bsc#1213595 - Set default output console to gfxterm for grub If no console setting is done in the image description for grub the default output console is set to: gfxterm and the default input console is set to: console. This Fixes bsc#1219074 - Add rd.kiwi.oem.force_resize boot option Forces the disk resize process on an OEM disk image. If set, no sanity check for unpartitioned/free space is performed and also an eventually configured <oem-resize-once> configuration from the image description will not be taken into account. This Fixes bsc#1224389 - Do not exclude the .profile env file by default kiwi's initrd modules read a .profile file which gets included into the initrd produced at build time. To allow rebuild of a host-only initrd from the booted system this information should be present such that it is possible to re-use kiwi initrd code. This is related to bsc#1228118 - Fix kiwi-repart restrictions The kiwi repart dracut module reads a profile file and if it does not exists it dies in the initrd. However, that profile file is not mandatory for the main resize functionality. Thus this commit turns this into a warning message. In addition the module-setup for 90kiwi-repart makes sure to include the required and optional profile files. This Fixes bsc#1228118 - Update virtualenv setup types-pkg_resources got dropped from PyPI - Fixed resize of dos table type on s390 On s390, parted is used to detect the partition table type. In contrast to blkid the name for DOS tables is reported as 'msdos' and not 'dos' which impacts several conditions in the kiwi initrd code which checks for 'dos'. This commit fixes the get_partition_table_type() method to return a consistent table name for DOS tables. This Fixes bsc#1228729 - Set grub-bls default to false for SUSE on SLES15 For the time being, SLES15 distributions cannot handle KIWI's default to use BLS with GRUB2. Until they catch up, revert this for them only. bsc#1233196 - Update doc config to match with latest theme - Fix boot support for ISO media on ppc64 add CHRP boot support for ppc64 and add xorriso option to avoid file name reduction to MS-DOS compatible 8.3 format Co-authored-by: Steffen Winterfeldt <wfeldt@opensuse.org> Co-authored-by: Michal Suchanek <msuchanek@suse.de> - Initial import into the build service - Rename ply.spec to python-ply.spec as that is what the resultant package is called. - Don't build as noarch. - Import into autobuild - Add a -doc subpackage - Add python-ply-shebangs.patch - Update to version 2.5: + Various bug fixes + Some performance improvements + For a blow-by-blow account of changes, see the file CHANGES in the package python-ply-doc. - Use new python macros - Update to 3.3: + PLY-3.3 is a minor bug fix release, it supports both Python 2 and Python 3. - License changed to BSD - Update to 3.4: + Minor patch to make cpp.py compatible with Python 3. + Fixed setup.py trove classifiers to properly list PLY as Python 3 compatible. - License changed to BSD3c - Packaged more doc files - Moved important docs (README, ..) to base package - Fixed build for non-SUSE distros - patch license to follow spdx.org standard - python3 package added - spec file cleanups - Fix building on SLES - update to version 3.6: * If PLY is unable to create the 'parser.out' or 'parsetab.py' files due to permission issues, it now just issues a warning message and continues to operate * Fixed some issues related to use of packages and table file modules - additional changes from version 3.5: * Added support for defaulted_states in the parser * Fixed debug logging in the parser * Added actions to be defined to character literals (Issue #32) * Import of the 'parsetab.py' file is now constrained to only consider the directory specified by the outputdir argument to yacc() * Changed default output directory to be the same as that in which the yacc grammar is defined * Changed the parsetab.py file signature slightly so that the parsetab won't regenerate if created on a different major version of Python * Fixed Issue #44 call_errorfunc() should return the result of errorfunc() * Support for versions of Python <2.7 is officially dropped * Fixed bug related to calling yacc(start=...) * Added skipped tests for PyPy and Java * Added filter to make unit tests pass under 'python -3' * Fixed CPP_INTEGER regex in ply/cpp.py (Issue 21) * Fixed yacc validation bugs when from __future__ import unicode_literals is being used * Added support for Travis-CI * Added a .gitignore file * Fixed validation problems for source files that include a different source code encoding specifier * Fixed unit tests for yacc to eliminate random failures due to dict hash value randomization in Python 3.3 * Fixed comment whitespace processing bugs in ply/cpp.py * Fixed token names in ply/ctokens.py to match rule names * Changes to functions available in panic mode error recover * Fixed some problems with line and position tracking and the use of error symbols * Change to doc string handling in lex module * Fixed issue #1: Fixed _tabversion. It should use __tabversion__ instead of __version__ * Fixed issue #8: Literals empty list causes IndexError * Fixed issue #12: Typo in code snippet in documentation * Fixed issue #10: Correctly escape t_XOREQUAL pattern. - clean the test and example directories - remove stray backup files in doc - remove unneeded executable bit of testlex.py - remove CFLAGS export: unneeded - do not drop executable bit of everything in test since it contains subdirectories - remove useless clean section - remove README from package: not provided anymore - update to version 3.8: * Fixed issues related to Python 3.5. Patch contributed by Barry Warsaw. - update to version 3.7 * Fixed problems when reading table files from pickled data. * Fixed regression in handling of table modules if specified as module objects. See https://github.com/dabeaz/ply/issues/63 - clean up spec - add testing rig - update to 3.9: * Exposed the parser state number as the parser.state attribute in productions and error functions. * Fixed Issue #88. Python3 compatibility with ply/cpp. * Fixed Issue #93. Ply can crash if SyntaxError is raised inside a production. Not actually sure if the original implementation worked as documented at all. Yacc has been modified to follow the spec as outlined in the CHANGES noted for 11/27/07 below. * Fixed Issue #97. Failure with code validation when the original source files aren't present. Validation step now ignores the missing file. * Minor fixes to version numbers. - Switch to single-spec build - Update to 3.10 * Changed grammar signature computation to not involve hashing functions. Parts are just combined into a big string. - Fix wrong-script-interpreter rpmlint error. - Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes tests with Linux 5.5. - Update to 5.7.0: * Various fixes to build with updated kernel/etc. - Remove merged patch pr_1665.patch and pr_1364.patch - Update patch skip-obs.patch - Remove skip-test-missing-warnings.patch as it can be fixed by properly calling the tests - Add skip_failing_tests.patch to skip tests failing because of incomplete emulation of the environment in osc build environment (gh#giampaolo/psutil#1635). - update to 5.7.2: * parallel tests on UNIX (make test-parallel). They're twice as fast! * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX. * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call. * 1747: Process provides more info about the process on str() and repr() (status and exit code): * 1757: memory leak tests are now stable. * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot) * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Michał Górny) * 1760: [Linux] Process.rlimit() does not handle long long type properly. * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess. * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar) - remove skip-flaky-i586.patch (obsolete) - Fix shebang replacement for multiple python flavors - update to 5.7.3: - 809_: [FreeBSD] add support for `Process.rlimit()`. - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner) - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is running (meaning Wi-Fi or ethernet cable is connected). - 1837_: [Linux] improved battery detection and charge "secsleft" calculation - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more than one CPU socket. - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still alive but the exe file which launched it got deleted. - 1791_: [macOS] fix missing include for getpagesize(). - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL pointer. - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not the remaining values, still return a result instead of None. - skip-obs.patch, skip_failing_tests.patch: rediff - Add missing BR for unittest2 - Only require unittest2 for Leap. - update to 5.8.0: * Enhancements: - 1863: disk_partitions() exposes 2 extra fields: maxfile and maxpath, which are the maximum file name and path name length. - 1872: [Windows] added support for PyPy 2.7. - 1879: provide pre-compiled wheels for Linux and macOS. - 1880: get rid of Travis and Cirrus CI services (they are no longer free). CI testing is now done by GitHub Actions on Linux, macOS and FreeBSD (yes). AppVeyor is still being used for Windows CI. * Bug fixes: - 1708: [Linux] get rid of sensors_temperatures() duplicates. (patch by Tim Schlueter). - 1839: [Windows] always raise AccessDenied when failing to query 64 processes from 32 bit ones (NtWoW64 APIs). - 1866: [Windows] process exe(), cmdline(), environ() may raise "invalid access to memory location" on Python 3.9. - 1874: [Solaris] wrong swap output given when encrypted column is present. - 1875: [Windows] process username() may raise ERROR_NONE_MAPPED if the SID has no corresponding account name. In this case AccessDenied is now raised. - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS. Turn it into AccessDenied or NoSuchProcess depending on whether the PID is alive. - 1886: [macOS] EIO error may be raised on cmdline() and environment(). Now it gets translated into AccessDenied. - 1891: [macOS] get rid of deprecated getpagesize(). - Rebase patch and skip three other tests that fail on obs * skip-obs.patch - Add patch to skip tests related to rlimit and zombie processes that fail when building for python2 on i586: * skip_rlimit_tests_on_python2.patch - Do not install tests (and change the way they're run since they were run from %{buildroot}) - remove the dependency on net-tools, since it conflicts with busybox-hostnmame which is default on MicroOS. boo#1184753 - Update skip-obs.patch to also skip TestProcess.test_ionice_linux - update to 5.9.0: * [Linux]: `cpu_freq()`_ is slow on systems with many CPUs. Read current frequency values for all CPUs from ``/proc/cpuinfo`` instead of opening many files in ``/sys`` fs. (patch by marxin) * `NoSuchProcess`_ message now specifies if the PID has been reused. * error classes (`NoSuchProcess`_, `AccessDenied`_, etc.) now have a better formatted and separated ``__repr__`` and ``__str__`` implementations. * [Linux]: `disk_partitions()`_: convert ``/dev/root`` device (an alias used on some Linux distros) to real root device path. * ``PSUTIL_DEBUG`` mode now prints file name and line number of the debug messages coming from C extension modules. * rewrite HISTORY.rst to use hyperlinks pointing to psutil API doc. * [Linux]: `wait_procs()`_ should catch ``subprocess.TimeoutExpired`` exception. * [Linux]: `sensors_battery()`_ can raise ``TypeError`` on PureOS. * [Linux]: psutil does not handle ``ENAMETOOLONG`` when accessing process file descriptors in procfs. (patch by Nikita Radchenko) * **[critical]**: ``memoize_when_activated`` decorator is not thread-safe. * **[critical]**: `process_iter()`_ is not thread safe and can raise ``TypeError`` if invoked from multiple threads. * [Linux]: `cpu_freq()`_ return order is wrong on systems with more than 9 CPUs. - Add skip-partitions-erros.patch skipping tests failing on Linux (gh#giampaolo/psutil#2043). - Fix name of Patch4, it is skip-partitions-erros.patch - removed obsolete skip-partitions-erros.patch - update to 5.9.1 * Enhancements - 1053: drop Python 2.6 support. (patches by Matthieu Darbois and Hugo van Kemenade) - 2050, [Linux]: increase read(2) buffer size from 1k to 32k when reading /proc pseudo files line by line. This should help having more consistent results. - 2057, [OpenBSD]: add support for cpu_freq(). - 2107, [Linux]: Process.memory_full_info() (reporting process USS/PSS/Swap memory) now reads /proc/pid/smaps_rollup instead of /proc/pids/smaps, which makes it 5 times faster. * Bug fixes - 2048: AttributeError is raised if psutil.Error class is raised manually and passed through str. - 2049, [Linux]: cpu_freq() erroneously returns curr value in GHz while min and max are in MHz. - 2050, [Linux]: virtual_memory() may raise ValueError if running in a LCX container. - Add patch mem-used-bsc1181475.patch (bsc#1181475) * Adopt change of used memory calculation from upstream of procps - Fix tests: setuptools changed the builddir library path and does not find the module from it. Use the installed platlib instead and exclude psutil.tests only later. - Refresh skip-obs.patch - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - update to version 2.21.0: * Requests now supports idna v2.8. - Do not depend on python-py - Update few of the requirements - Skip one more test that is flaky - Do not hardcode version requirements in setup.py allowing us to update and verify functionality on our own: * requests-no-hardcoded-version.patch - Update to version 2.20.1 (bsc#1111622) * Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443). - Update to 2.22.0: * Requests now supports urllib3 v1.25.2. (note: 1.25.0 and 1.25.1 are incompatible) - Rebase requests-no-hardcoded-version.patch - Hardcode pytest 3.x series as upstream even in git does not work with newer versions (they pinned the release) - Add two patches only updating test logic to remove pytest 3 pin - merged_pr_5049.patch - pr_5251-pytest5.patch - Remove python-urllib3, python-certifi and ca-certificates from main package BuildRequires, not required for building. - Do not require full python, (implicit) python-base is sufficient. - update to 2.23.0 - dropped merged_pr_5049.patch - refreshed requests-no-hardcoded-version.patch * Remove defunct reference to prefetch in Session __attrs__ * Requests no longer outputs password in basic auth usage warning - Switch off test_https_warnings test (bsc#1170175) - remove patch pr_5251-pytest5.patch, not needed anymore. - update to version 2.24.0: - pyOpenSSL TLS implementation is now only used if Python either doesn't have an `ssl` module or doesn't support SNI. Previously pyOpenSSL was unconditionally used if available. This applies even if pyOpenSSL is installed via the `requests[security]` extra (#5443) - Redirect resolution should now only occur when `allow_redirects` is True. (#5492) - No longer perform unnecessary Content-Length calculation for requests that won't use it. (#5496) - update to 2.25.0: * Added support for NETRC environment variable. (#5643) * Requests now supports urllib3 v1.26. * Requests v2.25.x will be the last release series with support for Python 3.5. - refreshed requests-no-hardcoded-version.patch - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.25.1: - Requests now treats `application/json` as `utf8` by default. Resolving inconsistencies between `r.text` and `r.json` output. (#5673) - Don't pin idna<3 in the egg-info so that depending packages can install the new idna dropping python2 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 - Add CVE-2024-35195.patch (CVE-2024-35195, bsc#1224788) - Add httpbin.patch to fix a test failure caused by the previous patch. - Update CVE-2024-35195.patch to allow the usage of "verify" parameter as a directory, bsc#1225912 - Move name ahead of version in spec file to resolve build issues on older distributions - fdupe more thoroughly. - Support older Red Hat platforms that don't offer "Recommends:" - update to version 2.21.0: * Requests now supports idna v2.8. - Do not depend on python-py - Update few of the requirements - Skip one more test that is flaky - Do not hardcode version requirements in setup.py allowing us to update and verify functionality on our own: * requests-no-hardcoded-version.patch - Update to version 2.20.1 (bsc#1111622) * Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443). - Update to 2.22.0: * Requests now supports urllib3 v1.25.2. (note: 1.25.0 and 1.25.1 are incompatible) - Rebase requests-no-hardcoded-version.patch - Hardcode pytest 3.x series as upstream even in git does not work with newer versions (they pinned the release) - Add two patches only updating test logic to remove pytest 3 pin - merged_pr_5049.patch - pr_5251-pytest5.patch - Remove python-urllib3, python-certifi and ca-certificates from main package BuildRequires, not required for building. - Do not require full python, (implicit) python-base is sufficient. - update to 2.23.0 - dropped merged_pr_5049.patch - refreshed requests-no-hardcoded-version.patch * Remove defunct reference to prefetch in Session __attrs__ * Requests no longer outputs password in basic auth usage warning - Switch off test_https_warnings test (bsc#1170175) - remove patch pr_5251-pytest5.patch, not needed anymore. - update to version 2.24.0: - pyOpenSSL TLS implementation is now only used if Python either doesn't have an `ssl` module or doesn't support SNI. Previously pyOpenSSL was unconditionally used if available. This applies even if pyOpenSSL is installed via the `requests[security]` extra (#5443) - Redirect resolution should now only occur when `allow_redirects` is True. (#5492) - No longer perform unnecessary Content-Length calculation for requests that won't use it. (#5496) - update to 2.25.0: * Added support for NETRC environment variable. (#5643) * Requests now supports urllib3 v1.26. * Requests v2.25.x will be the last release series with support for Python 3.5. - refreshed requests-no-hardcoded-version.patch - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.25.1: - Requests now treats `application/json` as `utf8` by default. Resolving inconsistencies between `r.text` and `r.json` output. (#5673) - Don't pin idna<3 in the egg-info so that depending packages can install the new idna dropping python2 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 - Support older Red Hat platforms that don't offer "Recommends:" - update to version 2.21.0: * Requests now supports idna v2.8. - Do not depend on python-py - Update few of the requirements - Skip one more test that is flaky - Do not hardcode version requirements in setup.py allowing us to update and verify functionality on our own: * requests-no-hardcoded-version.patch - Update to version 2.20.1 (bsc#1111622) * Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443). - Update to 2.22.0: * Requests now supports urllib3 v1.25.2. (note: 1.25.0 and 1.25.1 are incompatible) - Rebase requests-no-hardcoded-version.patch - Hardcode pytest 3.x series as upstream even in git does not work with newer versions (they pinned the release) - Add two patches only updating test logic to remove pytest 3 pin - merged_pr_5049.patch - pr_5251-pytest5.patch - Remove python-urllib3, python-certifi and ca-certificates from main package BuildRequires, not required for building. - Do not require full python, (implicit) python-base is sufficient. - update to 2.23.0 - dropped merged_pr_5049.patch - refreshed requests-no-hardcoded-version.patch * Remove defunct reference to prefetch in Session __attrs__ * Requests no longer outputs password in basic auth usage warning - Switch off test_https_warnings test (bsc#1170175) - remove patch pr_5251-pytest5.patch, not needed anymore. - update to version 2.24.0: - pyOpenSSL TLS implementation is now only used if Python either doesn't have an `ssl` module or doesn't support SNI. Previously pyOpenSSL was unconditionally used if available. This applies even if pyOpenSSL is installed via the `requests[security]` extra (#5443) - Redirect resolution should now only occur when `allow_redirects` is True. (#5492) - No longer perform unnecessary Content-Length calculation for requests that won't use it. (#5496) - update to 2.25.0: * Added support for NETRC environment variable. (#5643) * Requests now supports urllib3 v1.26. * Requests v2.25.x will be the last release series with support for Python 3.5. - refreshed requests-no-hardcoded-version.patch - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.25.1: - Requests now treats `application/json` as `utf8` by default. Resolving inconsistencies between `r.text` and `r.json` output. (#5673) - Don't pin idna<3 in the egg-info so that depending packages can install the new idna dropping python2 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 - Add CVE-2024-35195.patch (CVE-2024-35195, bsc#1224788) - Add httpbin.patch to fix a test failure caused by the previous patch. - adapt buildrequires - adapt buildrequires - adapt second spec file to changes done to rpm.spec - drop standard python directories from filelist [bnc#229189] - add libtool as explicit buildrequire - Spec file cleanup: * Don't rm -rf %{buildroot} * Removed %clean section * Removed authors from description - Fix usage of deprecated AsVoidPtr Python/C API, replaced by Capsule API - modified capsule api diff to match rpm upstream - Update to 4.10.2 - update to rpm-4.11.1 - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt buildrequires - adapt buildrequires - adapt second spec file to changes done to rpm.spec - drop standard python directories from filelist [bnc#229189] - add libtool as explicit buildrequire - Spec file cleanup: * Don't rm -rf %{buildroot} * Removed %clean section * Removed authors from description - Fix usage of deprecated AsVoidPtr Python/C API, replaced by Capsule API - modified capsule api diff to match rpm upstream - Update to 4.10.2 - update to rpm-4.11.1 - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt buildrequires - adapt buildrequires - adapt second spec file to changes done to rpm.spec - drop standard python directories from filelist [bnc#229189] - add libtool as explicit buildrequire - Spec file cleanup: * Don't rm -rf %{buildroot} * Removed %clean section * Removed authors from description - Fix usage of deprecated AsVoidPtr Python/C API, replaced by Capsule API - modified capsule api diff to match rpm upstream - Update to 4.10.2 - update to rpm-4.11.1 - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt buildrequires - adapt buildrequires - adapt second spec file to changes done to rpm.spec - drop standard python directories from filelist [bnc#229189] - add libtool as explicit buildrequire - Spec file cleanup: * Don't rm -rf %{buildroot} * Removed %clean section * Removed authors from description - Fix usage of deprecated AsVoidPtr Python/C API, replaced by Capsule API - modified capsule api diff to match rpm upstream - Update to 4.10.2 - update to rpm-4.11.1 - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - Update to version 3.3.0 * Unpaired surrogates once again pass through the decoder, to match older behavior and the RFC-4627 spec. https://github.com/simplejson/simplejson/issues/62 - update to 3.3.1: * JSONDecodeError exceptions can now be pickled - Require python-setuptools instead of distribute (upstreams merged) - Update to 3.4.1 * Fixed tests to run on Python 3.4 - Update to 3.4.0 * Native setuptools support re-introduced https://github.com/simplejson/simplejson/pull/92 - Update to 3.3.3 * Improve test suite's Python 3.4 compatibility https://github.com/simplejson/simplejson/issues/87 - Update to 3.3.2 * Docstring fix for decoded string types https://github.com/simplejson/simplejson/pull/82 - update to 3.5.2: * Fix Windows build with VS2008 Version 3.5.1 released 2014-05-21 * Consistently reject int_as_string_bitcount settings that are not positive integers Version 3.5.0 released 2014-05-20 * Added int_as_string_bitcount encoder option * Fixed potential crash when encoder created with incorrect options - update to version 3.6.5: * Importing bug fix for reference leak when an error occurs during dict encoding https://github.com/simplejson/simplejson/issues/109 - additional changes from version 3.6.4: * Important bug fix for dump when only sort_keys is set https://github.com/simplejson/simplejson/issues/106 - additional changes from version 3.6.3: * Documentation updates https://github.com/simplejson/simplejson/issues/103 - additional changes from version 3.6.2: * Documentation updates http://bugs.python.org/issue21514 - additional changes from version 3.6.1: * Documentation updates https://github.com/simplejson/simplejson/issues/102 - additional changes from version 3.6.0: * Automatically strip any UTF-8 BOM from input to more closely follow the latest specs https://github.com/simplejson/simplejson/pull/101 - additional changes from version 3.5.3: * Fix lower bound checking in scan_once / raw_decode API https://github.com/simplejson/simplejson/issues/98 - update to 3.8.2: * Fix implicit cast compiler warning in _speedups.c * simplejson is now available as wheels for OS X and Windows thanks to Travis-CI and AppVeyor respectively! Many thanks to @aebrahim for getting this party started. * Fix issue with iterable_as_array and indent option * Fix typo in keyword argument name introduced in 3.8.0 * New iterable_as_array encoder option to perform lazy serialization of any iterable objects, without having to convert to tuple or list. * Fix typo introduced in 3.7.0 (behavior should be indistinguishable) https://github.com/simplejson/simplejson/commit/e18cc09b688ea1f3305c27616fd3cadd2adc6d31#commitcomment-11443842 * Do not cache Decimal class in encoder, only reference the decimal module. This may make reload work in more common scenarios. * Fix compilation with MSVC https://github.com/simplejson/simplejson/pull/119 * simplejson no longer trusts custom str/repr methods for int, long, float subclasses. These instances are now formatted as if they were exact instances of those types. https://github.com/simplejson/simplejson/issues/118 - Switch to single-spec build - Update to 3.10.0 * Add RawJSON class to allow a faster path for already encoded JSON. - From 3.9.0 * Workaround for bad behavior in string subclasses * Fix warnings flagged by -3 * Update readthedocs documentation links * Add build status badge to README - fix pypi url - update to 3.11.1: * Fix issue with item_sort_key when speedups are available, and add auto-discovery to test suites to prevent similar regressions * docstring fix in JSONEncoder * Call PyObject_IsTrue() only once for the strict argument of scann er * Fix a crash with unencodable encoding in the encoder * Remove unused imports * Remove remnants of Python 2.4 support * Fix argument checking errors in _speedups.c * Remove the `__init__` methods in extension classes * Fix typo in the doc for loads * Add Python 3.6 to testing matrix and PyPI metadata - update to version 3.12.0: * Fix threaded import race condition https://github.com/simplejson/simplejson/issues/184 * Move RawJSON implementation to simplejson.raw_json module * Move JSONDecodeError implementation to simplejson.errors module - update to version 3.13.2: * Fix additional Python 2.x compilation issue on Windows - changes from version 3.13.1 : * Improve CI to catch speedups build regressions * Fix speedups build regression in Python 2.x https://github.com/simplejson/simplejson/issues/193 - changes from version 3.13.0: * Workarounds for NamedTemporaryFile issues with Windows for tool tests * Make TypeError messages contain type name instead of a repr. https://github.com/simplejson/simplejson/pull/191 * Ensure that encoding of text subtypes is consistent with or without speedups https://github.com/simplejson/simplejson/issues/185 - changes from version 3.12.1: * Misc updates to build infrastructure * Fix an assertion failure when make_encoder receives a bad encoder argument https://github.com/simplejson/simplejson/pull/188 * Fix potential crash during GC https://github.com/simplejson/simplejson/pull/187 * Fix a reference leak when sorting keys https://github.com/simplejson/simplejson/pull/186 - Remove bias from description. - specfile: * update copyright year - update to version 3.14.0: * Defer is_raw_json test (performance improvement) https://github.com/simplejson/simplejson/pull/212 * Avoid escaping U+2028 and U+2029 without ensure_ascii https://github.com/simplejson/simplejson/pull/211 * Fix an incorrect type test in Python 2, avoiding an unnecessary unicode copy. https://github.com/simplejson/simplejson/pull/210 - update to version 3.15.0: * Clean up the C code * Bypass the decode() method in bytes subclasses * Support builds without cStringIO * Allow to disable serializing bytes by default in Python 3 * Simplify the compatibility code * Fix tests in Python 2.5 - specfile: * be more specific in %files: %{python_sitearch}/* -> %{python_sitearch}/simplejson* - update to version 3.16.0: * Restore old behavior with regard to the type of decoded empty strings with speedups enabled on Python 2.x https://github.com/simplejson/simplejson/pull/225 * Add python_requires to setup.py to help pip https://github.com/simplejson/simplejson/pull/224 * Fix CSS in docs when built locally https://github.com/simplejson/simplejson/pull/222 - Do not package tests - update to version 3.16.1: * Added examples for JSON lines use cases * Add wheels for more Python versions and platforms - specfile: * update copyright year - update to version 3.17.0: * Updated documentation to be Python 3 first, and have removed documentation notes about version changes that occurred more than five years ago. https://github.com/simplejson/simplejson/pull/257 https://github.com/simplejson/simplejson/pull/254 * Update build matrix for Python 3.8 https://github.com/simplejson/simplejson/pull/255 https://github.com/simplejson/simplejson/pull/256 - update to 3.17.2 - use pytest as testrunner - Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides: python-urllib3, fixes boo#1138746 - Provides/Obsoletes does not fix the issue: we have a directory-to-symlink switch, which cannot be handled by RPM internally. Assist using pre script (boo#1138715). - Fixup pre script: the migration issue happens when changing from python-urllib3 to python2-urllib3: the number of installed instances of python2-urlliib3 is at this moment 1, unlike in regular updates. This is due to a name change, which consists not of a pure package update. - Use old pytest 3.x as newer do not work with this release * this will be fixed with next release, just spread among numerous fixes in the git for quick backporting - Use have/skip_python2/3 macros to allow building only one flavour - Update to 1.25.5: * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682) * Propagate Retry-After header settings to subsequent retries. (Pull #1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607) * Remove dependency on rfc3986 for URL parsing. * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters. * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652) * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673) - Drop patch urllib3-ssl-default-context.patch - Drop patch python-urllib3-recent-date.patch the date is recent enough on its own - Restrict the tornado dep from tom to 5 or older release as the 6.x changed the API - Updae to 1.25.6: * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692) - Require a new enough release of python-six. 1.25.6 needs at least 1.12.0 for ensure_text() and friends. - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. - Explicitly switch off building python 2 version. - update to 1.25.9 (bsc#1177120, CVE-2020-26137): * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. * Drain connection after ``PoolManager`` redirect (Pull #1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805) * Allow the CA certificate data to be passed as a string (Pull #1804) * Raise ``ValueError`` if method contains control characters (Pull #1800) * Add ``__repr__`` to ``Timeout`` (Pull #1795) - update to 1.25.10: * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull #1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858) - Generate pyc for ssl_match_hostname too - Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail. - Skip test for RECENT_DATE. It is a test purely for developers. To maintain reproducibility, keep upstreams possibly outdated RECENT_DATE in the source code. - Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503) * Improve performance of sub-authority splitting in URL - Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804) gh#urllib3/urllib3#3139 * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. - Add CVE-2023-45803.patch (bsc#1216377, CVE-2023-45803) gh#urllib3/urllib3@4e98d57809da - Add CVE-2024-37891.patch (bsc#1226469, CVE-2024-37891) - Add more test to skip as with new openssl some behaviour changed and we can't rely on them anymore - Skip test_source_address_error as we raise different error with fixes that we provide in new python2/3 - Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides: python-urllib3, fixes boo#1138746 - Provides/Obsoletes does not fix the issue: we have a directory-to-symlink switch, which cannot be handled by RPM internally. Assist using pre script (boo#1138715). - Fixup pre script: the migration issue happens when changing from python-urllib3 to python2-urllib3: the number of installed instances of python2-urlliib3 is at this moment 1, unlike in regular updates. This is due to a name change, which consists not of a pure package update. - Use old pytest 3.x as newer do not work with this release * this will be fixed with next release, just spread among numerous fixes in the git for quick backporting - Use have/skip_python2/3 macros to allow building only one flavour - Update to 1.25.5: * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682) * Propagate Retry-After header settings to subsequent retries. (Pull #1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607) * Remove dependency on rfc3986 for URL parsing. * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters. * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652) * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673) - Drop patch urllib3-ssl-default-context.patch - Drop patch python-urllib3-recent-date.patch the date is recent enough on its own - Restrict the tornado dep from tom to 5 or older release as the 6.x changed the API - Updae to 1.25.6: * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692) - Require a new enough release of python-six. 1.25.6 needs at least 1.12.0 for ensure_text() and friends. - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. - Explicitly switch off building python 2 version. - update to 1.25.9 (bsc#1177120, CVE-2020-26137): * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. * Drain connection after ``PoolManager`` redirect (Pull #1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805) * Allow the CA certificate data to be passed as a string (Pull #1804) * Raise ``ValueError`` if method contains control characters (Pull #1800) * Add ``__repr__`` to ``Timeout`` (Pull #1795) - update to 1.25.10: * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull #1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858) - Generate pyc for ssl_match_hostname too - Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail. - Skip test for RECENT_DATE. It is a test purely for developers. To maintain reproducibility, keep upstreams possibly outdated RECENT_DATE in the source code. - Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503) * Improve performance of sub-authority splitting in URL - Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804) gh#urllib3/urllib3#3139 * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. - Skip test_source_address_error as we raise different error with fixes that we provide in new python2/3 - Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides: python-urllib3, fixes boo#1138746 - Provides/Obsoletes does not fix the issue: we have a directory-to-symlink switch, which cannot be handled by RPM internally. Assist using pre script (boo#1138715). - Fixup pre script: the migration issue happens when changing from python-urllib3 to python2-urllib3: the number of installed instances of python2-urlliib3 is at this moment 1, unlike in regular updates. This is due to a name change, which consists not of a pure package update. - Use old pytest 3.x as newer do not work with this release * this will be fixed with next release, just spread among numerous fixes in the git for quick backporting - Use have/skip_python2/3 macros to allow building only one flavour - Update to 1.25.5: * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682) * Propagate Retry-After header settings to subsequent retries. (Pull #1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607) * Remove dependency on rfc3986 for URL parsing. * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters. * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652) * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673) - Drop patch urllib3-ssl-default-context.patch - Drop patch python-urllib3-recent-date.patch the date is recent enough on its own - Restrict the tornado dep from tom to 5 or older release as the 6.x changed the API - Updae to 1.25.6: * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692) - Require a new enough release of python-six. 1.25.6 needs at least 1.12.0 for ensure_text() and friends. - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. - Explicitly switch off building python 2 version. - update to 1.25.9 (bsc#1177120, CVE-2020-26137): * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. * Drain connection after ``PoolManager`` redirect (Pull #1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805) * Allow the CA certificate data to be passed as a string (Pull #1804) * Raise ``ValueError`` if method contains control characters (Pull #1800) * Add ``__repr__`` to ``Timeout`` (Pull #1795) - update to 1.25.10: * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull #1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858) - Generate pyc for ssl_match_hostname too - Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail. - Skip test for RECENT_DATE. It is a test purely for developers. To maintain reproducibility, keep upstreams possibly outdated RECENT_DATE in the source code. - Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503) * Improve performance of sub-authority splitting in URL - Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804) gh#urllib3/urllib3#3139 * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. - Add CVE-2023-45803.patch (bsc#1216377, CVE-2023-45803) gh#urllib3/urllib3@4e98d57809da - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Use %python_version over %py_ver: better portability to RHEL - Update to 2.8 - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Tests are removed from the package (not distributed in the tar.gz) - Update to 2.9.5 (bsc#1132174, CVE-2016-10745) (see the changes in /usr/share/doc/packages/python-Jinja2/CHANGES) - updated source URL - fix requires - update for singlespec - update to 2.9.6 * fixed custom context behavior in fast resolve mode - specfile: * CHANGES -> CHANGES.rst * added README.rst to %doc section - update to version 2.10: * Added a new extension node called "OverlayScope" which can be used to create an unoptimized scope that will look up all variables from a derived context. * Added an "in" test that works like the in operator. This can be used in combination with "reject" and "select". * Added "previtem" and "nextitem" to loop contexts, providing access to the previous/next item in the loop. If such an item does not exist, the value is undefined. * Added "changed(*values)" to loop contexts, providing an easy way of checking whether a value has changed since the last iteration (or rather since the last call of the method) * Added a "namespace" function that creates a special object which allows attribute assignment using the "set" tag. This can be used to carry data across scopes, e.g. from a loop body to code that comes after the loop. * Added a "trimmed" modifier to "{% trans %}" to strip linebreaks and surrounding whitespace. Also added a new policy to enable this for all "trans" blocks. * The "random" filter is no longer incorrectly constant folded and will produce a new random choice each time the template is rendered. (`#478`_) * Added a "unique" filter. (`#469`_) * Added "min" and "max" filters. (`#475`_) * Added tests for all comparison operators: "eq", "ne", "lt", "le", "gt", "ge". (`#665`_) * "import" statement cannot end with a trailing comma. (`#617`_, `#618`_) * "indent" filter will not indent blank lines by default. (`#685`_) * Add "reverse" argument for "dictsort" filter. (`#692`_) * Add a "NativeEnvironment" that renders templates to native Python types instead of strings. (`#708`_) * Added filter support to the block "set" tag. (`#489`_) * "tojson" filter marks output as safe to match documented behavior. (`#718`_) * Resolved a bug where getting debug locals for tracebacks could modify template context. * Fixed a bug where having many "{% elif ... %}" blocks resulted in a "too many levels of indentation" error. These blocks now compile to native "elif ..:" instead of "else: if ..:" (`#759`_) - update to version 2.10.1 (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341): * "SandboxedEnvironment" securely handles "str.format_map" in order to prevent code execution through untrusted format strings. The sandbox already handled "str.format". - CVE-2020-28493: Fixed a ReDOS vulnerability where urlize could have been called with untrusted user data (bsc#1181944). Added CVE-2020-28493.patch - Fixed IndentationError in CVE-2020-28493.patch (bsc#1182244) - Add CVE-2024-34064.patch upstream patch (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4) Also fixes (CVE-2024-22195, bsc#1218722) - Use %python_version over %py_ver: better portability to RHEL - Update to 2.8 - Added `target` parameter to urlize function. - Added support for `followsymlinks` to the file system loader. - The truncate filter now counts the length. - Added equalto filter that helps with select filters. - Changed cache keys to use absolute file names if available instead of load names. - Fixed loop length calculation for some iterators. - Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding. - Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger. - If unmarshalling of cached data fails the template will be reloaded now. - Implemented a block ``set`` tag. - Default cache size was incrased to 400 from a low 50. - Fixed ``is number`` test to accept long integers in all Python versions. - Changed ``is number`` to accept Decimal as a number. - Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`). - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``). - added support for context/environment/evalctx decorator functions on the finalize callback of the environment. - escape query strings for urlencode properly. Previously slashes were not escaped in that place. - Add 'base' parameter to 'int' filter. - Tests are removed from the package (not distributed in the tar.gz) - Update to 2.9.5 (bsc#1132174, CVE-2016-10745) (see the changes in /usr/share/doc/packages/python-Jinja2/CHANGES) - updated source URL - fix requires - update for singlespec - update to 2.9.6 * fixed custom context behavior in fast resolve mode - specfile: * CHANGES -> CHANGES.rst * added README.rst to %doc section - update to version 2.10: * Added a new extension node called "OverlayScope" which can be used to create an unoptimized scope that will look up all variables from a derived context. * Added an "in" test that works like the in operator. This can be used in combination with "reject" and "select". * Added "previtem" and "nextitem" to loop contexts, providing access to the previous/next item in the loop. If such an item does not exist, the value is undefined. * Added "changed(*values)" to loop contexts, providing an easy way of checking whether a value has changed since the last iteration (or rather since the last call of the method) * Added a "namespace" function that creates a special object which allows attribute assignment using the "set" tag. This can be used to carry data across scopes, e.g. from a loop body to code that comes after the loop. * Added a "trimmed" modifier to "{% trans %}" to strip linebreaks and surrounding whitespace. Also added a new policy to enable this for all "trans" blocks. * The "random" filter is no longer incorrectly constant folded and will produce a new random choice each time the template is rendered. (`#478`_) * Added a "unique" filter. (`#469`_) * Added "min" and "max" filters. (`#475`_) * Added tests for all comparison operators: "eq", "ne", "lt", "le", "gt", "ge". (`#665`_) * "import" statement cannot end with a trailing comma. (`#617`_, `#618`_) * "indent" filter will not indent blank lines by default. (`#685`_) * Add "reverse" argument for "dictsort" filter. (`#692`_) * Add a "NativeEnvironment" that renders templates to native Python types instead of strings. (`#708`_) * Added filter support to the block "set" tag. (`#489`_) * "tojson" filter marks output as safe to match documented behavior. (`#718`_) * Resolved a bug where getting debug locals for tracebacks could modify template context. * Fixed a bug where having many "{% elif ... %}" blocks resulted in a "too many levels of indentation" error. These blocks now compile to native "elif ..:" instead of "else: if ..:" (`#759`_) - update to version 2.10.1 (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341): * "SandboxedEnvironment" securely handles "str.format_map" in order to prevent code execution through untrusted format strings. The sandbox already handled "str.format". - CVE-2020-28493: Fixed a ReDOS vulnerability where urlize could have been called with untrusted user data (bsc#1181944). Added CVE-2020-28493.patch - Fixed IndentationError in CVE-2020-28493.patch (bsc#1182244) - Add CVE-2024-34064.patch upstream patch (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4) Also fixes (CVE-2024-22195, bsc#1218722) - Add security patch CVE-2024-56326.patch (bsc#1234809) - Add fix_OpenSSL111c.patch patch to ensure compatibility with OpenSSL 1.1.1c. gl#m2crypto/m2crypto#258 and jsc#SLE-9135. - Replace fix_OpenSSL111c.patch with proper new release 0.35.1 (there is really not much more in it; bsc#1149792). - Update to fix release 0.35.2 ... just fixing the test suite (bsc#1172226). - in python3.8 the fp is wrapped in a Buffer. SSL.Connection.makefile returns a socketIO which is no buffer. Added: 001-fix-buffering-for-python38.patch - Do not pull in py2 pkg on doc subpkg Update to 0.36.0: - wrap SocketIO in io.Buffered* for makefile <lethliel> - SSL.Connection.close accepts an argument to force the socket closing <Christophe Haen> - SSL.Connection: make the clientPostConnectionCheck an instance attribute <Christophe Haen> - Fixed bug with usage of unexisting method getreply at SSL_Transport <roman-nagaev> - Add appveyor builds for python 3.7 and 3.8 <Daniel A. Wozniak> - Fixed syntax warning on line 44. <randomfox> - Update M2Crypto.six to 1.13.0 <Matěj Cepl> - base64.decodestring() was finally removed in Python 3.8. <Matěj Cepl> - wrap SocketIO in io.Buffered* for makefile <lethliel> - NULL is legal argument for key and iv paramters of EVP_CipherInit(3) <Matěj Cepl> - Expose X509_V_FLAG_ALLOW_PROXY_CERTS verification flag and X509_STORE_SET_FLAGS function <Christophe Haen> - Stop testing for 2.6 and 3.4 on Travis. Start testing 3.8 <Matěj Cepl> - Extend test cert validity to 2049 <Bernhard M. Wiedemann> - Revert using typing module in 2.6. It is just not worthy. <Matěj Cepl> - Update Debian/stable SSL as well <Matěj Cepl> - Make tests pass again. <Matěj Cepl> - Stop using string module, which has been deprecated. <Matěj Cepl> - Tiny fixes to make pyls more happy <Matěj Cepl> - CI: Rework Fedora CI configuration <Neal Gompa> - Remove upstream merged patch 001-fix-buffering-for-python38.patch. - Update to 0.37.1: - Remove support for CentOS 6 and Python 2.6 (remove tests.vendor module). Python 2.7 is still fully supported. - Remodel CI: - on GitHub switched from Travis-CI to GH Actions - on GitLab-CI: stop testing 2.7 on Fedora, add centos7 - update appveyor.yml - Stop playing with swig in setup.py, we don't support swig 1.* anymore. - Fix dereferencing of pointers (gl#m2crypto/m2crypto#281) - Replace deprecated PyObject_AsReadBuffer with our own shim (thanks to Casey Deccio for saving my bacon there). - Use parametrized to create parametrized tests (new external dependency). - Only use DigestSign() and DigestUpdate() with OpenSSL >= 1.1.1 - Expose all the X509_V_FLAG - Add support for DigestSign* and DigestVerify* - Dr. Strangelove or: How I Learned to Stop Worrying and Love pytest - Add source signature file - OpenSSL allows the verificaton to continue on UNABLE_TO_VERIFY_LEAF_SIGNATURE * This unifies the behaviour of a single certificate with an unknown CA certificate with a self-signed certificate. - Add python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch (Thanks for Debian, https://salsa.debian.org/python-team/packages/m2crypto/-/commit/e0e9ad5cfff8) - Add 293_sslv23_padding.patch to avoid using RSA_SSLV23_PADDING (gl#m2crypto/m2crypto#293, gh#openssl/openssl#14216). - Add no-need-parameterized.patch ... we don't need run-time requirement of parameterized package (bsc#1185150). - Update to 0.38.0: - Remove the last use of setup.py test idiom. - Use m2_PyObject_AsReadBuffer instead of PyObject_AsReadBuffer. - Add support for arm64 big endian <Steev Klimaszewski> - Make support of RSA_SSLV23_PADDING optional (it has been deprecated). - Move project to src/ layout - Allow verify_cb_* to be called with ok=True <Casey Deccio> - Be prepared if any of constants in x509_vfy.h is not available. - But we do support 3.8 - We DO NOT support Python 2.6. - All patches were upstreamed: - 293_sslv23_padding.patch - no-need-parameterized.patch - python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch - Add missing bug references to this changelog. - Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657, bsc#1178829), which mitigates the Bleichenbacher timing attacks in the RSA decryption API. - Add python-M2Crypto.keyring to verify GPG signature of tarball. - update CVE-2020-25657-Bleichenbacher-attack.patch to actually contain the fix rather than just being empty (CVE-2020-25657, bsc#1178829) - add openssl-stop-parsing-header.patch (bsc#1205042) - add m2crypto-0.38-ossl3-tests.patch - Adapt tests for OpenSSL v3.1.0 * Add openssl-adapt-tests-for-3.1.0.patch - add timeout_300hz.patch to accept a small deviation from time in the testsuite (bsc#1212757) - Disable broken tests with openssl 3.2, bsc#1217782 - Add fix_OpenSSL111c.patch patch to ensure compatibility with OpenSSL 1.1.1c. gl#m2crypto/m2crypto#258 and jsc#SLE-9135. - Replace fix_OpenSSL111c.patch with proper new release 0.35.1 (there is really not much more in it; bsc#1149792). - Update to fix release 0.35.2 ... just fixing the test suite (bsc#1172226). - in python3.8 the fp is wrapped in a Buffer. SSL.Connection.makefile returns a socketIO which is no buffer. Added: 001-fix-buffering-for-python38.patch - Do not pull in py2 pkg on doc subpkg Update to 0.36.0: - wrap SocketIO in io.Buffered* for makefile <lethliel> - SSL.Connection.close accepts an argument to force the socket closing <Christophe Haen> - SSL.Connection: make the clientPostConnectionCheck an instance attribute <Christophe Haen> - Fixed bug with usage of unexisting method getreply at SSL_Transport <roman-nagaev> - Add appveyor builds for python 3.7 and 3.8 <Daniel A. Wozniak> - Fixed syntax warning on line 44. <randomfox> - Update M2Crypto.six to 1.13.0 <Matěj Cepl> - base64.decodestring() was finally removed in Python 3.8. <Matěj Cepl> - wrap SocketIO in io.Buffered* for makefile <lethliel> - NULL is legal argument for key and iv paramters of EVP_CipherInit(3) <Matěj Cepl> - Expose X509_V_FLAG_ALLOW_PROXY_CERTS verification flag and X509_STORE_SET_FLAGS function <Christophe Haen> - Stop testing for 2.6 and 3.4 on Travis. Start testing 3.8 <Matěj Cepl> - Extend test cert validity to 2049 <Bernhard M. Wiedemann> - Revert using typing module in 2.6. It is just not worthy. <Matěj Cepl> - Update Debian/stable SSL as well <Matěj Cepl> - Make tests pass again. <Matěj Cepl> - Stop using string module, which has been deprecated. <Matěj Cepl> - Tiny fixes to make pyls more happy <Matěj Cepl> - CI: Rework Fedora CI configuration <Neal Gompa> - Remove upstream merged patch 001-fix-buffering-for-python38.patch. - Update to 0.37.1: - Remove support for CentOS 6 and Python 2.6 (remove tests.vendor module). Python 2.7 is still fully supported. - Remodel CI: - on GitHub switched from Travis-CI to GH Actions - on GitLab-CI: stop testing 2.7 on Fedora, add centos7 - update appveyor.yml - Stop playing with swig in setup.py, we don't support swig 1.* anymore. - Fix dereferencing of pointers (gl#m2crypto/m2crypto#281) - Replace deprecated PyObject_AsReadBuffer with our own shim (thanks to Casey Deccio for saving my bacon there). - Use parametrized to create parametrized tests (new external dependency). - Only use DigestSign() and DigestUpdate() with OpenSSL >= 1.1.1 - Expose all the X509_V_FLAG - Add support for DigestSign* and DigestVerify* - Dr. Strangelove or: How I Learned to Stop Worrying and Love pytest - Add source signature file - OpenSSL allows the verificaton to continue on UNABLE_TO_VERIFY_LEAF_SIGNATURE * This unifies the behaviour of a single certificate with an unknown CA certificate with a self-signed certificate. - Add python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch (Thanks for Debian, https://salsa.debian.org/python-team/packages/m2crypto/-/commit/e0e9ad5cfff8) - Add 293_sslv23_padding.patch to avoid using RSA_SSLV23_PADDING (gl#m2crypto/m2crypto#293, gh#openssl/openssl#14216). - Add no-need-parameterized.patch ... we don't need run-time requirement of parameterized package (bsc#1185150). - Update to 0.38.0: - Remove the last use of setup.py test idiom. - Use m2_PyObject_AsReadBuffer instead of PyObject_AsReadBuffer. - Add support for arm64 big endian <Steev Klimaszewski> - Make support of RSA_SSLV23_PADDING optional (it has been deprecated). - Move project to src/ layout - Allow verify_cb_* to be called with ok=True <Casey Deccio> - Be prepared if any of constants in x509_vfy.h is not available. - But we do support 3.8 - We DO NOT support Python 2.6. - All patches were upstreamed: - 293_sslv23_padding.patch - no-need-parameterized.patch - python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch - Add missing bug references to this changelog. - Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657, bsc#1178829), which mitigates the Bleichenbacher timing attacks in the RSA decryption API. - Add python-M2Crypto.keyring to verify GPG signature of tarball. - update CVE-2020-25657-Bleichenbacher-attack.patch to actually contain the fix rather than just being empty (CVE-2020-25657, bsc#1178829) - add openssl-stop-parsing-header.patch (bsc#1205042) - add m2crypto-0.38-ossl3-tests.patch - Adapt tests for OpenSSL v3.1.0 * Add openssl-adapt-tests-for-3.1.0.patch - add timeout_300hz.patch to accept a small deviation from time in the testsuite (bsc#1212757) - Disable broken tests with openssl 3.2, bsc#1217782 - Add fix_OpenSSL111c.patch patch to ensure compatibility with OpenSSL 1.1.1c. gl#m2crypto/m2crypto#258 and jsc#SLE-9135. - Replace fix_OpenSSL111c.patch with proper new release 0.35.1 (there is really not much more in it; bsc#1149792). - Update to fix release 0.35.2 ... just fixing the test suite (bsc#1172226). - in python3.8 the fp is wrapped in a Buffer. SSL.Connection.makefile returns a socketIO which is no buffer. Added: 001-fix-buffering-for-python38.patch - Do not pull in py2 pkg on doc subpkg Update to 0.36.0: - wrap SocketIO in io.Buffered* for makefile <lethliel> - SSL.Connection.close accepts an argument to force the socket closing <Christophe Haen> - SSL.Connection: make the clientPostConnectionCheck an instance attribute <Christophe Haen> - Fixed bug with usage of unexisting method getreply at SSL_Transport <roman-nagaev> - Add appveyor builds for python 3.7 and 3.8 <Daniel A. Wozniak> - Fixed syntax warning on line 44. <randomfox> - Update M2Crypto.six to 1.13.0 <Matěj Cepl> - base64.decodestring() was finally removed in Python 3.8. <Matěj Cepl> - wrap SocketIO in io.Buffered* for makefile <lethliel> - NULL is legal argument for key and iv paramters of EVP_CipherInit(3) <Matěj Cepl> - Expose X509_V_FLAG_ALLOW_PROXY_CERTS verification flag and X509_STORE_SET_FLAGS function <Christophe Haen> - Stop testing for 2.6 and 3.4 on Travis. Start testing 3.8 <Matěj Cepl> - Extend test cert validity to 2049 <Bernhard M. Wiedemann> - Revert using typing module in 2.6. It is just not worthy. <Matěj Cepl> - Update Debian/stable SSL as well <Matěj Cepl> - Make tests pass again. <Matěj Cepl> - Stop using string module, which has been deprecated. <Matěj Cepl> - Tiny fixes to make pyls more happy <Matěj Cepl> - CI: Rework Fedora CI configuration <Neal Gompa> - Remove upstream merged patch 001-fix-buffering-for-python38.patch. - Update to 0.37.1: - Remove support for CentOS 6 and Python 2.6 (remove tests.vendor module). Python 2.7 is still fully supported. - Remodel CI: - on GitHub switched from Travis-CI to GH Actions - on GitLab-CI: stop testing 2.7 on Fedora, add centos7 - update appveyor.yml - Stop playing with swig in setup.py, we don't support swig 1.* anymore. - Fix dereferencing of pointers (gl#m2crypto/m2crypto#281) - Replace deprecated PyObject_AsReadBuffer with our own shim (thanks to Casey Deccio for saving my bacon there). - Use parametrized to create parametrized tests (new external dependency). - Only use DigestSign() and DigestUpdate() with OpenSSL >= 1.1.1 - Expose all the X509_V_FLAG - Add support for DigestSign* and DigestVerify* - Dr. Strangelove or: How I Learned to Stop Worrying and Love pytest - Add source signature file - OpenSSL allows the verificaton to continue on UNABLE_TO_VERIFY_LEAF_SIGNATURE * This unifies the behaviour of a single certificate with an unknown CA certificate with a self-signed certificate. - Add python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch (Thanks for Debian, https://salsa.debian.org/python-team/packages/m2crypto/-/commit/e0e9ad5cfff8) - Add 293_sslv23_padding.patch to avoid using RSA_SSLV23_PADDING (gl#m2crypto/m2crypto#293, gh#openssl/openssl#14216). - Add no-need-parameterized.patch ... we don't need run-time requirement of parameterized package (bsc#1185150). - Update to 0.38.0: - Remove the last use of setup.py test idiom. - Use m2_PyObject_AsReadBuffer instead of PyObject_AsReadBuffer. - Add support for arm64 big endian <Steev Klimaszewski> - Make support of RSA_SSLV23_PADDING optional (it has been deprecated). - Move project to src/ layout - Allow verify_cb_* to be called with ok=True <Casey Deccio> - Be prepared if any of constants in x509_vfy.h is not available. - But we do support 3.8 - We DO NOT support Python 2.6. - All patches were upstreamed: - 293_sslv23_padding.patch - no-need-parameterized.patch - python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch - Add missing bug references to this changelog. - Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657, bsc#1178829), which mitigates the Bleichenbacher timing attacks in the RSA decryption API. - Add python-M2Crypto.keyring to verify GPG signature of tarball. - update CVE-2020-25657-Bleichenbacher-attack.patch to actually contain the fix rather than just being empty (CVE-2020-25657, bsc#1178829) - add openssl-stop-parsing-header.patch (bsc#1205042) - add m2crypto-0.38-ossl3-tests.patch - Adapt tests for OpenSSL v3.1.0 * Add openssl-adapt-tests-for-3.1.0.patch - add timeout_300hz.patch to accept a small deviation from time in the testsuite (bsc#1212757) - Disable broken tests with openssl 3.2, bsc#1217782 - Add fix_OpenSSL111c.patch patch to ensure compatibility with OpenSSL 1.1.1c. gl#m2crypto/m2crypto#258 and jsc#SLE-9135. - Replace fix_OpenSSL111c.patch with proper new release 0.35.1 (there is really not much more in it; bsc#1149792). - Update to fix release 0.35.2 ... just fixing the test suite (bsc#1172226). - in python3.8 the fp is wrapped in a Buffer. SSL.Connection.makefile returns a socketIO which is no buffer. Added: 001-fix-buffering-for-python38.patch - Do not pull in py2 pkg on doc subpkg Update to 0.36.0: - wrap SocketIO in io.Buffered* for makefile <lethliel> - SSL.Connection.close accepts an argument to force the socket closing <Christophe Haen> - SSL.Connection: make the clientPostConnectionCheck an instance attribute <Christophe Haen> - Fixed bug with usage of unexisting method getreply at SSL_Transport <roman-nagaev> - Add appveyor builds for python 3.7 and 3.8 <Daniel A. Wozniak> - Fixed syntax warning on line 44. <randomfox> - Update M2Crypto.six to 1.13.0 <Matěj Cepl> - base64.decodestring() was finally removed in Python 3.8. <Matěj Cepl> - wrap SocketIO in io.Buffered* for makefile <lethliel> - NULL is legal argument for key and iv paramters of EVP_CipherInit(3) <Matěj Cepl> - Expose X509_V_FLAG_ALLOW_PROXY_CERTS verification flag and X509_STORE_SET_FLAGS function <Christophe Haen> - Stop testing for 2.6 and 3.4 on Travis. Start testing 3.8 <Matěj Cepl> - Extend test cert validity to 2049 <Bernhard M. Wiedemann> - Revert using typing module in 2.6. It is just not worthy. <Matěj Cepl> - Update Debian/stable SSL as well <Matěj Cepl> - Make tests pass again. <Matěj Cepl> - Stop using string module, which has been deprecated. <Matěj Cepl> - Tiny fixes to make pyls more happy <Matěj Cepl> - CI: Rework Fedora CI configuration <Neal Gompa> - Remove upstream merged patch 001-fix-buffering-for-python38.patch. - Update to 0.37.1: - Remove support for CentOS 6 and Python 2.6 (remove tests.vendor module). Python 2.7 is still fully supported. - Remodel CI: - on GitHub switched from Travis-CI to GH Actions - on GitLab-CI: stop testing 2.7 on Fedora, add centos7 - update appveyor.yml - Stop playing with swig in setup.py, we don't support swig 1.* anymore. - Fix dereferencing of pointers (gl#m2crypto/m2crypto#281) - Replace deprecated PyObject_AsReadBuffer with our own shim (thanks to Casey Deccio for saving my bacon there). - Use parametrized to create parametrized tests (new external dependency). - Only use DigestSign() and DigestUpdate() with OpenSSL >= 1.1.1 - Expose all the X509_V_FLAG - Add support for DigestSign* and DigestVerify* - Dr. Strangelove or: How I Learned to Stop Worrying and Love pytest - Add source signature file - OpenSSL allows the verificaton to continue on UNABLE_TO_VERIFY_LEAF_SIGNATURE * This unifies the behaviour of a single certificate with an unknown CA certificate with a self-signed certificate. - Add python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch (Thanks for Debian, https://salsa.debian.org/python-team/packages/m2crypto/-/commit/e0e9ad5cfff8) - Add 293_sslv23_padding.patch to avoid using RSA_SSLV23_PADDING (gl#m2crypto/m2crypto#293, gh#openssl/openssl#14216). - Add no-need-parameterized.patch ... we don't need run-time requirement of parameterized package (bsc#1185150). - Update to 0.38.0: - Remove the last use of setup.py test idiom. - Use m2_PyObject_AsReadBuffer instead of PyObject_AsReadBuffer. - Add support for arm64 big endian <Steev Klimaszewski> - Make support of RSA_SSLV23_PADDING optional (it has been deprecated). - Move project to src/ layout - Allow verify_cb_* to be called with ok=True <Casey Deccio> - Be prepared if any of constants in x509_vfy.h is not available. - But we do support 3.8 - We DO NOT support Python 2.6. - All patches were upstreamed: - 293_sslv23_padding.patch - no-need-parameterized.patch - python-M2Crypto-Allow-on-UNABLE_TO_VERIFY_LEAF_SIGNATURE.patch - Add missing bug references to this changelog. - Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657, bsc#1178829), which mitigates the Bleichenbacher timing attacks in the RSA decryption API. - Add python-M2Crypto.keyring to verify GPG signature of tarball. - update CVE-2020-25657-Bleichenbacher-attack.patch to actually contain the fix rather than just being empty (CVE-2020-25657, bsc#1178829) - add openssl-stop-parsing-header.patch (bsc#1205042) - add m2crypto-0.38-ossl3-tests.patch - Adapt tests for OpenSSL v3.1.0 * Add openssl-adapt-tests-for-3.1.0.patch - add timeout_300hz.patch to accept a small deviation from time in the testsuite (bsc#1212757) - Disable broken tests with openssl 3.2, bsc#1217782 - Update to 3.12 - Adding an implicit resolver to a derived loader should not affect the base loader (fixes issue #57). - Uniform representation for OrderedDict? across different versions of Python (fixes issue #61). - Fixed comparison to None warning (closes issue #64). - fix Source URL - update for multipython build - Use pythonhosted.org for the reference link. - Provide python-yaml instead of python2-yaml again. - update to 3.13 * fix compactibility with python 3.7 - Use %license instead of %doc [bsc#1082318] - Update to 5.1: * many changes, see CHANGES * bsc#1099308 CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code - update to 5.1.1 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8 - update to 5.1.2 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+ - update to 5.2 * A more flexible fix for custom tag constructors * Change default loader for yaml.add_constructor * Change default loader for add_implicit_resolver, add_path_resolver * Move constructor for object/apply to UnsafeConstructor * Fix logic for quoting special characters - update to 5.3 * Use `is` instead of equality for comparing with `None` * fix typos and stylistic nit * Fix up small typo * Fix handling of __slots__ * Allow calling add_multi_constructor with None * Add use of safe_load() function in README * Fix reader for Unicode code points over 0xFFFF * Enable certain unicode tests when maxunicode not > 0xffff * Use full_load in yaml-highlight example * Document that PyYAML is implemented with Cython * Fix for Python 3.10 * increase size of index, line, and column fields * remove some unused imports * Create timezone-aware datetimes when parsed as such * Add tests for timezone - update to 5.3.1 * fixes boo#1165439 (cve-2020-1747) Prevents arbitrary code execution during python/object/new constructor - update to 5.4.1 (bsc#1174514, CVE-2020-14343): * Fix stub compat with older pyyaml versions that may unwittingly load it * Build modernization, remove distutils, fix metadata, build wheels, CI to GHA * Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader * Fix memory leak in implicit resolver setup * Fix py2 copy support for timezone objects * Fix compatibility with Jython - reenable the cython yaml loader (bsc#1225641) - Update to 3.12 - Adding an implicit resolver to a derived loader should not affect the base loader (fixes issue #57). - Uniform representation for OrderedDict? across different versions of Python (fixes issue #61). - Fixed comparison to None warning (closes issue #64). - fix Source URL - update for multipython build - Use pythonhosted.org for the reference link. - Provide python-yaml instead of python2-yaml again. - update to 3.13 * fix compactibility with python 3.7 - Use %license instead of %doc [bsc#1082318] - Update to 5.1: * many changes, see CHANGES * bsc#1099308 CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code - update to 5.1.1 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8 - update to 5.1.2 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+ - update to 5.2 * A more flexible fix for custom tag constructors * Change default loader for yaml.add_constructor * Change default loader for add_implicit_resolver, add_path_resolver * Move constructor for object/apply to UnsafeConstructor * Fix logic for quoting special characters - update to 5.3 * Use `is` instead of equality for comparing with `None` * fix typos and stylistic nit * Fix up small typo * Fix handling of __slots__ * Allow calling add_multi_constructor with None * Add use of safe_load() function in README * Fix reader for Unicode code points over 0xFFFF * Enable certain unicode tests when maxunicode not > 0xffff * Use full_load in yaml-highlight example * Document that PyYAML is implemented with Cython * Fix for Python 3.10 * increase size of index, line, and column fields * remove some unused imports * Create timezone-aware datetimes when parsed as such * Add tests for timezone - update to 5.3.1 * fixes boo#1165439 (cve-2020-1747) Prevents arbitrary code execution during python/object/new constructor - update to 5.4.1 (bsc#1174514, CVE-2020-14343): * Fix stub compat with older pyyaml versions that may unwittingly load it * Build modernization, remove distutils, fix metadata, build wheels, CI to GHA * Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader * Fix memory leak in implicit resolver setup * Fix py2 copy support for timezone objects * Fix compatibility with Jython - reenable the cython yaml loader (bsc#1225641) - Update to 3.12 - Adding an implicit resolver to a derived loader should not affect the base loader (fixes issue #57). - Uniform representation for OrderedDict? across different versions of Python (fixes issue #61). - Fixed comparison to None warning (closes issue #64). - fix Source URL - update for multipython build - Use pythonhosted.org for the reference link. - Provide python-yaml instead of python2-yaml again. - update to 3.13 * fix compactibility with python 3.7 - Use %license instead of %doc [bsc#1082318] - Update to 5.1: * many changes, see CHANGES * bsc#1099308 CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code - update to 5.1.1 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8 - update to 5.1.2 * Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+ - update to 5.2 * A more flexible fix for custom tag constructors * Change default loader for yaml.add_constructor * Change default loader for add_implicit_resolver, add_path_resolver * Move constructor for object/apply to UnsafeConstructor * Fix logic for quoting special characters - update to 5.3 * Use `is` instead of equality for comparing with `None` * fix typos and stylistic nit * Fix up small typo * Fix handling of __slots__ * Allow calling add_multi_constructor with None * Add use of safe_load() function in README * Fix reader for Unicode code points over 0xFFFF * Enable certain unicode tests when maxunicode not > 0xffff * Use full_load in yaml-highlight example * Document that PyYAML is implemented with Cython * Fix for Python 3.10 * increase size of index, line, and column fields * remove some unused imports * Create timezone-aware datetimes when parsed as such * Add tests for timezone - update to 5.3.1 * fixes boo#1165439 (cve-2020-1747) Prevents arbitrary code execution during python/object/new constructor - update to 5.4.1 (bsc#1174514, CVE-2020-14343): * Fix stub compat with older pyyaml versions that may unwittingly load it * Build modernization, remove distutils, fix metadata, build wheels, CI to GHA * Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader * Fix memory leak in implicit resolver setup * Fix py2 copy support for timezone objects * Fix compatibility with Jython - reenable the cython yaml loader (bsc#1225641) - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Version 5.0.0 - Support new Azure metadata API (bsc#1164818, bsc#1164819) - Automatically detect root device (bsc#1158698, bsc#1158707) - Version 5.0.1 - Use lsblk for root device detection (bsc#1169921) - Version 5.1.0 - Produce well-formed JSON and XML output when multiple filters are specified (bsc#1170598, bsc#1170599) - Update to version 5.1.2 (bsc#1173357, bsc#1174847) + Detect when the VM is running in ASM (Azure Classic) and handle the condition to generate the data we are interested in without requiring access to the full IMDS available only in ARM instances. - From version 5.1.1 (bsc#1173238, bsc#1173240) + Add --listapis and --api latest support - Fix provides directive (bsc#1175609, bsc#1175610) + The provides directive must set a version or update does not work as expected - Fix provides directive (bsc#1175609, bsc#1175610) + The provides directive must set a version or update does not work as expected - Version 5.1.4 (bsc#1184720, bsc#1172581) + Use versions endpoint to list the available versions + Add bypass proxy + Update way to check classic vms - Version 5.1.5 (bsc#1194663) + Handle lsblk output format change. The json data now contains "mountpoints" instead of "mountpoint" - Version 5.1.6 Fix empty list attributes (bsc#1218760) - Version 5.0.0 - Support new Azure metadata API (bsc#1164818, bsc#1164819) - Automatically detect root device (bsc#1158698, bsc#1158707) - Version 5.0.1 - Use lsblk for root device detection (bsc#1169921) - Version 5.1.0 - Produce well-formed JSON and XML output when multiple filters are specified (bsc#1170598, bsc#1170599) - Update to version 5.1.2 (bsc#1173357, bsc#1174847) + Detect when the VM is running in ASM (Azure Classic) and handle the condition to generate the data we are interested in without requiring access to the full IMDS available only in ARM instances. - From version 5.1.1 (bsc#1173238, bsc#1173240) + Add --listapis and --api latest support - Fix provides directive (bsc#1175609, bsc#1175610) + The provides directive must set a version or update does not work as expected - Fix provides directive (bsc#1175609, bsc#1175610) + The provides directive must set a version or update does not work as expected - Version 5.1.4 (bsc#1184720, bsc#1172581) + Use versions endpoint to list the available versions + Add bypass proxy + Update way to check classic vms - Version 5.1.5 (bsc#1194663) + Handle lsblk output format change. The json data now contains "mountpoints" instead of "mountpoint" - Version 5.1.6 Fix empty list attributes (bsc#1218760) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Update to version 2.3.0 * Added support for CP932 detection (thanks to @hashy) * Fixed an issue where UTF-8 with a BOM would not be detected as UTF-8-SIG (#8) * Modified chardetect to use argparse for argument parsing * Moved docs to a gh-pages branch. You can now access them at http://chardet.github.io - Changelog on https://github.com/chardet/chardet/commits/2.3.0 - Other minor changes - specfile: * added update alternative to prevent conflicts with python3 version * add tests - Include in SLE 12 (bsc#1002895, FATE#321630) - Converted to single spec. - do not use %py_ver, replace with %python_version - update to 3.0.4 - fix source link - add update-alternative support for py2/py3 coinstallability - Fix build for Leap-42.3 - add update-alternatives post-requires - Fix update-alternative in %postun, bsc#1218765 - Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249). - Readjust patches: - bpo-31046_ensurepip_honours_prefix.patch - decimal.patch - python-3.3.0b1-fix_date_time_compiler.patch - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Don't use OpenSSL 1.1 on platforms which don't have it. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Don't use appstream-glib on SLE-12. - Use Python 2-based Sphinx on SLE-12. - No documentation on SLE-12. - Add skip_SSL_tests.patch skipping tests because of patched OpenSSL (bpo#9425). - Rename 22198.patch into more descriptive remove-sphinx40-warning.patch. - Add patch support-expat-245.patch: * Support Expat >= 2.4.5 - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update bundled pip wheel to the latest SLE version patched against bsc#1186819 (CVE-2021-3572). - Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the command injection in the mailcap module. - Rename support-expat-245.patch to support-expat-CVE-2022-25236-patched.patch to unify the patch with other packages. - Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests on s390x. - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) - Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix CVE-2020-10735 (bsc#1203125) to limit amount of digits converting text to int and vice vera (potential for DoS). Originally by Victor Stinner of Red Hat. - Add CVE-2022-37454-sha3-buffer-overflow.patch to fix bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer overflow in hashlib.sha3_* implementations (originally from the XKCP library). - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding extremely long domain names. - Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in the garbage collection (bsc#1188607). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Add bpo27321-email-no-replace-header.patch to stop email.generator.py from replacing a non-existent header (bsc#1208443, gh#python/cpython#71508). - Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329, bsc#1208471) blocklists bypass via the urllib.parse component when supplying a URL that starts with blank characters - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add bpo-44434-libgcc_s-for-pthread_cancel.patch which eliminates unnecessary and dangerous calls to PyThread_exit_thread() (bsc#1203355). - Use python3 modules to build the documentation. - Add CVE-2007-4559-filter-tarfile_extractall.patch to fix CVE-2007-4559 (bsc#1203750) by adding the filter for tarfile.extractall (PEP 706). - Add 99366-patch.dict-can-decorate-async.patch fixing gh#python/cpython#98086 (backport from Python 3.10 patch in gh#python/cpython!99366), fixing bsc#1211158. - Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing gh#python/cpython#108310, backport from upstream patch gh#python/cpython#108315 (bsc#1214692, CVE-2023-40217) - Refresh CVE-2023-27043-email-parsing-errors.patch to gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043). - (bsc#1219666, CVE-2023-6597) Add CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from gh#python/cpython!99930) fixing symlink bug in cleanup of tempfile.TemporaryDirectory. - Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into skip_SSL_tests.patch, and make them include all conditionals. - bsc#1221854 (CVE-2024-0450) Add CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch detecting the vulnerability of the "quoted-overlap" zipbomb (from gh#python/cpython!110016). - Add bh42369-thread-safety-zipfile-SharedFile.patch (from gh#python/cpython!26974) required by the previous patch. - Add expat-260-test_xml_etree-reparse-deferral.patch to make the interpreter work with patched libexpat in our distros. - Move all patches from locally sourced to the branch opensuse-3.6 branch at GitHub repo, and move all metadata to commits themselves (readable in the headers of each patch). - Add bpo-41675-modernize-siginterrupt.patch to make Python build cleanly even on more recent SPs of SLE-15 (gh#python/cpython#85841). - Remove patches: - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this patch is redundant on all SUSE-supported distros - python-3.3.0b1-test-posix_fadvise.patch - protection against the kernel issues which has been fixed in gh#torvalds/linux@3d3727cdb07f, which has been included in all our kernels more recent than SLE-11. - python-3.3.3-skip-distutils-test_sysconfig_module.patch - skips a test, which should be relevant only for testing on Mac OS X systems with universal builds. I have no valid record, that this test would be ever problematic on Linux. - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was included already in Python 3.5. - Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109, gh#python/cpython!16557) fixes syslog making default "ident" from sys.argv[0]. - Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that it uses features sniffing, not just comparing version number (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075). - Remove support-expat-CVE-2022-25236-patched.patch, which was the previous name of this patch. - Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping failing tests. - Refresh patches: - CVE-2023-27043-email-parsing-errors.patch - fix_configure_rst.patch - skip_if_buildbot-extend.patch - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch fixing bsc#1226447 (CVE-2024-0397) by removing memory race condition in ssl.SSLContext certificate store methods. - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448 (CVE-2024-4032) rearranging definition of private v global IP addresses. - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more. - Add CVE-2024-6923-email-hdr-inject.patch to prevent email header injection due to unquoted newlines (bsc#1228780, CVE-2024-6923). - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic complexity in parsing cookies with backslashes (bsc#1229596, CVE-2024-7592) - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Add CVE-2024-5642-switch-off-NPN.patch switching off the NPN support eliminating bsc#1227233 (CVE-2024-5642). - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch prevent ReDos via excessive backtracking while parsing header values (bsc#1230227, CVE-2024-6232). - Drop .pyc files from docdir for reproducible builds (bsc#1230906). - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote path names provided when creating a virtual environment (bsc#1232241, CVE-2024-9287) - Add CVE-2024-11168-validation-IPv6-addrs.patch fixing bsc#1233307 (CVE-2024-11168, gh#python/cpython#103848): Improper validation of IPv6 and IPvFuture addresses. - Remove -IVendor/ from python-config boo#1231795 - Fix CVE-2024-11168-validation-IPv6-addrs.patch - PGO run of build freezes with parallel processing, switch to -j1 - Update to 2.3.1: * updated tests for upstream wycheproof changes * many other tiny test tweaks - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Update to 2.3.1: * updated tests for upstream wycheproof changes * many other tiny test tweaks - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Update to 2.3.1: * updated tests for upstream wycheproof changes * many other tiny test tweaks - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Update to 2.3.1: * updated tests for upstream wycheproof changes * many other tiny test tweaks - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Update to 2.3.1: * updated tests for upstream wycheproof changes * many other tiny test tweaks - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Add CVE-2023-49083.patch to fix A null-pointer-dereference and segfault could occur when loading certificates from a PKCS#7 bundle. bsc#1217592 - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Add CVE-2023-49083.patch to fix A null-pointer-dereference and segfault could occur when loading certificates from a PKCS#7 bundle. bsc#1217592 - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Add CVE-2023-49083.patch to fix A null-pointer-dereference and segfault could occur when loading certificates from a PKCS#7 bundle. bsc#1217592 - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Add CVE-2023-49083.patch to fix A null-pointer-dereference and segfault could occur when loading certificates from a PKCS#7 bundle. bsc#1217592 - Fix fdupes call - Update to 2.4.1: * Dropped support for LibreSSL 2.4.x. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by the OpenSSL project. At this time there is no time table for dropping support, however we strongly encourage all users to upgrade or install cryptography from a wheel. * Added initial :doc:`OCSP </x509/ocsp>` support. * Added support for cryptography.x509.PrecertPoison. - Update to version 2.4.2: * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.0j. - Dependency on python-idna changed to "Recommends" aligned with change in upstream source (see below) - update to 2.5: * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1, but this version removes the default idna dependency as well. If you still need this deprecated path please install cryptography with the idna extra: pip install cryptography[idna]. * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4. * Numerous classes and functions have been updated to allow bytes-like types for keying material and passwords, including symmetric algorithms, AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a. * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1. * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1. * Added support for X448 key exchange when using OpenSSL 1.1.1. * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1. * Added initial support for parsing PKCS12 files with load_key_and_certificates(). * Added support for IssuingDistributionPoint. * Added rfc4514_string() method to x509.Name, x509.RelativeDistinguishedName, and x509.NameAttribute to format the name or component an RFC 4514 Distinguished Name string. * Added from_encoded_point(), which immediately checks if the point is on the curve and supports compressed points. Deprecated the previous method from_encoded_point(). * Added signature_hash_algorithm to OCSPResponse. * Updated X25519 key exchange support to allow additional serialization methods. Calling public_bytes() with no arguments has been deprecated. * Added support for encoding compressed and uncompressed points via public_bytes(). Deprecated the previous method encode_point(). - update to 2.6.1: * BACKWARDS INCOMPATIBLE: Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature()instead. * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead. * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1b. * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer. * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer. * load_ssh_public_key() can now load ed25519 public keys. * Add support for easily mapping an object identifier to its elliptic curve class viaget_curve_for_oid(). * Add support for OpenSSL when compiled with the no-engine (OPENSSL_NO_ENGINE) flag. - Simplify the test execution to be more understandable - update to 2.7 * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface. The CMAC and HMAC APIs have not changed, but they are no longer registered as MACContext instances. * Removed support for running our tests with setup.py test. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305` when using OpenSSL 1.1.1 or newer. * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH in :meth:`Ed25519PublicKey.public_bytes <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>` . * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier` and deprecate passing an Extension object. - update to 2.8 * Added support for Python 3.8. * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations. * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9. * We now ship manylinux2010 wheels in addition to our manylinux1 wheels. * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder. * cryptography no longer depends on asn1crypto. * FreshestCRL is now allowed as a CertificateRevocationList extension. - update to 2.9.2 * 2.9.2 - 2020-04-22 - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15. * 2.9.1 - 2020-04-21 - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g. * 2.9 - 2020-04-02 - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed. Users on older version of OpenSSL will need to upgrade. - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed. - Removed support for calling public_bytes() with no arguments, as per our deprecation policy. You must now pass encoding and format. - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string() returns the RDNs as required by RFC 4514. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f. - Added support for parsing single_extensions in an OCSP response. - NameAttribute values can now be empty strings. - update to 3.0 - refreshed disable-uneven-sizes-tests.patch and skip_openssl_memleak_test.patch * Removed support for passing an Extension instance to from_issuer_subject_key_identifier(), as per our deprecation policy. * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer. * RSA generate_private_key() no longer accepts public_exponent values except 65537 and 3 (the latter for legacy purposes). * X.509 certificate parsing now enforces that the version field contains a valid value, rather than deferring this check until version is accessed. * Deprecated support for Python 2 * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa private keys: load_ssh_private_key() for loading and OpenSSH for writing. * Added support for OpenSSH certificates to load_ssh_public_key(). * Added encrypt_at_time() and decrypt_at_time() to Fernet. * Added support for the SubjectInformationAccess X.509 extension. * Added support for parsing SignedCertificateTimestamps in OCSP responses. * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid(). * Added support for encoding attributes in certificate signing requests via add_attribute(). * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG instead of its own OS random engine because these versions of OpenSSL properly reseed on fork. * Added initial support for creating PKCS12 files with serialize_key_and_certificates(). - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.2 (bsc#1178168, CVE-2020-25659): * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - Remove unnecessary dependency virtualenv. - update to 3.3.0 - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed due to low usage and maintenance burden. - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change is to conform with an upcoming OpenSSL release that will no longer support sizes outside this window. - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we now raise ValueError rather than UnsupportedAlgorithm when an unsupported cipher is used. This change is to conform with an upcoming OpenSSL release that will no longer distinguish between error types. - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing. - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1i. - Python 2 support is deprecated in cryptography. This is the last release that will support Python 2. - Added the recover_data_from_signature() function to RSAPublicKey for recovering the signed data from an RSA signature. - update to 3.3.1: * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use - update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331): * SECURITY ISSUE: Fixed a bug where certain sequences of update() calls when symmetrically encrypting very large payloads (>2GB) could result in an integer overflow, leading to buffer overflows. CVE-2020-36242 - drops CVE-2020-36242-buffer-overflow.patch on older dists - Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931) * Don't allow update_into to mutate immutable objects - Add CVE-2023-49083.patch to fix A null-pointer-dereference and segfault could occur when loading certificates from a PKCS#7 bundle. bsc#1217592 - Initial package 0.7.1 - Minimal cleanup - updated to 0.8 Changelog (http://pythonhosted.org/cssselect/#changelog): Released on 2013-03-15. Improvements: [#22] Let extended translators override what XPathExpr class is used [#19] Use the built-in lang() XPath function for implementing the :lang() pseudo-class with XML documents. This is probably faster than ancestor-or-self::. Bug fixes: [#14] Fix non-ASCII pseudo-classes. (Invalid selector instead of crash.) [#20] As per the spec, elements containing only whitespace are not considered empty for the :empty pseudo-class. - Packaged LICENSE file fixes bnc#828513 Bug 828513 - LICENSE not packaged in python3-cssselect 0.8 - Update to version 0.9.1 + **Backward incompatible change from 0.9**: :meth:`~GenericTranslator.selector_to_xpath` defaults to ignoring pseudo-elements, as it did in 0.8 and previous versions. (:meth:`~GenericTranslator.css_to_xpath` doesn’t change.) + Drop official support for Python 2.4 and 3.1, as testing was becoming difficult. Nothing will break overnight, but future releases may on may not work on these versions. Older releases will remain available on PyPI. - Changes from 0.9 + Add parser support for :attr:`functional pseudo-elements <Selector.pseudo_element>`. + This version accidentally introduced a backward incompatible change: :meth:`~GenericTranslator.selector_to_xpath` defaults to rejecting pseudo-elements instead of ignoring them. - Remove useless CFLAGS definition - Add README.rst, CHANGES and AUTHORS in package documentation - update to 1.0.1: * Add support for Python 3.6. * Documentation hosted `on Read the Docs <https://cssselect.readthedocs.io/>`_ * Add code coverage reports. * Fix ``:nth-*(an+b)`` pseudo-classes selectors. (except ``*:nth-child()`` which looks untranslatable to XPath 1.0.) * Distribute as universal wheel. * Add support for Python 3.3, 3.4 and 3.5. * Drop support for Python 2.5 as testing is getting difficult. * Improve tests on pseudo-elements. - Switch to singlespec approach - specfile: * update copyright year - update to version 1.0.3: * Fix artifact uploads to pypi - changes from version 1.0.2: * Drop support for Python 2.6 and Python 3.3. * Fix deprecation warning in Python 3.6. * Minor cleanups. - Initial package 0.7.1 - Minimal cleanup - updated to 0.8 Changelog (http://pythonhosted.org/cssselect/#changelog): Released on 2013-03-15. Improvements: [#22] Let extended translators override what XPathExpr class is used [#19] Use the built-in lang() XPath function for implementing the :lang() pseudo-class with XML documents. This is probably faster than ancestor-or-self::. Bug fixes: [#14] Fix non-ASCII pseudo-classes. (Invalid selector instead of crash.) [#20] As per the spec, elements containing only whitespace are not considered empty for the :empty pseudo-class. - Packaged LICENSE file fixes bnc#828513 Bug 828513 - LICENSE not packaged in python3-cssselect 0.8 - Update to version 0.9.1 + **Backward incompatible change from 0.9**: :meth:`~GenericTranslator.selector_to_xpath` defaults to ignoring pseudo-elements, as it did in 0.8 and previous versions. (:meth:`~GenericTranslator.css_to_xpath` doesn’t change.) + Drop official support for Python 2.4 and 3.1, as testing was becoming difficult. Nothing will break overnight, but future releases may on may not work on these versions. Older releases will remain available on PyPI. - Changes from 0.9 + Add parser support for :attr:`functional pseudo-elements <Selector.pseudo_element>`. + This version accidentally introduced a backward incompatible change: :meth:`~GenericTranslator.selector_to_xpath` defaults to rejecting pseudo-elements instead of ignoring them. - Remove useless CFLAGS definition - Add README.rst, CHANGES and AUTHORS in package documentation - update to 1.0.1: * Add support for Python 3.6. * Documentation hosted `on Read the Docs <https://cssselect.readthedocs.io/>`_ * Add code coverage reports. * Fix ``:nth-*(an+b)`` pseudo-classes selectors. (except ``*:nth-child()`` which looks untranslatable to XPath 1.0.) * Distribute as universal wheel. * Add support for Python 3.3, 3.4 and 3.5. * Drop support for Python 2.5 as testing is getting difficult. * Improve tests on pseudo-elements. - Switch to singlespec approach - specfile: * update copyright year - update to version 1.0.3: * Fix artifact uploads to pypi - changes from version 1.0.2: * Drop support for Python 2.6 and Python 3.3. * Fix deprecation warning in Python 3.6. * Minor cleanups. - update to 1.11.1: * fix syntax error exception on dns server failure * various fixlets for DNSSEC support - update to 1.12.0: * The test system can now run the tests without requiring dnspython to be installed. * When reading from a masterfile, if the first content line started with leading whitespace, we raised an ugly exception instead of doing the right thing, namely using the zone origin as the name. [#73] Thanks to Tassatux for reporting the issue. * Added dns.zone.to_text() convenience method. Thanks to Brandon Whaley <redkrieg@gmail.com> for the patch. * The /etc/resolv.conf setting "options rotate" is now understood by the resolver. If present, the resolver will shuffle the nameserver list each time dns.resolver.query() is called. Thanks to underrun for the patch. Note that you don't want to add "options rotate" to your /etc/resolv.conf if your system's resolver library does not understand it. In this case, just set resolver.rotate = True by hand. * Escaping of Unicode has been corrected. Previously we escaped and then converted to Unicode, but the right thing to do is convert to Unicode, then escape. Also, characters > 0x7f should NOT be escaped in Unicode mode. Thanks to Martin Basti for the patch. * dns.rdtypes.ANY.DNSKEY now has helpers functions to convert between the numeric form of the flags and a set of human-friendly strings. Thanks to Petr Spacek for the patch. * RRSIGs did not respect relativization settings in to_text(). Thanks to Brian Smith for reporting the bug and submitting a (slightly different) patch. * dns/rdtypes/IN/APL.py: The APL from_wire() method did not accept an rdata length of 0 as valid. Thanks to salzmdan for reporting the problem. * dns/ipv6.py: Add is_mapped() * dns/reversename.py: Lookup IPv6 mapped IPv4 addresses in the v4 reverse namespace. Thanks to Devin Bayer. Yes, I finally fixed this one :) * dns/zone.py: Do not put back an unescaped token. This was causing escape processing for domain names to break. Thanks to connormclaud for reporting the problem. * dns/message.py: Making a response didn't work correctly if the query was signed with TSIG and we knew the key. Thanks to Jeffrey Stiles for reporting the problem. * dns/query.py: Fix problems with the IXFR state machine which caused long diffs to fail. Thanks to James Raftery for the fix and the repeated prodding to get it applied :) - enable some tests - add python-dnspython-rpmlintrc file - add python-ecdsa and python-pycrypto to BuildRequires for the DNSSec tests - use /usr/bin/python instead of /usr/bin/env python for the example scripts to avoid additional dependencies - fix build on SLE11 - New upstream release 1.13.0 - New upstream release 1.14.0 - New upstream release 1.15.0 * IDNA 2008 support is now available if the "idna" module has been installed and IDNA 2008 is requested. The default IDNA behavior is still IDNA 2003. The new IDNA codec mechanism is currently only useful for direct calls to dns.name.from_text() or dns.name.from_unicode(), but in future releases it will be deployed throughout dnspython, e.g. so that you can read a masterfile with an IDNA 2008 codec in force. * By default, dns.name.to_unicode() is not strict about which version of IDNA the input complies with. Strictness can be requested by using one of the strict IDNA codecs. * Add AVC RR support. * Some problems with newlines in various output modes have been addressed. * dns.name.to_text() now returns text and not bytes on Python 3.x * More miscellaneous fixes for the Python 2/3 codeline merge. - Include readme with readme.patch as not included in upstream tarball - Fix a bug in the tests code with 210.patch with upstream pull request #210 - use and recommend python-ecdsa and python-pycrypto for dnssec support - Update for the multipython build. - Rename python-dnspython.asc to python-dnspython.keyring. - Spec cleanup. - Add new patches to solve DoS: - CVE-2023-29483-pre1.patch - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) - Fix CVE-2023-29483-pre1.patch (bsc#1230353, gh#rthalley/dnspython@6d590f0a2e1b, gh#nrhall/dnspython@55d6a9d81930) - Package LICENSE, use proper upstream URL - Run testsuite - Cleanup macro usage - update to 1.11.1: * fix syntax error exception on dns server failure * various fixlets for DNSSEC support - update to 1.12.0: * The test system can now run the tests without requiring dnspython to be installed. * When reading from a masterfile, if the first content line started with leading whitespace, we raised an ugly exception instead of doing the right thing, namely using the zone origin as the name. [#73] Thanks to Tassatux for reporting the issue. * Added dns.zone.to_text() convenience method. Thanks to Brandon Whaley <redkrieg@gmail.com> for the patch. * The /etc/resolv.conf setting "options rotate" is now understood by the resolver. If present, the resolver will shuffle the nameserver list each time dns.resolver.query() is called. Thanks to underrun for the patch. Note that you don't want to add "options rotate" to your /etc/resolv.conf if your system's resolver library does not understand it. In this case, just set resolver.rotate = True by hand. * Escaping of Unicode has been corrected. Previously we escaped and then converted to Unicode, but the right thing to do is convert to Unicode, then escape. Also, characters > 0x7f should NOT be escaped in Unicode mode. Thanks to Martin Basti for the patch. * dns.rdtypes.ANY.DNSKEY now has helpers functions to convert between the numeric form of the flags and a set of human-friendly strings. Thanks to Petr Spacek for the patch. * RRSIGs did not respect relativization settings in to_text(). Thanks to Brian Smith for reporting the bug and submitting a (slightly different) patch. * dns/rdtypes/IN/APL.py: The APL from_wire() method did not accept an rdata length of 0 as valid. Thanks to salzmdan for reporting the problem. * dns/ipv6.py: Add is_mapped() * dns/reversename.py: Lookup IPv6 mapped IPv4 addresses in the v4 reverse namespace. Thanks to Devin Bayer. Yes, I finally fixed this one :) * dns/zone.py: Do not put back an unescaped token. This was causing escape processing for domain names to break. Thanks to connormclaud for reporting the problem. * dns/message.py: Making a response didn't work correctly if the query was signed with TSIG and we knew the key. Thanks to Jeffrey Stiles for reporting the problem. * dns/query.py: Fix problems with the IXFR state machine which caused long diffs to fail. Thanks to James Raftery for the fix and the repeated prodding to get it applied :) - enable some tests - add python-dnspython-rpmlintrc file - add python-ecdsa and python-pycrypto to BuildRequires for the DNSSec tests - use /usr/bin/python instead of /usr/bin/env python for the example scripts to avoid additional dependencies - fix build on SLE11 - New upstream release 1.13.0 - New upstream release 1.14.0 - New upstream release 1.15.0 * IDNA 2008 support is now available if the "idna" module has been installed and IDNA 2008 is requested. The default IDNA behavior is still IDNA 2003. The new IDNA codec mechanism is currently only useful for direct calls to dns.name.from_text() or dns.name.from_unicode(), but in future releases it will be deployed throughout dnspython, e.g. so that you can read a masterfile with an IDNA 2008 codec in force. * By default, dns.name.to_unicode() is not strict about which version of IDNA the input complies with. Strictness can be requested by using one of the strict IDNA codecs. * Add AVC RR support. * Some problems with newlines in various output modes have been addressed. * dns.name.to_text() now returns text and not bytes on Python 3.x * More miscellaneous fixes for the Python 2/3 codeline merge. - Include readme with readme.patch as not included in upstream tarball - Fix a bug in the tests code with 210.patch with upstream pull request #210 - use and recommend python-ecdsa and python-pycrypto for dnssec support - Update for the multipython build. - Rename python-dnspython.asc to python-dnspython.keyring. - Spec cleanup. - Add new patches to solve DoS: - CVE-2023-29483-pre1.patch - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) - Package LICENSE, use proper upstream URL - Run testsuite - Cleanup macro usage - update to 1.11.1: * fix syntax error exception on dns server failure * various fixlets for DNSSEC support - update to 1.12.0: * The test system can now run the tests without requiring dnspython to be installed. * When reading from a masterfile, if the first content line started with leading whitespace, we raised an ugly exception instead of doing the right thing, namely using the zone origin as the name. [#73] Thanks to Tassatux for reporting the issue. * Added dns.zone.to_text() convenience method. Thanks to Brandon Whaley <redkrieg@gmail.com> for the patch. * The /etc/resolv.conf setting "options rotate" is now understood by the resolver. If present, the resolver will shuffle the nameserver list each time dns.resolver.query() is called. Thanks to underrun for the patch. Note that you don't want to add "options rotate" to your /etc/resolv.conf if your system's resolver library does not understand it. In this case, just set resolver.rotate = True by hand. * Escaping of Unicode has been corrected. Previously we escaped and then converted to Unicode, but the right thing to do is convert to Unicode, then escape. Also, characters > 0x7f should NOT be escaped in Unicode mode. Thanks to Martin Basti for the patch. * dns.rdtypes.ANY.DNSKEY now has helpers functions to convert between the numeric form of the flags and a set of human-friendly strings. Thanks to Petr Spacek for the patch. * RRSIGs did not respect relativization settings in to_text(). Thanks to Brian Smith for reporting the bug and submitting a (slightly different) patch. * dns/rdtypes/IN/APL.py: The APL from_wire() method did not accept an rdata length of 0 as valid. Thanks to salzmdan for reporting the problem. * dns/ipv6.py: Add is_mapped() * dns/reversename.py: Lookup IPv6 mapped IPv4 addresses in the v4 reverse namespace. Thanks to Devin Bayer. Yes, I finally fixed this one :) * dns/zone.py: Do not put back an unescaped token. This was causing escape processing for domain names to break. Thanks to connormclaud for reporting the problem. * dns/message.py: Making a response didn't work correctly if the query was signed with TSIG and we knew the key. Thanks to Jeffrey Stiles for reporting the problem. * dns/query.py: Fix problems with the IXFR state machine which caused long diffs to fail. Thanks to James Raftery for the fix and the repeated prodding to get it applied :) - enable some tests - add python-dnspython-rpmlintrc file - add python-ecdsa and python-pycrypto to BuildRequires for the DNSSec tests - use /usr/bin/python instead of /usr/bin/env python for the example scripts to avoid additional dependencies - fix build on SLE11 - New upstream release 1.13.0 - New upstream release 1.14.0 - New upstream release 1.15.0 * IDNA 2008 support is now available if the "idna" module has been installed and IDNA 2008 is requested. The default IDNA behavior is still IDNA 2003. The new IDNA codec mechanism is currently only useful for direct calls to dns.name.from_text() or dns.name.from_unicode(), but in future releases it will be deployed throughout dnspython, e.g. so that you can read a masterfile with an IDNA 2008 codec in force. * By default, dns.name.to_unicode() is not strict about which version of IDNA the input complies with. Strictness can be requested by using one of the strict IDNA codecs. * Add AVC RR support. * Some problems with newlines in various output modes have been addressed. * dns.name.to_text() now returns text and not bytes on Python 3.x * More miscellaneous fixes for the Python 2/3 codeline merge. - Include readme with readme.patch as not included in upstream tarball - Fix a bug in the tests code with 210.patch with upstream pull request #210 - use and recommend python-ecdsa and python-pycrypto for dnssec support - Update for the multipython build. - Rename python-dnspython.asc to python-dnspython.keyring. - Spec cleanup. - Add new patches to solve DoS: - CVE-2023-29483-pre1.patch - CVE-2023-29483.patch (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044) - Update to 0.12 * docs/ref/rst/directives.txt - Update "math" and "csv-table" descriptions. * docutils/parsers/rst/directives/images.py - Fix [258] figwidth="image" generates unitless width value. * docutils/parsers/rst/states.py - Improve error report when a non-ASCII character is specified as delimiter, quote or escape character under Python 2. Fixes [ 249 ] and [ 250 ]. * docutils/writers/html4css1/__init__.py - Don't add newline after inline math. Thanks to Yury G. Kudryashov for the patch. * docutils/writers/latex2e/__init__.py - Fix [ 239 ] Latex writer glues paragraphs with figure floats. - Apply [ 116 ] by Kirill Smelkov. Don't hardcode \large for subtitle. * docutils/writers/odf_odt/__init__.py - Apply patch by Jakub Wilk to fix bug [ 100 ]. * test/test_error_reporting.py - Fix [ 223 ] by removing redundant tests we do not have control over. * test/test_nodes.py - Apply [ 115 ] respect fixed 2to3 string literal conversion behavior. - fix bashisms in pre script - Fix update-alternatives implementation. - update to 0.13.1: * New HTML writer generating HTML 5. * languages: persian/farsi (fa) and latvian (la) mappings. * change default base url for :rfc: to http://tools.ietf.org/html/ latex2e: Fix admonition width, remove deprecated options, better tablewidth auto, ... - Converted to single-spec - Added python-docutils-rpmlintrc - Fix url - Executables are python-independent so only have the python3 version provide them. - Implement update-alternatives to avoid conflict with rst2html5 - Make only the python2 package provide the "docutils" package. - only emit rst2html5 alternatives for python 3 - switch the "docutils" provides to the python 3 package (all the comands live there) (this fixes bsc#1039394) - specfile: * add binary rst2html4 - update to version 0.14: * Enable validation of Docutils XML documents against the DTD: Use attribute type NMTOKEN instead of REFID for the `refid` attribute and NMTOKENS for `backrefs`: REFID refers to an ID type instance, however, the `ids` attribute cannot use the ID type because `XML only allows one ID per Element Type`__ and doesn't support a multiple-ID "IDS" attribute type. * Added documentation for escaped whitespace in URI contexts. * Clarify use of Unicode character categories. * Added functionality: escaped whitespace in URI contexts. * Consistent handling of all whitespace characters in inline markup recognition. Fixes [ 307 ] and [ 3402314 ] (now [ 173 ]). * Added support for escaped whitespace in URI contexts. * Rework patch [ 120 ] (revert change to "Table.get_column_widths()" that led to problems in an application with a custom table directive). * Fix [ 320 ] Russian docinfo fields not recognized. * Don't add a second ID to problematic references. * Fix SmartQuotes: warn only once if language is unsupported, keep "rawsource" when "educating" quotes. * Added "split_escaped_whitespace" function, support for escaped whitespace in URI contexts. * Fix [ 321 ] Import block might cause name error. * Update quote definitions for languages et, fi, fr, ro, sv, tr, uk. * New quote definitions for hr, hsb, hu, lv, sh, sl, sr. * Fix [ 313 ] Differentiate apostrophe from closing single quote (if possible). * Fix [ 317 ] Extra space inserted with French smartquotes. * Add command line interface for stand-alone use (requires 2.7). * Provide default title in metadata (required by HTML5). * Fix [ 312 ] HTML writer generates invalid HTML if the table has two tags. * Fix [ 319 ] The MathJax CDN shut down on April 30, 2017. For security reasons, we don't use a third party public installation as default but warn if math-output_ is set to MathJax without specifying a URL. * Apply [ 125 ] HTML writer: respect automatic table column sizing. * Handle class arguments for block-level elements by wrapping them in a "DUclass" environment. This replaces the special handling for "epigraph" and "topic" elements. * Apply [ 141 ] Handling inline in manpage writer. * Command setting "language" now sets the default language of the generated ODF document. * The use of image directive options :width: (%), :scale:, etc now set the width/height/size of images in the generated ODF documents. * The heading/title of admonitions now reflects the language specified by the "language" setting. * Fixed [ 306 ] only first of multiple "image" directives with the same URL shown in output. * Fixed [ 282 ] python3: AttributeError. * tools/rst2html4.py: New front-end. * tools/dev/generate_punctuation_chars.py: New skript to test and update utils.punctuation_chars. - Use update-alternatives for all binary scripts and provide /usr/bin/docutils to avoid conflict with python311-docutils bsc#1219501 - Initial package creation - update to version v2.5 * only store scripts that are specifically referenced in logic * Fix validation for U+30FB KATAKANA MIDDLE DOT code point (#47) * range-based integer containment code * Documentation Updates * Make test runners Python 2.6 compatible (issue #20) * remove DISALLOWED codepoints from datafile, since they're unread * Avoid using bare 'except' (#39) * Add Python 3.5 support * Mark Python Wheels as universal (supports Python 2 and 3) * Skip tests that won't work on Python 2.6 (fixes #20) * Update Travis configuration to test against Python 2.6 and 3.6 * Use relative imports (fixes #26) * Documentation tidy up * Revert to basing IDNAError on UnicodeError (issue #43) (#45) * rebuild idnadata * Update history with Java-related change * ignore vim swapfiles * Update Travis CI coverage to 3.6 and 3.7-dev * Reduce memory usage even further. (#41) * Update trove classifier for Python 3.6 * Properly report label length exceptions (issue #36) * Segment uts46data to avoid Jython limits (#28) - Switch to singlespec approach - point download url to PyPI - drop %oname - update to version 2.6: * Allows generation of IDNA and UTS 46 table data for different versions of Unicode, by deriving properties directly from Unicode data. * Ability to generate RFC 5892/IANA-style table data * Diagnostic output of IDNA-related Unicode properties and derived calculations for a given codepoint * Support for idna.__version__ to report version * Support for idna.idnadata.__version__ and idna.uts46data.__version__ to report Unicode version of underlying IDNA and UTS 46 data respectively. - Add CVE-2024-3651.patch, backported from upstream commit gh#kjd/idna#172/commits/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7 (bsc#1222842, CVE-2024-3651) - Update to version 0.4.1 + No upstream changelog - Update to version 0.5.0 + No upstream changelog + Update in support for fix of bnc#905354 - Updated to version 0.6.1 + No Upstream Changelog - update to version 0.7.0: * Add support for JEP-12, raw string literals * Support .whl files - additional changes from version 0.6.2: * Implement JEP-10, slice projections * Fix bug with filter projection parsing * Add to_array function * Add merge function * Fix error messages for function argument type errors - point source URL to pypi - Update to version 0.7.1: * Rename ``bin/jp`` to ``bin/jp.py`` * Fix issue with precedence when parsing wildcard projections * Remove ordereddict and simplejson as py2.6 dependencies. These were never actually used in the jmespath code base, only in the unit tests. Unittests requirements are handled via requirements26.txt. - Manage the jp executable with update-alternatives now that python3-jmespath exists - spec file improvements - Fix build issues for SLE 11 + More test dependencies required - Update to version 0.9.0 * Add support for new lines with tokens in an expression * Add support for JEP 9 which introduces "and" expressions, "unary" expressions, "not" expressions, and "paren" expressions * Fix issue with hardcoded path in ``jp.py`` executable (issue 90, issue 88, issue 82) - Update to version 0.8.0 * Improve lexing performance (issue 84) * Fix parsing error for multiselect lists (issue 86) * Fix issue with escaping single quotes in literal strings (issue 85) * Add support for providing your own dict cls to support ordered dictionaries (issue 94) * Add map() function (issue 95) - Fix update-alternatives implementation. - Switch to single-spec build - Update to version 0.9.2 + Fix regression when using ordering comparators on strings (issue 124) - From 0.9.1 + Raise LexerError on invalid numbers (issue 98) + Add support for custom functions (#100) (issue 100) + Fix ZeroDivisionError for built-in function avg() on empty lists (#115) (issue 115) + Properly handle non numerical ordering operators (#117) (issue 117) - Only BuildRequire unittest2 for python2 - properly Requires(postun) for %postun section - Update to 0.9.3: + Fix issue where long types in py2 and Decimal types were not being evaluated as numbers (issue 125) + Handle numbers in scientific notation in to_number() function (issue 120) + Fix issue where custom functions would override the function table of the builtin function class (issue 133) - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security update: * [CVE-2023-45322, bsc#1216129] use-after-free in xmlUnlinkNode() in tree.c - Added file libxml2-CVE-2023-45322.patch - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader * Added libxml2-CVE-2024-25062.patch - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in xmlHTMLPrintFileContext in xmllint.c * Added libxml2-CVE-2024-34459.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Security fix: [bsc#1185410, CVE-2021-3517] * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal() * Add libxml2-CVE-2021-3517.patch - Security fix: [bsc#1185408, CVE-2021-3518] * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess() * Add libxml2-CVE-2021-3518.patch - Security fix: [bsc#1185698, CVE-2021-3537] * NULL pointer dereference in valid.c:xmlValidBuildAContentModel * Add libxml2-CVE-2021-3537.patch - Security fix: [bsc#1186015, CVE-2021-3541] * Exponential entity expansion attack bypasses all existing protection mechanisms. - Add libxml2-CVE-2021-3541.patch - Update to version 2.9.12 * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928) * Fix null deref in legacy SAX1 parser * Fix handling of unexpected EOF in xmlParseContent * Fix user-after-free * Validate UTF8 in xmlEncodeEntities * Fix memory leak in xmlParseElementMixedContentDecl * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin * Fix SEGV in xmlSAXParseFileWithData * Don't process siblings of root in xmlXIncludeProcess * Full changes: http://xmlsoft.org/news.html - Drop upstream fixed * libxml2-CVE-2021-3541.patch * libxml2-CVE-2021-3537.patch * libxml2-CVE-2021-3518.patch * libxml2-CVE-2021-3517.patch * libxml2-CVE-2021-3516.patch * libxml2-CVE-2020-7595.patch * libxml2-CVE-2019-20388.patch * libxml2-CVE-2020-24977.patch * libxml2-CVE-2019-19956.patch * libxml2-python39.patch * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch - Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch - Drop since 2.8.0 merged fix-perl.diff - Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch - Fix python-lxml regression with libxml2 2.9.12: * Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255 - Add upstream patches: * libxml2-fix-lxml-corrupted-subtree-structures.patch * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild. - Update to version 2.9.13: * Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues. * Many regressions fixes. * Numerous bug fixes, including, among many others: + xmllint's --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing. * Numerous tests and code and fuzzing fixes and improvements. * Updated documentation. - The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\ libxml2-2.9.13.news. - Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future. - Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with 'cp' command. - Update http://xmlsoft.org URL tag to Libxml2's new web home: https://gitlab.gnome.org/GNOME/libxml2. - Update ftp://xmlsoft.org Source tag to Libxml2's new download host: https://download.gnome.org. - Drop deprecated Python-2-related macro definitions/conditional statement from spec file. - Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch. - Drop libxml2.keyring source file as the new download host doesn't offer GPG signatures. - Use ldconfig_scriptlets macro for post(un) handling. - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap. - Update to 2.9.14: * Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent * Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex * Improvements: + Fix recovery from invalid HTML start tags * Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build - Update to 2.10.0: * Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case. * Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h * Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput() * Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it's missing on. + Don't add IDs containing unexpanded entity references * Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don't reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don't include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags * Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don't mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don't set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with "rb" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks * Build system + Don't autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don't overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml's pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don't try to recreate COPYING symlink + Detect libm using libtool's macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install *.html and *.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don't check for standard C89 library functions + Don't check for standard C89 headers + Remove special configuration for certain maintainers * Test suite, CI + Disable network in API tests + testapi: remove leading slash from "/missing.xml" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify 'make check' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3 * Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags - Update to version 2.10.1: * Regressions: Fix xmlCtxtReadDoc with encoding * Bug fixes: Fix HTML parser with threads and --without-legacy * Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c * Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml - Update to version 2.10.2: * Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning * Build system + build: require automake-1.16.3 or later + Remove generated files from distribution * Test suite: Don't create missing.xml when running testapi - Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files. - Use sed to fix env-script-interpreter in documentation example. - Pass with-ftp to configure, build ftp support. - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. - Add W3C conformance tests to the testsuite (bsc#1204585): * Added file xmlts20080827.tar.gz - Build also for modern python version (jsc#PED-68) - Remove unneeded dependency (bsc#1209918). - Security update: * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn't deterministic - Added patch libxml2-CVE-2023-29469.patch * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in xmlSchemaFixupComplexType - Added patch libxml2-CVE-2023-28484-1.patch - Added patch libxml2-CVE-2023-28484-2.patch - Security update: * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global buffer overflow - Added file libxml2-CVE-2023-39615.patch - Update to 4.4.1: * LP#1838252: The order of an OrderedDict was lost in 4.4.0 when passing it as attrib mapping during element creation. * LP#1838521: The package metadata now lists the supported Python versions. - Add lxml-libxml-2.9.10.patch: Fix build against libxml 2.9.10. - Update to 4.4.2: * LP#1835708: ElementInclude incorrectly rejected repeated non-recursive includes as recursive. * Remove patch lxml-libxml-2.9.10.patch which is now upstream - update to 4.5.0 * A new function indent() was added to insert tail whitespace for pretty-printing an XML tree. * LP#1857794 Tail text of nodes that get removed from a document using item deletion disappeared silently instead of sticking with the node that was removed. * LP#1840234: The package version number is now available as lxml.__version__ - Remove explicit Provides of python-doc, which is just wrong. - Update to 4.5.1 * LP#1570388: Fix failures when serialising documents larger than 2GB in some cases. * LP#1865141, GH#298: QName values were not accepted by the el.iter() method. Patch by xmo-odoo. * LP#1863413, GH#297: The build failed to detect libraries on Linux that are only configured via pkg-config. - update to 4.5.2: * ``Cleaner()`` now validates that only known configuration options can be set. * LP#1882606: ``Cleaner.clean_html()`` discarded comments and PIs regardless of the corresponding configuration option, if ``remove_unknown_tags`` was set. * LP#1880251: Instead of globally overwriting the document loader in libxml2, lxml now sets it per parser run, which improves the interoperability with other users of libxml2 such as libxmlsec. * LP#1881960: Fix build in CPython 3.10 by using Cython 0.29.21. * The setup options "--with-xml2-config" and "--with-xslt-config" were accidentally renamed to "--xml2-config" and "--xslt-config" in 4.5.1 and are now available again. - update to 4.6.2: * A vulnerability (CVE-2020-27783) was discovered in the HTML Cleaner by Yaniv Nizry, which allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content. (bsc#1179534) * A vulnerability was discovered in the HTML Cleaner by Yaniv Nizry, which allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content. * GH#310: ``lxml.html.InputGetter`` supports ``__len__()`` to count the number of input fields. Patch by Aidan Woolley. * ``lxml.html.InputGetter`` has a new ``.items()`` method to ease processing all input fields. * ``lxml.html.InputGetter.keys()`` now returns the field names in document order. * GH-309: The API documentation is now generated using ``sphinx-apidoc``. * LP#1869455: C14N 2.0 serialisation failed for unprefixed attributes when a default namespace was defined. * ``TreeBuilder.close()`` raised ``AssertionError`` in some error cases where it should have raised ``XMLSyntaxError``. It now raises a combined exception to keep up backwards compatibility, while switching to ``XMLSyntaxError`` as an interface. - update to 4.6.3: * A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung, which allowed JavaScript to pass through. The cleaner now removes the HTML5 ``formaction`` attribute. (bsc#1184177) - Adapt test_etree.py to a behavioural change in libxml2 2.9.11+ * Add python-lxml-test_etree.patch - Add missing dependency on python-base for the devel subpackage. - update to 4.6.4: * A new property ``system_url`` was added to DTD entities. * The ``STATIC_*`` variables in ``setup.py`` can now be passed via env vars. - remove python-lxml-test_etree.patch (upstream) - update to 4.6.5 (bsc#1193752, CVE-2021-43818): * A vulnerability (GHSL-2021-1038) in the HTML cleaner allowed sneaking script content through SVG images. * A vulnerability (GHSL-2021-1037) in the HTML cleaner allowed sneaking script content through CSS imports and other crafted constructs. - update to 4.7.1: * Chunked Unicode string parsing via ``parser.feed()`` now encodes the input data to the native UTF-8 encoding directly, instead of going through ``Py_UNICODE`` / ``wchar_t`` encoding first, which previously required duplicate recoding in most cases. * The standard namespace prefixes were mishandled during "C14N2" serialisation on Python 3. * ``lxml.objectify`` previously accepted non-XML numbers with underscores (like "1_000") as integers or float values in Python 3.6 and later. It now adheres to the number format of the XML spec again. * LP#1939031: Static wheels of lxml now contain the header files of zlib and libiconv (in addition to the already provided headers of libxml2/libxslt/libexslt). * Wheels include libxml2 2.9.12+ and libxslt 1.1.34 (also on Windows). - update to 4.8.0: * GH#337: Path-like objects are now supported throughout the API instead of just strings. * The ``ElementMaker`` now supports ``QName`` values as tags, which always override the default namespace of the factory. * GH#338: In lxml.objectify, the XSI float annotation "nan" and "inf" were spelled in lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively. * Built with Cython 0.29.28. - update to 4.9.0: * The mixin inheritance order in ``lxml.html`` was corrected. * Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12. - update to version 4.9.1 (bsc#1201253, CVE-2022-2309): * Bugs fixed + A crash was resolved when using iterwalk() (or canonicalize()) after parsing certain incorrect input. Note that iterwalk() can crash on valid input parsed with the same parser after failing to parse the incorrect input. - Update BR for libxml2-devel to the current version. - Add missing BR for python-base. - Rename package to avoid conflicts with the new Python Stack Proposal (jsc#PED-68) - Add libexpat-2.6.0-backport.patch to fix compatibility with system libexpat in tests (bsc#1222075, CVE-2023-52425). - Update to 4.4.1: * LP#1838252: The order of an OrderedDict was lost in 4.4.0 when passing it as attrib mapping during element creation. * LP#1838521: The package metadata now lists the supported Python versions. - Add lxml-libxml-2.9.10.patch: Fix build against libxml 2.9.10. - Update to 4.4.2: * LP#1835708: ElementInclude incorrectly rejected repeated non-recursive includes as recursive. * Remove patch lxml-libxml-2.9.10.patch which is now upstream - update to 4.5.0 * A new function indent() was added to insert tail whitespace for pretty-printing an XML tree. * LP#1857794 Tail text of nodes that get removed from a document using item deletion disappeared silently instead of sticking with the node that was removed. * LP#1840234: The package version number is now available as lxml.__version__ - Remove explicit Provides of python-doc, which is just wrong. - Update to 4.5.1 * LP#1570388: Fix failures when serialising documents larger than 2GB in some cases. * LP#1865141, GH#298: QName values were not accepted by the el.iter() method. Patch by xmo-odoo. * LP#1863413, GH#297: The build failed to detect libraries on Linux that are only configured via pkg-config. - update to 4.5.2: * ``Cleaner()`` now validates that only known configuration options can be set. * LP#1882606: ``Cleaner.clean_html()`` discarded comments and PIs regardless of the corresponding configuration option, if ``remove_unknown_tags`` was set. * LP#1880251: Instead of globally overwriting the document loader in libxml2, lxml now sets it per parser run, which improves the interoperability with other users of libxml2 such as libxmlsec. * LP#1881960: Fix build in CPython 3.10 by using Cython 0.29.21. * The setup options "--with-xml2-config" and "--with-xslt-config" were accidentally renamed to "--xml2-config" and "--xslt-config" in 4.5.1 and are now available again. - update to 4.6.2: * A vulnerability (CVE-2020-27783) was discovered in the HTML Cleaner by Yaniv Nizry, which allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content. (bsc#1179534) * A vulnerability was discovered in the HTML Cleaner by Yaniv Nizry, which allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content. * GH#310: ``lxml.html.InputGetter`` supports ``__len__()`` to count the number of input fields. Patch by Aidan Woolley. * ``lxml.html.InputGetter`` has a new ``.items()`` method to ease processing all input fields. * ``lxml.html.InputGetter.keys()`` now returns the field names in document order. * GH-309: The API documentation is now generated using ``sphinx-apidoc``. * LP#1869455: C14N 2.0 serialisation failed for unprefixed attributes when a default namespace was defined. * ``TreeBuilder.close()`` raised ``AssertionError`` in some error cases where it should have raised ``XMLSyntaxError``. It now raises a combined exception to keep up backwards compatibility, while switching to ``XMLSyntaxError`` as an interface. - update to 4.6.3: * A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung, which allowed JavaScript to pass through. The cleaner now removes the HTML5 ``formaction`` attribute. (bsc#1184177) - Adapt test_etree.py to a behavioural change in libxml2 2.9.11+ * Add python-lxml-test_etree.patch - Add missing dependency on python-base for the devel subpackage. - update to 4.6.4: * A new property ``system_url`` was added to DTD entities. * The ``STATIC_*`` variables in ``setup.py`` can now be passed via env vars. - remove python-lxml-test_etree.patch (upstream) - update to 4.6.5 (bsc#1193752, CVE-2021-43818): * A vulnerability (GHSL-2021-1038) in the HTML cleaner allowed sneaking script content through SVG images. * A vulnerability (GHSL-2021-1037) in the HTML cleaner allowed sneaking script content through CSS imports and other crafted constructs. - update to 4.7.1: * Chunked Unicode string parsing via ``parser.feed()`` now encodes the input data to the native UTF-8 encoding directly, instead of going through ``Py_UNICODE`` / ``wchar_t`` encoding first, which previously required duplicate recoding in most cases. * The standard namespace prefixes were mishandled during "C14N2" serialisation on Python 3. * ``lxml.objectify`` previously accepted non-XML numbers with underscores (like "1_000") as integers or float values in Python 3.6 and later. It now adheres to the number format of the XML spec again. * LP#1939031: Static wheels of lxml now contain the header files of zlib and libiconv (in addition to the already provided headers of libxml2/libxslt/libexslt). * Wheels include libxml2 2.9.12+ and libxslt 1.1.34 (also on Windows). - update to 4.8.0: * GH#337: Path-like objects are now supported throughout the API instead of just strings. * The ``ElementMaker`` now supports ``QName`` values as tags, which always override the default namespace of the factory. * GH#338: In lxml.objectify, the XSI float annotation "nan" and "inf" were spelled in lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively. * Built with Cython 0.29.28. - update to 4.9.0: * The mixin inheritance order in ``lxml.html`` was corrected. * Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12. - update to version 4.9.1 (bsc#1201253, CVE-2022-2309): * Bugs fixed + A crash was resolved when using iterwalk() (or canonicalize()) after parsing certain incorrect input. Note that iterwalk() can crash on valid input parsed with the same parser after failing to parse the incorrect input. - Update BR for libxml2-devel to the current version. - Add missing BR for python-base. - Rename package to avoid conflicts with the new Python Stack Proposal (jsc#PED-68) - Add libexpat-2.6.0-backport.patch to fix compatibility with system libexpat in tests (bsc#1222075, CVE-2023-52425). - Update to 4.4.1: * LP#1838252: The order of an OrderedDict was lost in 4.4.0 when passing it as attrib mapping during element creation. * LP#1838521: The package metadata now lists the supported Python versions. - Add lxml-libxml-2.9.10.patch: Fix build against libxml 2.9.10. - Update to 4.4.2: * LP#1835708: ElementInclude incorrectly rejected repeated non-recursive includes as recursive. * Remove patch lxml-libxml-2.9.10.patch which is now upstream - update to 4.5.0 * A new function indent() was added to insert tail whitespace for pretty-printing an XML tree. * LP#1857794 Tail text of nodes that get removed from a document using item deletion disappeared silently instead of sticking with the node that was removed. * LP#1840234: The package version number is now available as lxml.__version__ - Remove explicit Provides of python-doc, which is just wrong. - Update to 4.5.1 * LP#1570388: Fix failures when serialising documents larger than 2GB in some cases. * LP#1865141, GH#298: QName values were not accepted by the el.iter() method. Patch by xmo-odoo. * LP#1863413, GH#297: The build failed to detect libraries on Linux that are only configured via pkg-config. - update to 4.5.2: * ``Cleaner()`` now validates that only known configuration options can be set. * LP#1882606: ``Cleaner.clean_html()`` discarded comments and PIs regardless of the corresponding configuration option, if ``remove_unknown_tags`` was set. * LP#1880251: Instead of globally overwriting the document loader in libxml2, lxml now sets it per parser run, which improves the interoperability with other users of libxml2 such as libxmlsec. * LP#1881960: Fix build in CPython 3.10 by using Cython 0.29.21. * The setup options "--with-xml2-config" and "--with-xslt-config" were accidentally renamed to "--xml2-config" and "--xslt-config" in 4.5.1 and are now available again. - update to 4.6.2: * A vulnerability (CVE-2020-27783) was discovered in the HTML Cleaner by Yaniv Nizry, which allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content. (bsc#1179534) * A vulnerability was discovered in the HTML Cleaner by Yaniv Nizry, which allowed JavaScript to pass through. The cleaner now removes more sneaky "style" content. * GH#310: ``lxml.html.InputGetter`` supports ``__len__()`` to count the number of input fields. Patch by Aidan Woolley. * ``lxml.html.InputGetter`` has a new ``.items()`` method to ease processing all input fields. * ``lxml.html.InputGetter.keys()`` now returns the field names in document order. * GH-309: The API documentation is now generated using ``sphinx-apidoc``. * LP#1869455: C14N 2.0 serialisation failed for unprefixed attributes when a default namespace was defined. * ``TreeBuilder.close()`` raised ``AssertionError`` in some error cases where it should have raised ``XMLSyntaxError``. It now raises a combined exception to keep up backwards compatibility, while switching to ``XMLSyntaxError`` as an interface. - update to 4.6.3: * A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung, which allowed JavaScript to pass through. The cleaner now removes the HTML5 ``formaction`` attribute. (bsc#1184177) - Adapt test_etree.py to a behavioural change in libxml2 2.9.11+ * Add python-lxml-test_etree.patch - Add missing dependency on python-base for the devel subpackage. - update to 4.6.4: * A new property ``system_url`` was added to DTD entities. * The ``STATIC_*`` variables in ``setup.py`` can now be passed via env vars. - remove python-lxml-test_etree.patch (upstream) - update to 4.6.5 (bsc#1193752, CVE-2021-43818): * A vulnerability (GHSL-2021-1038) in the HTML cleaner allowed sneaking script content through SVG images. * A vulnerability (GHSL-2021-1037) in the HTML cleaner allowed sneaking script content through CSS imports and other crafted constructs. - update to 4.7.1: * Chunked Unicode string parsing via ``parser.feed()`` now encodes the input data to the native UTF-8 encoding directly, instead of going through ``Py_UNICODE`` / ``wchar_t`` encoding first, which previously required duplicate recoding in most cases. * The standard namespace prefixes were mishandled during "C14N2" serialisation on Python 3. * ``lxml.objectify`` previously accepted non-XML numbers with underscores (like "1_000") as integers or float values in Python 3.6 and later. It now adheres to the number format of the XML spec again. * LP#1939031: Static wheels of lxml now contain the header files of zlib and libiconv (in addition to the already provided headers of libxml2/libxslt/libexslt). * Wheels include libxml2 2.9.12+ and libxslt 1.1.34 (also on Windows). - update to 4.8.0: * GH#337: Path-like objects are now supported throughout the API instead of just strings. * The ``ElementMaker`` now supports ``QName`` values as tags, which always override the default namespace of the factory. * GH#338: In lxml.objectify, the XSI float annotation "nan" and "inf" were spelled in lower case, whereas XML Schema datatypes define them as "NaN" and "INF" respectively. * Built with Cython 0.29.28. - update to 4.9.0: * The mixin inheritance order in ``lxml.html`` was corrected. * Built with Cython 0.29.30 to adapt to changes in Python 3.11 and 3.12. - update to version 4.9.1 (bsc#1201253, CVE-2022-2309): * Bugs fixed + A crash was resolved when using iterwalk() (or canonicalize()) after parsing certain incorrect input. Note that iterwalk() can crash on valid input parsed with the same parser after failing to parse the incorrect input. - Update BR for libxml2-devel to the current version. - Add missing BR for python-base. - Rename package to avoid conflicts with the new Python Stack Proposal (jsc#PED-68) - Add libexpat-2.6.0-backport.patch to fix compatibility with system libexpat in tests (bsc#1222075, CVE-2023-52425). - Update to new upstream release 0.8 * This release contains new features available up to the (upcoming) Linux 4.14 kernel release: * Support for stateful objects, these objects are uniquely identified by a user-defined name, you can refer to them from rules, and there is a well established interface to operate with them. * Sort set elements when listing them, from lower to largest. * TCP option matching and mangling support. This includes TCP maximum segment size mangling. * Add new "-s" option for listings without stateful information. * Add new -c/--check option for nft, to tests if your ruleset loads fine, into the kernel, this is a dry run mode. * Connection tracking helper support. * Add --echo option, to print the handle that the kernel allocates to uniquely identify rules. * Conntrack zone support * Symmetric hash support * Add support to include directories from nft natives scripts, files are loaded in alphanumerical order. * Allow to check if IPv6 extension header or TCP option exists or is missing. * Extend quota support to display used bytes. * Add ct average matching, to match average bytes per packet a connection has transferred so far, to map the existing feature available in the iptables connbytes match. * Allow to flush maps and flow tables. * Allow to embed set definition into an existing set. * Conntrack event filtering support via rule. - Update to new upstream release 0.8.1 * This release deprecates the "flow table" syntax in favor of "meter". - Update to new upstream release 0.8.2 * add secpath support - Update to new upstream release 0.8.3 * raw payload support to match headers that do not yet have received a mnemonic. - Update to new upstream release 0.8.4 * Support to match IPv6 segment routing headers. * New "meta ibrname" and "meta obrname" arguments to match the name of the logical bridge a packet is passing through. These new names replace the old (misnamed) "ibriport"/"obriport". * `nft -a` will now show handle identifier for all objects, including tables and chains. * nft can now delete objects by their handle number. * Support to update maps from the ruleset (packet path). * the "--echo" option now prints handle id for tables and object too. * `nft -f -` will now read from standard input * Support for flow tables, cf. man page or https://lwn.net/Articles/738214/ . - Update to new upstream release 0.8.5 * support to add/insert a rule at a given index position * meter statement now supports a configureable upper max size * timeouts for sets can now be specified in milliseconds * re-add iptables-like empty skeleton rulesets - Update to new upstream release 0.9.0 * Support to check if packet matches an existing socket. * Support to limit number of active connections by arbitrary criteria, such as ip addresses, networks, conntrack zones or any combination thereof. * Added support for "audit" logging. - Remove unused dblatex BuildRequires, only needed for the optional and disabled PDF generation (same contents as shipped manpage). - Update to new upstream release 0.9.2 * Transport header port matching, e.g. "th dport 53" * Support for matching on IPv4 options * Support for synproxy - Update to release 0.9.3 * meta: Introduce new conditions "time", "day" and "hour". * src: add ability to set/get secmarks to/from connection. * flowtable: add support for named flowtable listing. * flowtable: add support for delete command by handle. * json: add support for element deletion. * Add `-T` as the short option for `--numeric-time`. * meta: add ibrpvid and ibrvproto support - Add json, python [boo#1158723] - Update to release 0.9.4 * Add a helper for concat expression handling. * Add "typeof" build/parse/print support. - Add anonset-crashfix.patch [boo#1171321] - Update to release 0.9.5 * Support for set counters. * Support for restoring set element counters via nft -f. * Counter support for flowtables. * typeof concatenations support for sets. * Support for concatenated ranges in anonymous sets. * Allow to reject packets with 802.1q from the bridge family. * Support for matching on the conntrack ID. - Drop anonset-crashfix.patch (upstream solved differently) - Update to release 0.9.6 * Fix two ASAN runtime errors - Update to release 0.9.7 * Support for implicit chains * Support for ingress inet chains * Support for reject from prerouting chain * Support for --terse option in json * Support for the reset command with json - Update to release 0.9.8 * Complete support for matching ICMP header content fields. * Added raw tcp option match support. * Added ability to check for the presence of any tcp option. * Support for rejecting traffic from the ingress chain. - add 0001-cache-check-for-NULL-chain-in-cache_init.patch: this fixes rare crashes that could occur e.g. in firewalld (bsc#1197606). - add 0001-evaluate-reject-support-ethernet-as-L2-protocol-for-.patch: this fixes a crash in nftables if layer2 reject rules are processed (e.g. Ethernet MAC address based reject rich rule in firewalld, bsc#1210773). - port python-single-spec logic from Factory package to allow shipment of python311 modules as well (bsc#1219253). - Update to 3.4: + Minor patch to make cpp.py compatible with Python 3. + Fixed setup.py trove classifiers to properly list PLY as Python 3 compatible. - License changed to BSD3c - Packaged more doc files - Moved important docs (README, ..) to base package - Fixed build for non-SUSE distros - patch license to follow spdx.org standard - python3 package added - spec file cleanups - Fix building on SLES - update to version 3.6: * If PLY is unable to create the 'parser.out' or 'parsetab.py' files due to permission issues, it now just issues a warning message and continues to operate * Fixed some issues related to use of packages and table file modules - additional changes from version 3.5: * Added support for defaulted_states in the parser * Fixed debug logging in the parser * Added actions to be defined to character literals (Issue #32) * Import of the 'parsetab.py' file is now constrained to only consider the directory specified by the outputdir argument to yacc() * Changed default output directory to be the same as that in which the yacc grammar is defined * Changed the parsetab.py file signature slightly so that the parsetab won't regenerate if created on a different major version of Python * Fixed Issue #44 call_errorfunc() should return the result of errorfunc() * Support for versions of Python <2.7 is officially dropped * Fixed bug related to calling yacc(start=...) * Added skipped tests for PyPy and Java * Added filter to make unit tests pass under 'python -3' * Fixed CPP_INTEGER regex in ply/cpp.py (Issue 21) * Fixed yacc validation bugs when from __future__ import unicode_literals is being used * Added support for Travis-CI * Added a .gitignore file * Fixed validation problems for source files that include a different source code encoding specifier * Fixed unit tests for yacc to eliminate random failures due to dict hash value randomization in Python 3.3 * Fixed comment whitespace processing bugs in ply/cpp.py * Fixed token names in ply/ctokens.py to match rule names * Changes to functions available in panic mode error recover * Fixed some problems with line and position tracking and the use of error symbols * Change to doc string handling in lex module * Fixed issue #1: Fixed _tabversion. It should use __tabversion__ instead of __version__ * Fixed issue #8: Literals empty list causes IndexError * Fixed issue #12: Typo in code snippet in documentation * Fixed issue #10: Correctly escape t_XOREQUAL pattern. - clean the test and example directories - remove stray backup files in doc - remove unneeded executable bit of testlex.py - remove CFLAGS export: unneeded - do not drop executable bit of everything in test since it contains subdirectories - remove useless clean section - remove README from package: not provided anymore - update to version 3.8: * Fixed issues related to Python 3.5. Patch contributed by Barry Warsaw. - update to version 3.7 * Fixed problems when reading table files from pickled data. * Fixed regression in handling of table modules if specified as module objects. See https://github.com/dabeaz/ply/issues/63 - clean up spec - add testing rig - update to 3.9: * Exposed the parser state number as the parser.state attribute in productions and error functions. * Fixed Issue #88. Python3 compatibility with ply/cpp. * Fixed Issue #93. Ply can crash if SyntaxError is raised inside a production. Not actually sure if the original implementation worked as documented at all. Yacc has been modified to follow the spec as outlined in the CHANGES noted for 11/27/07 below. * Fixed Issue #97. Failure with code validation when the original source files aren't present. Validation step now ignores the missing file. * Minor fixes to version numbers. - Switch to single-spec build - Update to 3.10 * Changed grammar signature computation to not involve hashing functions. Parts are just combined into a big string. - Fix wrong-script-interpreter rpmlint error. - Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes tests with Linux 5.5. - Update to 5.7.0: * Various fixes to build with updated kernel/etc. - Remove merged patch pr_1665.patch and pr_1364.patch - Update patch skip-obs.patch - Remove skip-test-missing-warnings.patch as it can be fixed by properly calling the tests - Add skip_failing_tests.patch to skip tests failing because of incomplete emulation of the environment in osc build environment (gh#giampaolo/psutil#1635). - update to 5.7.2: * parallel tests on UNIX (make test-parallel). They're twice as fast! * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX. * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call. * 1747: Process provides more info about the process on str() and repr() (status and exit code): * 1757: memory leak tests are now stable. * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot) * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Michał Górny) * 1760: [Linux] Process.rlimit() does not handle long long type properly. * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess. * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar) - remove skip-flaky-i586.patch (obsolete) - Fix shebang replacement for multiple python flavors - update to 5.7.3: - 809_: [FreeBSD] add support for `Process.rlimit()`. - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner) - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is running (meaning Wi-Fi or ethernet cable is connected). - 1837_: [Linux] improved battery detection and charge "secsleft" calculation - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more than one CPU socket. - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still alive but the exe file which launched it got deleted. - 1791_: [macOS] fix missing include for getpagesize(). - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL pointer. - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not the remaining values, still return a result instead of None. - skip-obs.patch, skip_failing_tests.patch: rediff - Add missing BR for unittest2 - Only require unittest2 for Leap. - update to 5.8.0: * Enhancements: - 1863: disk_partitions() exposes 2 extra fields: maxfile and maxpath, which are the maximum file name and path name length. - 1872: [Windows] added support for PyPy 2.7. - 1879: provide pre-compiled wheels for Linux and macOS. - 1880: get rid of Travis and Cirrus CI services (they are no longer free). CI testing is now done by GitHub Actions on Linux, macOS and FreeBSD (yes). AppVeyor is still being used for Windows CI. * Bug fixes: - 1708: [Linux] get rid of sensors_temperatures() duplicates. (patch by Tim Schlueter). - 1839: [Windows] always raise AccessDenied when failing to query 64 processes from 32 bit ones (NtWoW64 APIs). - 1866: [Windows] process exe(), cmdline(), environ() may raise "invalid access to memory location" on Python 3.9. - 1874: [Solaris] wrong swap output given when encrypted column is present. - 1875: [Windows] process username() may raise ERROR_NONE_MAPPED if the SID has no corresponding account name. In this case AccessDenied is now raised. - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS. Turn it into AccessDenied or NoSuchProcess depending on whether the PID is alive. - 1886: [macOS] EIO error may be raised on cmdline() and environment(). Now it gets translated into AccessDenied. - 1891: [macOS] get rid of deprecated getpagesize(). - Rebase patch and skip three other tests that fail on obs * skip-obs.patch - Add patch to skip tests related to rlimit and zombie processes that fail when building for python2 on i586: * skip_rlimit_tests_on_python2.patch - Do not install tests (and change the way they're run since they were run from %{buildroot}) - remove the dependency on net-tools, since it conflicts with busybox-hostnmame which is default on MicroOS. boo#1184753 - Update skip-obs.patch to also skip TestProcess.test_ionice_linux - update to 5.9.0: * [Linux]: `cpu_freq()`_ is slow on systems with many CPUs. Read current frequency values for all CPUs from ``/proc/cpuinfo`` instead of opening many files in ``/sys`` fs. (patch by marxin) * `NoSuchProcess`_ message now specifies if the PID has been reused. * error classes (`NoSuchProcess`_, `AccessDenied`_, etc.) now have a better formatted and separated ``__repr__`` and ``__str__`` implementations. * [Linux]: `disk_partitions()`_: convert ``/dev/root`` device (an alias used on some Linux distros) to real root device path. * ``PSUTIL_DEBUG`` mode now prints file name and line number of the debug messages coming from C extension modules. * rewrite HISTORY.rst to use hyperlinks pointing to psutil API doc. * [Linux]: `wait_procs()`_ should catch ``subprocess.TimeoutExpired`` exception. * [Linux]: `sensors_battery()`_ can raise ``TypeError`` on PureOS. * [Linux]: psutil does not handle ``ENAMETOOLONG`` when accessing process file descriptors in procfs. (patch by Nikita Radchenko) * **[critical]**: ``memoize_when_activated`` decorator is not thread-safe. * **[critical]**: `process_iter()`_ is not thread safe and can raise ``TypeError`` if invoked from multiple threads. * [Linux]: `cpu_freq()`_ return order is wrong on systems with more than 9 CPUs. - Add skip-partitions-erros.patch skipping tests failing on Linux (gh#giampaolo/psutil#2043). - Fix name of Patch4, it is skip-partitions-erros.patch - removed obsolete skip-partitions-erros.patch - update to 5.9.1 * Enhancements - 1053: drop Python 2.6 support. (patches by Matthieu Darbois and Hugo van Kemenade) - 2050, [Linux]: increase read(2) buffer size from 1k to 32k when reading /proc pseudo files line by line. This should help having more consistent results. - 2057, [OpenBSD]: add support for cpu_freq(). - 2107, [Linux]: Process.memory_full_info() (reporting process USS/PSS/Swap memory) now reads /proc/pid/smaps_rollup instead of /proc/pids/smaps, which makes it 5 times faster. * Bug fixes - 2048: AttributeError is raised if psutil.Error class is raised manually and passed through str. - 2049, [Linux]: cpu_freq() erroneously returns curr value in GHz while min and max are in MHz. - 2050, [Linux]: virtual_memory() may raise ValueError if running in a LCX container. - Add patch mem-used-bsc1181475.patch (bsc#1181475) * Adopt change of used memory calculation from upstream of procps - Fix tests: setuptools changed the builddir library path and does not find the module from it. Use the installed platlib instead and exclude psutil.tests only later. - Refresh skip-obs.patch - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes tests with Linux 5.5. - Update to 5.7.0: * Various fixes to build with updated kernel/etc. - Remove merged patch pr_1665.patch and pr_1364.patch - Update patch skip-obs.patch - Remove skip-test-missing-warnings.patch as it can be fixed by properly calling the tests - Add skip_failing_tests.patch to skip tests failing because of incomplete emulation of the environment in osc build environment (gh#giampaolo/psutil#1635). - update to 5.7.2: * parallel tests on UNIX (make test-parallel). They're twice as fast! * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX. * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call. * 1747: Process provides more info about the process on str() and repr() (status and exit code): * 1757: memory leak tests are now stable. * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot) * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Michał Górny) * 1760: [Linux] Process.rlimit() does not handle long long type properly. * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess. * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar) - remove skip-flaky-i586.patch (obsolete) - Fix shebang replacement for multiple python flavors - update to 5.7.3: - 809_: [FreeBSD] add support for `Process.rlimit()`. - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner) - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is running (meaning Wi-Fi or ethernet cable is connected). - 1837_: [Linux] improved battery detection and charge "secsleft" calculation - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more than one CPU socket. - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still alive but the exe file which launched it got deleted. - 1791_: [macOS] fix missing include for getpagesize(). - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL pointer. - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not the remaining values, still return a result instead of None. - skip-obs.patch, skip_failing_tests.patch: rediff - Add missing BR for unittest2 - Only require unittest2 for Leap. - update to 5.8.0: * Enhancements: - 1863: disk_partitions() exposes 2 extra fields: maxfile and maxpath, which are the maximum file name and path name length. - 1872: [Windows] added support for PyPy 2.7. - 1879: provide pre-compiled wheels for Linux and macOS. - 1880: get rid of Travis and Cirrus CI services (they are no longer free). CI testing is now done by GitHub Actions on Linux, macOS and FreeBSD (yes). AppVeyor is still being used for Windows CI. * Bug fixes: - 1708: [Linux] get rid of sensors_temperatures() duplicates. (patch by Tim Schlueter). - 1839: [Windows] always raise AccessDenied when failing to query 64 processes from 32 bit ones (NtWoW64 APIs). - 1866: [Windows] process exe(), cmdline(), environ() may raise "invalid access to memory location" on Python 3.9. - 1874: [Solaris] wrong swap output given when encrypted column is present. - 1875: [Windows] process username() may raise ERROR_NONE_MAPPED if the SID has no corresponding account name. In this case AccessDenied is now raised. - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS. Turn it into AccessDenied or NoSuchProcess depending on whether the PID is alive. - 1886: [macOS] EIO error may be raised on cmdline() and environment(). Now it gets translated into AccessDenied. - 1891: [macOS] get rid of deprecated getpagesize(). - Rebase patch and skip three other tests that fail on obs * skip-obs.patch - Add patch to skip tests related to rlimit and zombie processes that fail when building for python2 on i586: * skip_rlimit_tests_on_python2.patch - Do not install tests (and change the way they're run since they were run from %{buildroot}) - remove the dependency on net-tools, since it conflicts with busybox-hostnmame which is default on MicroOS. boo#1184753 - Update skip-obs.patch to also skip TestProcess.test_ionice_linux - update to 5.9.0: * [Linux]: `cpu_freq()`_ is slow on systems with many CPUs. Read current frequency values for all CPUs from ``/proc/cpuinfo`` instead of opening many files in ``/sys`` fs. (patch by marxin) * `NoSuchProcess`_ message now specifies if the PID has been reused. * error classes (`NoSuchProcess`_, `AccessDenied`_, etc.) now have a better formatted and separated ``__repr__`` and ``__str__`` implementations. * [Linux]: `disk_partitions()`_: convert ``/dev/root`` device (an alias used on some Linux distros) to real root device path. * ``PSUTIL_DEBUG`` mode now prints file name and line number of the debug messages coming from C extension modules. * rewrite HISTORY.rst to use hyperlinks pointing to psutil API doc. * [Linux]: `wait_procs()`_ should catch ``subprocess.TimeoutExpired`` exception. * [Linux]: `sensors_battery()`_ can raise ``TypeError`` on PureOS. * [Linux]: psutil does not handle ``ENAMETOOLONG`` when accessing process file descriptors in procfs. (patch by Nikita Radchenko) * **[critical]**: ``memoize_when_activated`` decorator is not thread-safe. * **[critical]**: `process_iter()`_ is not thread safe and can raise ``TypeError`` if invoked from multiple threads. * [Linux]: `cpu_freq()`_ return order is wrong on systems with more than 9 CPUs. - Add skip-partitions-erros.patch skipping tests failing on Linux (gh#giampaolo/psutil#2043). - Fix name of Patch4, it is skip-partitions-erros.patch - removed obsolete skip-partitions-erros.patch - update to 5.9.1 * Enhancements - 1053: drop Python 2.6 support. (patches by Matthieu Darbois and Hugo van Kemenade) - 2050, [Linux]: increase read(2) buffer size from 1k to 32k when reading /proc pseudo files line by line. This should help having more consistent results. - 2057, [OpenBSD]: add support for cpu_freq(). - 2107, [Linux]: Process.memory_full_info() (reporting process USS/PSS/Swap memory) now reads /proc/pid/smaps_rollup instead of /proc/pids/smaps, which makes it 5 times faster. * Bug fixes - 2048: AttributeError is raised if psutil.Error class is raised manually and passed through str. - 2049, [Linux]: cpu_freq() erroneously returns curr value in GHz while min and max are in MHz. - 2050, [Linux]: virtual_memory() may raise ValueError if running in a LCX container. - Add patch mem-used-bsc1181475.patch (bsc#1181475) * Adopt change of used memory calculation from upstream of procps - Fix tests: setuptools changed the builddir library path and does not find the module from it. Use the installed platlib instead and exclude psutil.tests only later. - Refresh skip-obs.patch - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes tests with Linux 5.5. - Update to 5.7.0: * Various fixes to build with updated kernel/etc. - Remove merged patch pr_1665.patch and pr_1364.patch - Update patch skip-obs.patch - Remove skip-test-missing-warnings.patch as it can be fixed by properly calling the tests - Add skip_failing_tests.patch to skip tests failing because of incomplete emulation of the environment in osc build environment (gh#giampaolo/psutil#1635). - update to 5.7.2: * parallel tests on UNIX (make test-parallel). They're twice as fast! * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX. * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call. * 1747: Process provides more info about the process on str() and repr() (status and exit code): * 1757: memory leak tests are now stable. * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot) * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Michał Górny) * 1760: [Linux] Process.rlimit() does not handle long long type properly. * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess. * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar) - remove skip-flaky-i586.patch (obsolete) - Fix shebang replacement for multiple python flavors - update to 5.7.3: - 809_: [FreeBSD] add support for `Process.rlimit()`. - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner) - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is running (meaning Wi-Fi or ethernet cable is connected). - 1837_: [Linux] improved battery detection and charge "secsleft" calculation - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more than one CPU socket. - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still alive but the exe file which launched it got deleted. - 1791_: [macOS] fix missing include for getpagesize(). - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL pointer. - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not the remaining values, still return a result instead of None. - skip-obs.patch, skip_failing_tests.patch: rediff - Add missing BR for unittest2 - Only require unittest2 for Leap. - update to 5.8.0: * Enhancements: - 1863: disk_partitions() exposes 2 extra fields: maxfile and maxpath, which are the maximum file name and path name length. - 1872: [Windows] added support for PyPy 2.7. - 1879: provide pre-compiled wheels for Linux and macOS. - 1880: get rid of Travis and Cirrus CI services (they are no longer free). CI testing is now done by GitHub Actions on Linux, macOS and FreeBSD (yes). AppVeyor is still being used for Windows CI. * Bug fixes: - 1708: [Linux] get rid of sensors_temperatures() duplicates. (patch by Tim Schlueter). - 1839: [Windows] always raise AccessDenied when failing to query 64 processes from 32 bit ones (NtWoW64 APIs). - 1866: [Windows] process exe(), cmdline(), environ() may raise "invalid access to memory location" on Python 3.9. - 1874: [Solaris] wrong swap output given when encrypted column is present. - 1875: [Windows] process username() may raise ERROR_NONE_MAPPED if the SID has no corresponding account name. In this case AccessDenied is now raised. - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS. Turn it into AccessDenied or NoSuchProcess depending on whether the PID is alive. - 1886: [macOS] EIO error may be raised on cmdline() and environment(). Now it gets translated into AccessDenied. - 1891: [macOS] get rid of deprecated getpagesize(). - Rebase patch and skip three other tests that fail on obs * skip-obs.patch - Add patch to skip tests related to rlimit and zombie processes that fail when building for python2 on i586: * skip_rlimit_tests_on_python2.patch - Do not install tests (and change the way they're run since they were run from %{buildroot}) - remove the dependency on net-tools, since it conflicts with busybox-hostnmame which is default on MicroOS. boo#1184753 - Update skip-obs.patch to also skip TestProcess.test_ionice_linux - update to 5.9.0: * [Linux]: `cpu_freq()`_ is slow on systems with many CPUs. Read current frequency values for all CPUs from ``/proc/cpuinfo`` instead of opening many files in ``/sys`` fs. (patch by marxin) * `NoSuchProcess`_ message now specifies if the PID has been reused. * error classes (`NoSuchProcess`_, `AccessDenied`_, etc.) now have a better formatted and separated ``__repr__`` and ``__str__`` implementations. * [Linux]: `disk_partitions()`_: convert ``/dev/root`` device (an alias used on some Linux distros) to real root device path. * ``PSUTIL_DEBUG`` mode now prints file name and line number of the debug messages coming from C extension modules. * rewrite HISTORY.rst to use hyperlinks pointing to psutil API doc. * [Linux]: `wait_procs()`_ should catch ``subprocess.TimeoutExpired`` exception. * [Linux]: `sensors_battery()`_ can raise ``TypeError`` on PureOS. * [Linux]: psutil does not handle ``ENAMETOOLONG`` when accessing process file descriptors in procfs. (patch by Nikita Radchenko) * **[critical]**: ``memoize_when_activated`` decorator is not thread-safe. * **[critical]**: `process_iter()`_ is not thread safe and can raise ``TypeError`` if invoked from multiple threads. * [Linux]: `cpu_freq()`_ return order is wrong on systems with more than 9 CPUs. - Add skip-partitions-erros.patch skipping tests failing on Linux (gh#giampaolo/psutil#2043). - Fix name of Patch4, it is skip-partitions-erros.patch - removed obsolete skip-partitions-erros.patch - update to 5.9.1 * Enhancements - 1053: drop Python 2.6 support. (patches by Matthieu Darbois and Hugo van Kemenade) - 2050, [Linux]: increase read(2) buffer size from 1k to 32k when reading /proc pseudo files line by line. This should help having more consistent results. - 2057, [OpenBSD]: add support for cpu_freq(). - 2107, [Linux]: Process.memory_full_info() (reporting process USS/PSS/Swap memory) now reads /proc/pid/smaps_rollup instead of /proc/pids/smaps, which makes it 5 times faster. * Bug fixes - 2048: AttributeError is raised if psutil.Error class is raised manually and passed through str. - 2049, [Linux]: cpu_freq() erroneously returns curr value in GHz while min and max are in MHz. - 2050, [Linux]: virtual_memory() may raise ValueError if running in a LCX container. - Add patch mem-used-bsc1181475.patch (bsc#1181475) * Adopt change of used memory calculation from upstream of procps - Fix tests: setuptools changed the builddir library path and does not find the module from it. Use the installed platlib instead and exclude psutil.tests only later. - Refresh skip-obs.patch - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - update to version 2.21.0: * Requests now supports idna v2.8. - Do not depend on python-py - Update few of the requirements - Skip one more test that is flaky - Do not hardcode version requirements in setup.py allowing us to update and verify functionality on our own: * requests-no-hardcoded-version.patch - Update to version 2.20.1 (bsc#1111622) * Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443). - Update to 2.22.0: * Requests now supports urllib3 v1.25.2. (note: 1.25.0 and 1.25.1 are incompatible) - Rebase requests-no-hardcoded-version.patch - Hardcode pytest 3.x series as upstream even in git does not work with newer versions (they pinned the release) - Add two patches only updating test logic to remove pytest 3 pin - merged_pr_5049.patch - pr_5251-pytest5.patch - Remove python-urllib3, python-certifi and ca-certificates from main package BuildRequires, not required for building. - Do not require full python, (implicit) python-base is sufficient. - update to 2.23.0 - dropped merged_pr_5049.patch - refreshed requests-no-hardcoded-version.patch * Remove defunct reference to prefetch in Session __attrs__ * Requests no longer outputs password in basic auth usage warning - Switch off test_https_warnings test (bsc#1170175) - remove patch pr_5251-pytest5.patch, not needed anymore. - update to version 2.24.0: - pyOpenSSL TLS implementation is now only used if Python either doesn't have an `ssl` module or doesn't support SNI. Previously pyOpenSSL was unconditionally used if available. This applies even if pyOpenSSL is installed via the `requests[security]` extra (#5443) - Redirect resolution should now only occur when `allow_redirects` is True. (#5492) - No longer perform unnecessary Content-Length calculation for requests that won't use it. (#5496) - update to 2.25.0: * Added support for NETRC environment variable. (#5643) * Requests now supports urllib3 v1.26. * Requests v2.25.x will be the last release series with support for Python 3.5. - refreshed requests-no-hardcoded-version.patch - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.25.1: - Requests now treats `application/json` as `utf8` by default. Resolving inconsistencies between `r.text` and `r.json` output. (#5673) - Don't pin idna<3 in the egg-info so that depending packages can install the new idna dropping python2 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 - Add CVE-2024-35195.patch (CVE-2024-35195, bsc#1224788) - Add httpbin.patch to fix a test failure caused by the previous patch. - Update CVE-2024-35195.patch to allow the usage of "verify" parameter as a directory, bsc#1225912 - Move name ahead of version in spec file to resolve build issues on older distributions - fdupe more thoroughly. - Support older Red Hat platforms that don't offer "Recommends:" - update to version 2.21.0: * Requests now supports idna v2.8. - Do not depend on python-py - Update few of the requirements - Skip one more test that is flaky - Do not hardcode version requirements in setup.py allowing us to update and verify functionality on our own: * requests-no-hardcoded-version.patch - Update to version 2.20.1 (bsc#1111622) * Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443). - Update to 2.22.0: * Requests now supports urllib3 v1.25.2. (note: 1.25.0 and 1.25.1 are incompatible) - Rebase requests-no-hardcoded-version.patch - Hardcode pytest 3.x series as upstream even in git does not work with newer versions (they pinned the release) - Add two patches only updating test logic to remove pytest 3 pin - merged_pr_5049.patch - pr_5251-pytest5.patch - Remove python-urllib3, python-certifi and ca-certificates from main package BuildRequires, not required for building. - Do not require full python, (implicit) python-base is sufficient. - update to 2.23.0 - dropped merged_pr_5049.patch - refreshed requests-no-hardcoded-version.patch * Remove defunct reference to prefetch in Session __attrs__ * Requests no longer outputs password in basic auth usage warning - Switch off test_https_warnings test (bsc#1170175) - remove patch pr_5251-pytest5.patch, not needed anymore. - update to version 2.24.0: - pyOpenSSL TLS implementation is now only used if Python either doesn't have an `ssl` module or doesn't support SNI. Previously pyOpenSSL was unconditionally used if available. This applies even if pyOpenSSL is installed via the `requests[security]` extra (#5443) - Redirect resolution should now only occur when `allow_redirects` is True. (#5492) - No longer perform unnecessary Content-Length calculation for requests that won't use it. (#5496) - update to 2.25.0: * Added support for NETRC environment variable. (#5643) * Requests now supports urllib3 v1.26. * Requests v2.25.x will be the last release series with support for Python 3.5. - refreshed requests-no-hardcoded-version.patch - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.25.1: - Requests now treats `application/json` as `utf8` by default. Resolving inconsistencies between `r.text` and `r.json` output. (#5673) - Don't pin idna<3 in the egg-info so that depending packages can install the new idna dropping python2 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 - Support older Red Hat platforms that don't offer "Recommends:" - update to version 2.21.0: * Requests now supports idna v2.8. - Do not depend on python-py - Update few of the requirements - Skip one more test that is flaky - Do not hardcode version requirements in setup.py allowing us to update and verify functionality on our own: * requests-no-hardcoded-version.patch - Update to version 2.20.1 (bsc#1111622) * Fixed bug with unintended Authorization header stripping for redirects using default ports (http/80, https/443). - Update to 2.22.0: * Requests now supports urllib3 v1.25.2. (note: 1.25.0 and 1.25.1 are incompatible) - Rebase requests-no-hardcoded-version.patch - Hardcode pytest 3.x series as upstream even in git does not work with newer versions (they pinned the release) - Add two patches only updating test logic to remove pytest 3 pin - merged_pr_5049.patch - pr_5251-pytest5.patch - Remove python-urllib3, python-certifi and ca-certificates from main package BuildRequires, not required for building. - Do not require full python, (implicit) python-base is sufficient. - update to 2.23.0 - dropped merged_pr_5049.patch - refreshed requests-no-hardcoded-version.patch * Remove defunct reference to prefetch in Session __attrs__ * Requests no longer outputs password in basic auth usage warning - Switch off test_https_warnings test (bsc#1170175) - remove patch pr_5251-pytest5.patch, not needed anymore. - update to version 2.24.0: - pyOpenSSL TLS implementation is now only used if Python either doesn't have an `ssl` module or doesn't support SNI. Previously pyOpenSSL was unconditionally used if available. This applies even if pyOpenSSL is installed via the `requests[security]` extra (#5443) - Redirect resolution should now only occur when `allow_redirects` is True. (#5492) - No longer perform unnecessary Content-Length calculation for requests that won't use it. (#5496) - update to 2.25.0: * Added support for NETRC environment variable. (#5643) * Requests now supports urllib3 v1.26. * Requests v2.25.x will be the last release series with support for Python 3.5. - refreshed requests-no-hardcoded-version.patch - Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352) - update to 2.25.1: - Requests now treats `application/json` as `utf8` by default. Resolving inconsistencies between `r.text` and `r.json` output. (#5673) - Don't pin idna<3 in the egg-info so that depending packages can install the new idna dropping python2 - Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629) - Add CVE-2023-32681.patch to fix unintended leak of Proxy-Authorization header (CVE-2023-32681, bsc#1211674) Upstream commit: gh#psf/requests@74ea7cf7a6a2 - Add CVE-2024-35195.patch (CVE-2024-35195, bsc#1224788) - Add httpbin.patch to fix a test failure caused by the previous patch. - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - adapt to python-3.3, which no longer looks at XXXmodule.so - Unify rpm-python and python3-rpm into singlespec - Switch the build to use setuptools-based build, so that the Python module is properly built with all its metadata - Properly quote the conditional for Obsoletes+Provides - Add a comment to note that prep and build stages come from rpm.spec - Update RPM groups - update to rpm-4.14.1 - Switch really to singlespec thus allowing us to build without python2-devel present in the distribution - remove rpmlint-Factory buildignore - update to rpm-4.14.3 - build for all python modules (jsc#PED-68, jsc#PED-1988) - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Update to 41.2.0: * #479: Remove some usage of the deprecated imp module. * #1565: Changed html_sidebars from string to list of string as per https://www.sphinx-doc.org/en/master/changes.html#id58 * #1697: Moved most of the constants from setup.py to setup.cfg * #1756: Forse metadata-version >= 1.2. when project urls are present. - Switch to multibuild to enable testsuite - Define LANG in %check to fix openSUSE/SLE 15 testsuite - Update to 41.4.0 * In declarative config, now traps errors when invalid python_requires values are supplied. * When storing extras, rely on OrderedSet to retain order of extras as indicated by the packager, which will also be deterministic on Python 2.7 (with PYTHONHASHSEED unset) and Python 3.6+. * Fixed failing integration test triggered by 'long_description_content_type' in packaging. - Add patch to sort outputs for better reproducability: * sort-for-reproducibility.patch - Add missing dep on ordered-set as it is now in the vendored dir too - Try to use system packages rather than the vendored variants - Remove runtime dependency for the full python3 package, as the actually required SSL module is in python3-base. For python(2), SSL is in the "full" python package. Avoids build loops and shortens the dependency chain for e.g. rust. - update to 41.6.0 - add importlib.patch * Replace usage of deprecated imp module with local re-implementation in setuptools._imp * Fix pkg_resources.Requirement hash/equality implementation * Fix tests when running under python3.10. * drop 'deprecated' documentation (test command, ez_setup, EasyInstall) - update to 44.0.0 - last version with python2 support - add testdata.tar.gz -> missing data for testsuite * Drop support for Python 3.4. * include pyproject.toml in source distribution by default. Projects relying on the previous behavior where pyproject.toml * Setuptools once again declares 'setuptools' in the build-system.requires and adds PEP 517 build support by declaring itself as the build-backend * Fix support for easy_install's find-links option in setup.cfg * Build dependencies (setup_requires and tests_require) now install transitive dependencies indicated by extras. * Mark the easy_install script and setuptools command as deprecated, and use pip when available to fetch/build wheels for missing setup_requires/tests_require requirements, with the following differences in behavior: + support for python_requires + better support for wheels (proper handling of priority with respect to PEP 425 tags) + PEP 517/518 support + eggs are not supported + no support for the allow_hosts easy_install option (index_url/find_links are still honored) + pip environment variables are honored (and take precedence over easy_install options) * Removed the "upload" and "register" commands in favor of twine. * Add support for the license_files option in setup.cfg to automatically include multiple license files in a source distribution. * Update handling of wheels compatibility tags: * add support for manylinux2010 * fix use of removed 'm' ABI flag in Python 3.8 on Windows * Fix empty namespace package installation from wheel. * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options", enabling plugins like setuptools_scm to configure options on the distribution at finalization time. - Fix build without python2 - Fix License to the correct MIT - use local source dir for pytest imports gh#openSUSE/python-rpm-macros#48 - update to 44.1.0 * Set sys.argv[0] in setup script run by build_meta.__legacy__ * Fix for Python 4: replace unsafe six.PY3 with six.PY2 * Fixed a bug in the “setuptools.finalize_distribution_options” hook that lead to ignoring the order attribute of entry points managed by this hook. * Avoid loading working set during Distribution.finalize_options prior to invoking _install_setup_requires, broken since v42.0.0. - Add wheel subpackage with the generated wheel for this package (bsc#1176262, CVE-2019-20916). - Make wheel a separate build run to avoid the setuptools/wheel build cycle. - Avoid duplicite wheel name in the generated package, and we actually don't need a subpackage at all. - Add remove_mock.patch to remove dependency on the external mock package. - We cannot remove vendored packages when generating setuptools wheel (bsc#1177127). - Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service (ReDoS) in package_index.py. bsc#1206667 - Rename package sources from python- to python3 for PSP (jsc#PED-68, jsc#PED-2217) - Update to 41.2.0: * #479: Remove some usage of the deprecated imp module. * #1565: Changed html_sidebars from string to list of string as per https://www.sphinx-doc.org/en/master/changes.html#id58 * #1697: Moved most of the constants from setup.py to setup.cfg * #1756: Forse metadata-version >= 1.2. when project urls are present. - Switch to multibuild to enable testsuite - Define LANG in %check to fix openSUSE/SLE 15 testsuite - Update to 41.4.0 * In declarative config, now traps errors when invalid python_requires values are supplied. * When storing extras, rely on OrderedSet to retain order of extras as indicated by the packager, which will also be deterministic on Python 2.7 (with PYTHONHASHSEED unset) and Python 3.6+. * Fixed failing integration test triggered by 'long_description_content_type' in packaging. - Add patch to sort outputs for better reproducability: * sort-for-reproducibility.patch - Add missing dep on ordered-set as it is now in the vendored dir too - Try to use system packages rather than the vendored variants - Remove runtime dependency for the full python3 package, as the actually required SSL module is in python3-base. For python(2), SSL is in the "full" python package. Avoids build loops and shortens the dependency chain for e.g. rust. - update to 41.6.0 - add importlib.patch * Replace usage of deprecated imp module with local re-implementation in setuptools._imp * Fix pkg_resources.Requirement hash/equality implementation * Fix tests when running under python3.10. * drop 'deprecated' documentation (test command, ez_setup, EasyInstall) - update to 44.0.0 - last version with python2 support - add testdata.tar.gz -> missing data for testsuite * Drop support for Python 3.4. * include pyproject.toml in source distribution by default. Projects relying on the previous behavior where pyproject.toml * Setuptools once again declares 'setuptools' in the build-system.requires and adds PEP 517 build support by declaring itself as the build-backend * Fix support for easy_install's find-links option in setup.cfg * Build dependencies (setup_requires and tests_require) now install transitive dependencies indicated by extras. * Mark the easy_install script and setuptools command as deprecated, and use pip when available to fetch/build wheels for missing setup_requires/tests_require requirements, with the following differences in behavior: + support for python_requires + better support for wheels (proper handling of priority with respect to PEP 425 tags) + PEP 517/518 support + eggs are not supported + no support for the allow_hosts easy_install option (index_url/find_links are still honored) + pip environment variables are honored (and take precedence over easy_install options) * Removed the "upload" and "register" commands in favor of twine. * Add support for the license_files option in setup.cfg to automatically include multiple license files in a source distribution. * Update handling of wheels compatibility tags: * add support for manylinux2010 * fix use of removed 'm' ABI flag in Python 3.8 on Windows * Fix empty namespace package installation from wheel. * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options", enabling plugins like setuptools_scm to configure options on the distribution at finalization time. - Fix build without python2 - Fix License to the correct MIT - use local source dir for pytest imports gh#openSUSE/python-rpm-macros#48 - update to 44.1.0 * Set sys.argv[0] in setup script run by build_meta.__legacy__ * Fix for Python 4: replace unsafe six.PY3 with six.PY2 * Fixed a bug in the “setuptools.finalize_distribution_options” hook that lead to ignoring the order attribute of entry points managed by this hook. * Avoid loading working set during Distribution.finalize_options prior to invoking _install_setup_requires, broken since v42.0.0. - Add wheel subpackage with the generated wheel for this package (bsc#1176262, CVE-2019-20916). - Make wheel a separate build run to avoid the setuptools/wheel build cycle. - Avoid duplicite wheel name in the generated package, and we actually don't need a subpackage at all. - Add remove_mock.patch to remove dependency on the external mock package. - We cannot remove vendored packages when generating setuptools wheel (bsc#1177127). - Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service (ReDoS) in package_index.py. bsc#1206667 - Rename package sources from python- to python3 for PSP (jsc#PED-68, jsc#PED-2217) - Switch to multibuild to enable testsuite - Define LANG in %check to fix openSUSE/SLE 15 testsuite - Update to 41.4.0 * In declarative config, now traps errors when invalid python_requires values are supplied. * When storing extras, rely on OrderedSet to retain order of extras as indicated by the packager, which will also be deterministic on Python 2.7 (with PYTHONHASHSEED unset) and Python 3.6+. * Fixed failing integration test triggered by 'long_description_content_type' in packaging. - Add patch to sort outputs for better reproducability: * sort-for-reproducibility.patch - Add missing dep on ordered-set as it is now in the vendored dir too - Try to use system packages rather than the vendored variants - Remove runtime dependency for the full python3 package, as the actually required SSL module is in python3-base. For python(2), SSL is in the "full" python package. Avoids build loops and shortens the dependency chain for e.g. rust. - update to 41.6.0 - add importlib.patch * Replace usage of deprecated imp module with local re-implementation in setuptools._imp * Fix pkg_resources.Requirement hash/equality implementation * Fix tests when running under python3.10. * drop 'deprecated' documentation (test command, ez_setup, EasyInstall) - update to 44.0.0 - last version with python2 support - add testdata.tar.gz -> missing data for testsuite * Drop support for Python 3.4. * include pyproject.toml in source distribution by default. Projects relying on the previous behavior where pyproject.toml * Setuptools once again declares 'setuptools' in the build-system.requires and adds PEP 517 build support by declaring itself as the build-backend * Fix support for easy_install's find-links option in setup.cfg * Build dependencies (setup_requires and tests_require) now install transitive dependencies indicated by extras. * Mark the easy_install script and setuptools command as deprecated, and use pip when available to fetch/build wheels for missing setup_requires/tests_require requirements, with the following differences in behavior: + support for python_requires + better support for wheels (proper handling of priority with respect to PEP 425 tags) + PEP 517/518 support + eggs are not supported + no support for the allow_hosts easy_install option (index_url/find_links are still honored) + pip environment variables are honored (and take precedence over easy_install options) * Removed the "upload" and "register" commands in favor of twine. * Add support for the license_files option in setup.cfg to automatically include multiple license files in a source distribution. * Update handling of wheels compatibility tags: * add support for manylinux2010 * fix use of removed 'm' ABI flag in Python 3.8 on Windows * Fix empty namespace package installation from wheel. * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options", enabling plugins like setuptools_scm to configure options on the distribution at finalization time. - Fix build without python2 - Fix License to the correct MIT - use local source dir for pytest imports gh#openSUSE/python-rpm-macros#48 - update to 44.1.0 * Set sys.argv[0] in setup script run by build_meta.__legacy__ * Fix for Python 4: replace unsafe six.PY3 with six.PY2 * Fixed a bug in the “setuptools.finalize_distribution_options” hook that lead to ignoring the order attribute of entry points managed by this hook. * Avoid loading working set during Distribution.finalize_options prior to invoking _install_setup_requires, broken since v42.0.0. - Add wheel subpackage with the generated wheel for this package (bsc#1176262, CVE-2019-20916). - Make wheel a separate build run to avoid the setuptools/wheel build cycle. - Avoid duplicite wheel name in the generated package, and we actually don't need a subpackage at all. - Add remove_mock.patch to remove dependency on the external mock package. - We cannot remove vendored packages when generating setuptools wheel (bsc#1177127). - Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service (ReDoS) in package_index.py. bsc#1206667 - Rename package sources from python- to python3 for PSP (jsc#PED-68, jsc#PED-2217) - Add patch CVE-2024-6345-code-execution-via-download-funcs.patch: * Sanitize any VCS URL we download. (CVE-2024-6345, bsc#1228105) - Switch to multibuild to enable testsuite - Define LANG in %check to fix openSUSE/SLE 15 testsuite - Update to 41.4.0 * In declarative config, now traps errors when invalid python_requires values are supplied. * When storing extras, rely on OrderedSet to retain order of extras as indicated by the packager, which will also be deterministic on Python 2.7 (with PYTHONHASHSEED unset) and Python 3.6+. * Fixed failing integration test triggered by 'long_description_content_type' in packaging. - Add patch to sort outputs for better reproducability: * sort-for-reproducibility.patch - Add missing dep on ordered-set as it is now in the vendored dir too - Try to use system packages rather than the vendored variants - Remove runtime dependency for the full python3 package, as the actually required SSL module is in python3-base. For python(2), SSL is in the "full" python package. Avoids build loops and shortens the dependency chain for e.g. rust. - update to 41.6.0 - add importlib.patch * Replace usage of deprecated imp module with local re-implementation in setuptools._imp * Fix pkg_resources.Requirement hash/equality implementation * Fix tests when running under python3.10. * drop 'deprecated' documentation (test command, ez_setup, EasyInstall) - update to 44.0.0 - last version with python2 support - add testdata.tar.gz -> missing data for testsuite * Drop support for Python 3.4. * include pyproject.toml in source distribution by default. Projects relying on the previous behavior where pyproject.toml * Setuptools once again declares 'setuptools' in the build-system.requires and adds PEP 517 build support by declaring itself as the build-backend * Fix support for easy_install's find-links option in setup.cfg * Build dependencies (setup_requires and tests_require) now install transitive dependencies indicated by extras. * Mark the easy_install script and setuptools command as deprecated, and use pip when available to fetch/build wheels for missing setup_requires/tests_require requirements, with the following differences in behavior: + support for python_requires + better support for wheels (proper handling of priority with respect to PEP 425 tags) + PEP 517/518 support + eggs are not supported + no support for the allow_hosts easy_install option (index_url/find_links are still honored) + pip environment variables are honored (and take precedence over easy_install options) * Removed the "upload" and "register" commands in favor of twine. * Add support for the license_files option in setup.cfg to automatically include multiple license files in a source distribution. * Update handling of wheels compatibility tags: * add support for manylinux2010 * fix use of removed 'm' ABI flag in Python 3.8 on Windows * Fix empty namespace package installation from wheel. * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options", enabling plugins like setuptools_scm to configure options on the distribution at finalization time. - Fix build without python2 - Fix License to the correct MIT - use local source dir for pytest imports gh#openSUSE/python-rpm-macros#48 - update to 44.1.0 * Set sys.argv[0] in setup script run by build_meta.__legacy__ * Fix for Python 4: replace unsafe six.PY3 with six.PY2 * Fixed a bug in the “setuptools.finalize_distribution_options” hook that lead to ignoring the order attribute of entry points managed by this hook. * Avoid loading working set during Distribution.finalize_options prior to invoking _install_setup_requires, broken since v42.0.0. - Add wheel subpackage with the generated wheel for this package (bsc#1176262, CVE-2019-20916). - Make wheel a separate build run to avoid the setuptools/wheel build cycle. - Avoid duplicite wheel name in the generated package, and we actually don't need a subpackage at all. - Add remove_mock.patch to remove dependency on the external mock package. - We cannot remove vendored packages when generating setuptools wheel (bsc#1177127). - Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service (ReDoS) in package_index.py. bsc#1206667 - Rename package sources from python- to python3 for PSP (jsc#PED-68, jsc#PED-2217) - Add patch CVE-2024-6345-code-execution-via-download-funcs.patch: * Sanitize any VCS URL we download. (CVE-2024-6345, bsc#1228105) - update to version 3.6.5: * Importing bug fix for reference leak when an error occurs during dict encoding https://github.com/simplejson/simplejson/issues/109 - additional changes from version 3.6.4: * Important bug fix for dump when only sort_keys is set https://github.com/simplejson/simplejson/issues/106 - additional changes from version 3.6.3: * Documentation updates https://github.com/simplejson/simplejson/issues/103 - additional changes from version 3.6.2: * Documentation updates http://bugs.python.org/issue21514 - additional changes from version 3.6.1: * Documentation updates https://github.com/simplejson/simplejson/issues/102 - additional changes from version 3.6.0: * Automatically strip any UTF-8 BOM from input to more closely follow the latest specs https://github.com/simplejson/simplejson/pull/101 - additional changes from version 3.5.3: * Fix lower bound checking in scan_once / raw_decode API https://github.com/simplejson/simplejson/issues/98 - update to 3.8.2: * Fix implicit cast compiler warning in _speedups.c * simplejson is now available as wheels for OS X and Windows thanks to Travis-CI and AppVeyor respectively! Many thanks to @aebrahim for getting this party started. * Fix issue with iterable_as_array and indent option * Fix typo in keyword argument name introduced in 3.8.0 * New iterable_as_array encoder option to perform lazy serialization of any iterable objects, without having to convert to tuple or list. * Fix typo introduced in 3.7.0 (behavior should be indistinguishable) https://github.com/simplejson/simplejson/commit/e18cc09b688ea1f3305c27616fd3cadd2adc6d31#commitcomment-11443842 * Do not cache Decimal class in encoder, only reference the decimal module. This may make reload work in more common scenarios. * Fix compilation with MSVC https://github.com/simplejson/simplejson/pull/119 * simplejson no longer trusts custom str/repr methods for int, long, float subclasses. These instances are now formatted as if they were exact instances of those types. https://github.com/simplejson/simplejson/issues/118 - Switch to single-spec build - Update to 3.10.0 * Add RawJSON class to allow a faster path for already encoded JSON. - From 3.9.0 * Workaround for bad behavior in string subclasses * Fix warnings flagged by -3 * Update readthedocs documentation links * Add build status badge to README - fix pypi url - update to 3.11.1: * Fix issue with item_sort_key when speedups are available, and add auto-discovery to test suites to prevent similar regressions * docstring fix in JSONEncoder * Call PyObject_IsTrue() only once for the strict argument of scann er * Fix a crash with unencodable encoding in the encoder * Remove unused imports * Remove remnants of Python 2.4 support * Fix argument checking errors in _speedups.c * Remove the `__init__` methods in extension classes * Fix typo in the doc for loads * Add Python 3.6 to testing matrix and PyPI metadata - update to version 3.12.0: * Fix threaded import race condition https://github.com/simplejson/simplejson/issues/184 * Move RawJSON implementation to simplejson.raw_json module * Move JSONDecodeError implementation to simplejson.errors module - update to version 3.13.2: * Fix additional Python 2.x compilation issue on Windows - changes from version 3.13.1 : * Improve CI to catch speedups build regressions * Fix speedups build regression in Python 2.x https://github.com/simplejson/simplejson/issues/193 - changes from version 3.13.0: * Workarounds for NamedTemporaryFile issues with Windows for tool tests * Make TypeError messages contain type name instead of a repr. https://github.com/simplejson/simplejson/pull/191 * Ensure that encoding of text subtypes is consistent with or without speedups https://github.com/simplejson/simplejson/issues/185 - changes from version 3.12.1: * Misc updates to build infrastructure * Fix an assertion failure when make_encoder receives a bad encoder argument https://github.com/simplejson/simplejson/pull/188 * Fix potential crash during GC https://github.com/simplejson/simplejson/pull/187 * Fix a reference leak when sorting keys https://github.com/simplejson/simplejson/pull/186 - Remove bias from description. - specfile: * update copyright year - update to version 3.14.0: * Defer is_raw_json test (performance improvement) https://github.com/simplejson/simplejson/pull/212 * Avoid escaping U+2028 and U+2029 without ensure_ascii https://github.com/simplejson/simplejson/pull/211 * Fix an incorrect type test in Python 2, avoiding an unnecessary unicode copy. https://github.com/simplejson/simplejson/pull/210 - update to version 3.15.0: * Clean up the C code * Bypass the decode() method in bytes subclasses * Support builds without cStringIO * Allow to disable serializing bytes by default in Python 3 * Simplify the compatibility code * Fix tests in Python 2.5 - specfile: * be more specific in %files: %{python_sitearch}/* -> %{python_sitearch}/simplejson* - update to version 3.16.0: * Restore old behavior with regard to the type of decoded empty strings with speedups enabled on Python 2.x https://github.com/simplejson/simplejson/pull/225 * Add python_requires to setup.py to help pip https://github.com/simplejson/simplejson/pull/224 * Fix CSS in docs when built locally https://github.com/simplejson/simplejson/pull/222 - Do not package tests - update to version 3.16.1: * Added examples for JSON lines use cases * Add wheels for more Python versions and platforms - specfile: * update copyright year - update to version 3.17.0: * Updated documentation to be Python 3 first, and have removed documentation notes about version changes that occurred more than five years ago. https://github.com/simplejson/simplejson/pull/257 https://github.com/simplejson/simplejson/pull/254 * Update build matrix for Python 3.8 https://github.com/simplejson/simplejson/pull/255 https://github.com/simplejson/simplejson/pull/256 - update to 3.17.2 - use pytest as testrunner - update to version 3.6.5: * Importing bug fix for reference leak when an error occurs during dict encoding https://github.com/simplejson/simplejson/issues/109 - additional changes from version 3.6.4: * Important bug fix for dump when only sort_keys is set https://github.com/simplejson/simplejson/issues/106 - additional changes from version 3.6.3: * Documentation updates https://github.com/simplejson/simplejson/issues/103 - additional changes from version 3.6.2: * Documentation updates http://bugs.python.org/issue21514 - additional changes from version 3.6.1: * Documentation updates https://github.com/simplejson/simplejson/issues/102 - additional changes from version 3.6.0: * Automatically strip any UTF-8 BOM from input to more closely follow the latest specs https://github.com/simplejson/simplejson/pull/101 - additional changes from version 3.5.3: * Fix lower bound checking in scan_once / raw_decode API https://github.com/simplejson/simplejson/issues/98 - update to 3.8.2: * Fix implicit cast compiler warning in _speedups.c * simplejson is now available as wheels for OS X and Windows thanks to Travis-CI and AppVeyor respectively! Many thanks to @aebrahim for getting this party started. * Fix issue with iterable_as_array and indent option * Fix typo in keyword argument name introduced in 3.8.0 * New iterable_as_array encoder option to perform lazy serialization of any iterable objects, without having to convert to tuple or list. * Fix typo introduced in 3.7.0 (behavior should be indistinguishable) https://github.com/simplejson/simplejson/commit/e18cc09b688ea1f3305c27616fd3cadd2adc6d31#commitcomment-11443842 * Do not cache Decimal class in encoder, only reference the decimal module. This may make reload work in more common scenarios. * Fix compilation with MSVC https://github.com/simplejson/simplejson/pull/119 * simplejson no longer trusts custom str/repr methods for int, long, float subclasses. These instances are now formatted as if they were exact instances of those types. https://github.com/simplejson/simplejson/issues/118 - Switch to single-spec build - Update to 3.10.0 * Add RawJSON class to allow a faster path for already encoded JSON. - From 3.9.0 * Workaround for bad behavior in string subclasses * Fix warnings flagged by -3 * Update readthedocs documentation links * Add build status badge to README - fix pypi url - update to 3.11.1: * Fix issue with item_sort_key when speedups are available, and add auto-discovery to test suites to prevent similar regressions * docstring fix in JSONEncoder * Call PyObject_IsTrue() only once for the strict argument of scann er * Fix a crash with unencodable encoding in the encoder * Remove unused imports * Remove remnants of Python 2.4 support * Fix argument checking errors in _speedups.c * Remove the `__init__` methods in extension classes * Fix typo in the doc for loads * Add Python 3.6 to testing matrix and PyPI metadata - update to version 3.12.0: * Fix threaded import race condition https://github.com/simplejson/simplejson/issues/184 * Move RawJSON implementation to simplejson.raw_json module * Move JSONDecodeError implementation to simplejson.errors module - update to version 3.13.2: * Fix additional Python 2.x compilation issue on Windows - changes from version 3.13.1 : * Improve CI to catch speedups build regressions * Fix speedups build regression in Python 2.x https://github.com/simplejson/simplejson/issues/193 - changes from version 3.13.0: * Workarounds for NamedTemporaryFile issues with Windows for tool tests * Make TypeError messages contain type name instead of a repr. https://github.com/simplejson/simplejson/pull/191 * Ensure that encoding of text subtypes is consistent with or without speedups https://github.com/simplejson/simplejson/issues/185 - changes from version 3.12.1: * Misc updates to build infrastructure * Fix an assertion failure when make_encoder receives a bad encoder argument https://github.com/simplejson/simplejson/pull/188 * Fix potential crash during GC https://github.com/simplejson/simplejson/pull/187 * Fix a reference leak when sorting keys https://github.com/simplejson/simplejson/pull/186 - Remove bias from description. - specfile: * update copyright year - update to version 3.14.0: * Defer is_raw_json test (performance improvement) https://github.com/simplejson/simplejson/pull/212 * Avoid escaping U+2028 and U+2029 without ensure_ascii https://github.com/simplejson/simplejson/pull/211 * Fix an incorrect type test in Python 2, avoiding an unnecessary unicode copy. https://github.com/simplejson/simplejson/pull/210 - update to version 3.15.0: * Clean up the C code * Bypass the decode() method in bytes subclasses * Support builds without cStringIO * Allow to disable serializing bytes by default in Python 3 * Simplify the compatibility code * Fix tests in Python 2.5 - specfile: * be more specific in %files: %{python_sitearch}/* -> %{python_sitearch}/simplejson* - update to version 3.16.0: * Restore old behavior with regard to the type of decoded empty strings with speedups enabled on Python 2.x https://github.com/simplejson/simplejson/pull/225 * Add python_requires to setup.py to help pip https://github.com/simplejson/simplejson/pull/224 * Fix CSS in docs when built locally https://github.com/simplejson/simplejson/pull/222 - Do not package tests - update to version 3.16.1: * Added examples for JSON lines use cases * Add wheels for more Python versions and platforms - specfile: * update copyright year - update to version 3.17.0: * Updated documentation to be Python 3 first, and have removed documentation notes about version changes that occurred more than five years ago. https://github.com/simplejson/simplejson/pull/257 https://github.com/simplejson/simplejson/pull/254 * Update build matrix for Python 3.8 https://github.com/simplejson/simplejson/pull/255 https://github.com/simplejson/simplejson/pull/256 - update to 3.17.2 - use pytest as testrunner - update to version 3.6.5: * Importing bug fix for reference leak when an error occurs during dict encoding https://github.com/simplejson/simplejson/issues/109 - additional changes from version 3.6.4: * Important bug fix for dump when only sort_keys is set https://github.com/simplejson/simplejson/issues/106 - additional changes from version 3.6.3: * Documentation updates https://github.com/simplejson/simplejson/issues/103 - additional changes from version 3.6.2: * Documentation updates http://bugs.python.org/issue21514 - additional changes from version 3.6.1: * Documentation updates https://github.com/simplejson/simplejson/issues/102 - additional changes from version 3.6.0: * Automatically strip any UTF-8 BOM from input to more closely follow the latest specs https://github.com/simplejson/simplejson/pull/101 - additional changes from version 3.5.3: * Fix lower bound checking in scan_once / raw_decode API https://github.com/simplejson/simplejson/issues/98 - update to 3.8.2: * Fix implicit cast compiler warning in _speedups.c * simplejson is now available as wheels for OS X and Windows thanks to Travis-CI and AppVeyor respectively! Many thanks to @aebrahim for getting this party started. * Fix issue with iterable_as_array and indent option * Fix typo in keyword argument name introduced in 3.8.0 * New iterable_as_array encoder option to perform lazy serialization of any iterable objects, without having to convert to tuple or list. * Fix typo introduced in 3.7.0 (behavior should be indistinguishable) https://github.com/simplejson/simplejson/commit/e18cc09b688ea1f3305c27616fd3cadd2adc6d31#commitcomment-11443842 * Do not cache Decimal class in encoder, only reference the decimal module. This may make reload work in more common scenarios. * Fix compilation with MSVC https://github.com/simplejson/simplejson/pull/119 * simplejson no longer trusts custom str/repr methods for int, long, float subclasses. These instances are now formatted as if they were exact instances of those types. https://github.com/simplejson/simplejson/issues/118 - Switch to single-spec build - Update to 3.10.0 * Add RawJSON class to allow a faster path for already encoded JSON. - From 3.9.0 * Workaround for bad behavior in string subclasses * Fix warnings flagged by -3 * Update readthedocs documentation links * Add build status badge to README - fix pypi url - update to 3.11.1: * Fix issue with item_sort_key when speedups are available, and add auto-discovery to test suites to prevent similar regressions * docstring fix in JSONEncoder * Call PyObject_IsTrue() only once for the strict argument of scann er * Fix a crash with unencodable encoding in the encoder * Remove unused imports * Remove remnants of Python 2.4 support * Fix argument checking errors in _speedups.c * Remove the `__init__` methods in extension classes * Fix typo in the doc for loads * Add Python 3.6 to testing matrix and PyPI metadata - update to version 3.12.0: * Fix threaded import race condition https://github.com/simplejson/simplejson/issues/184 * Move RawJSON implementation to simplejson.raw_json module * Move JSONDecodeError implementation to simplejson.errors module - update to version 3.13.2: * Fix additional Python 2.x compilation issue on Windows - changes from version 3.13.1 : * Improve CI to catch speedups build regressions * Fix speedups build regression in Python 2.x https://github.com/simplejson/simplejson/issues/193 - changes from version 3.13.0: * Workarounds for NamedTemporaryFile issues with Windows for tool tests * Make TypeError messages contain type name instead of a repr. https://github.com/simplejson/simplejson/pull/191 * Ensure that encoding of text subtypes is consistent with or without speedups https://github.com/simplejson/simplejson/issues/185 - changes from version 3.12.1: * Misc updates to build infrastructure * Fix an assertion failure when make_encoder receives a bad encoder argument https://github.com/simplejson/simplejson/pull/188 * Fix potential crash during GC https://github.com/simplejson/simplejson/pull/187 * Fix a reference leak when sorting keys https://github.com/simplejson/simplejson/pull/186 - Remove bias from description. - specfile: * update copyright year - update to version 3.14.0: * Defer is_raw_json test (performance improvement) https://github.com/simplejson/simplejson/pull/212 * Avoid escaping U+2028 and U+2029 without ensure_ascii https://github.com/simplejson/simplejson/pull/211 * Fix an incorrect type test in Python 2, avoiding an unnecessary unicode copy. https://github.com/simplejson/simplejson/pull/210 - update to version 3.15.0: * Clean up the C code * Bypass the decode() method in bytes subclasses * Support builds without cStringIO * Allow to disable serializing bytes by default in Python 3 * Simplify the compatibility code * Fix tests in Python 2.5 - specfile: * be more specific in %files: %{python_sitearch}/* -> %{python_sitearch}/simplejson* - update to version 3.16.0: * Restore old behavior with regard to the type of decoded empty strings with speedups enabled on Python 2.x https://github.com/simplejson/simplejson/pull/225 * Add python_requires to setup.py to help pip https://github.com/simplejson/simplejson/pull/224 * Fix CSS in docs when built locally https://github.com/simplejson/simplejson/pull/222 - Do not package tests - update to version 3.16.1: * Added examples for JSON lines use cases * Add wheels for more Python versions and platforms - specfile: * update copyright year - update to version 3.17.0: * Updated documentation to be Python 3 first, and have removed documentation notes about version changes that occurred more than five years ago. https://github.com/simplejson/simplejson/pull/257 https://github.com/simplejson/simplejson/pull/254 * Update build matrix for Python 3.8 https://github.com/simplejson/simplejson/pull/255 https://github.com/simplejson/simplejson/pull/256 - update to 3.17.2 - use pytest as testrunner - Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides: python-urllib3, fixes boo#1138746 - Provides/Obsoletes does not fix the issue: we have a directory-to-symlink switch, which cannot be handled by RPM internally. Assist using pre script (boo#1138715). - Fixup pre script: the migration issue happens when changing from python-urllib3 to python2-urllib3: the number of installed instances of python2-urlliib3 is at this moment 1, unlike in regular updates. This is due to a name change, which consists not of a pure package update. - Use old pytest 3.x as newer do not work with this release * this will be fixed with next release, just spread among numerous fixes in the git for quick backporting - Use have/skip_python2/3 macros to allow building only one flavour - Update to 1.25.5: * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682) * Propagate Retry-After header settings to subsequent retries. (Pull #1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607) * Remove dependency on rfc3986 for URL parsing. * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters. * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652) * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673) - Drop patch urllib3-ssl-default-context.patch - Drop patch python-urllib3-recent-date.patch the date is recent enough on its own - Restrict the tornado dep from tom to 5 or older release as the 6.x changed the API - Updae to 1.25.6: * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692) - Require a new enough release of python-six. 1.25.6 needs at least 1.12.0 for ensure_text() and friends. - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. - Explicitly switch off building python 2 version. - update to 1.25.9 (bsc#1177120, CVE-2020-26137): * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. * Drain connection after ``PoolManager`` redirect (Pull #1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805) * Allow the CA certificate data to be passed as a string (Pull #1804) * Raise ``ValueError`` if method contains control characters (Pull #1800) * Add ``__repr__`` to ``Timeout`` (Pull #1795) - update to 1.25.10: * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull #1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858) - Generate pyc for ssl_match_hostname too - Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail. - Skip test for RECENT_DATE. It is a test purely for developers. To maintain reproducibility, keep upstreams possibly outdated RECENT_DATE in the source code. - Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503) * Improve performance of sub-authority splitting in URL - Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804) gh#urllib3/urllib3#3139 * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. - Add CVE-2023-45803.patch (bsc#1216377, CVE-2023-45803) gh#urllib3/urllib3@4e98d57809da - Add CVE-2024-37891.patch (bsc#1226469, CVE-2024-37891) - Add more test to skip as with new openssl some behaviour changed and we can't rely on them anymore - Skip test_source_address_error as we raise different error with fixes that we provide in new python2/3 - Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides: python-urllib3, fixes boo#1138746 - Provides/Obsoletes does not fix the issue: we have a directory-to-symlink switch, which cannot be handled by RPM internally. Assist using pre script (boo#1138715). - Fixup pre script: the migration issue happens when changing from python-urllib3 to python2-urllib3: the number of installed instances of python2-urlliib3 is at this moment 1, unlike in regular updates. This is due to a name change, which consists not of a pure package update. - Use old pytest 3.x as newer do not work with this release * this will be fixed with next release, just spread among numerous fixes in the git for quick backporting - Use have/skip_python2/3 macros to allow building only one flavour - Update to 1.25.5: * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682) * Propagate Retry-After header settings to subsequent retries. (Pull #1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607) * Remove dependency on rfc3986 for URL parsing. * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters. * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652) * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673) - Drop patch urllib3-ssl-default-context.patch - Drop patch python-urllib3-recent-date.patch the date is recent enough on its own - Restrict the tornado dep from tom to 5 or older release as the 6.x changed the API - Updae to 1.25.6: * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692) - Require a new enough release of python-six. 1.25.6 needs at least 1.12.0 for ensure_text() and friends. - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. - Explicitly switch off building python 2 version. - update to 1.25.9 (bsc#1177120, CVE-2020-26137): * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. * Drain connection after ``PoolManager`` redirect (Pull #1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805) * Allow the CA certificate data to be passed as a string (Pull #1804) * Raise ``ValueError`` if method contains control characters (Pull #1800) * Add ``__repr__`` to ``Timeout`` (Pull #1795) - update to 1.25.10: * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull #1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858) - Generate pyc for ssl_match_hostname too - Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail. - Skip test for RECENT_DATE. It is a test purely for developers. To maintain reproducibility, keep upstreams possibly outdated RECENT_DATE in the source code. - Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503) * Improve performance of sub-authority splitting in URL - Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804) gh#urllib3/urllib3#3139 * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. - Skip test_source_address_error as we raise different error with fixes that we provide in new python2/3 - Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides: python-urllib3, fixes boo#1138746 - Provides/Obsoletes does not fix the issue: we have a directory-to-symlink switch, which cannot be handled by RPM internally. Assist using pre script (boo#1138715). - Fixup pre script: the migration issue happens when changing from python-urllib3 to python2-urllib3: the number of installed instances of python2-urlliib3 is at this moment 1, unlike in regular updates. This is due to a name change, which consists not of a pure package update. - Use old pytest 3.x as newer do not work with this release * this will be fixed with next release, just spread among numerous fixes in the git for quick backporting - Use have/skip_python2/3 macros to allow building only one flavour - Update to 1.25.5: * Add mitigation for BPO-37428 affecting Python <3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682) * Propagate Retry-After header settings to subsequent retries. (Pull #1607) * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607) * Remove dependency on rfc3986 for URL parsing. * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters. * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652) * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673) - Drop patch urllib3-ssl-default-context.patch - Drop patch python-urllib3-recent-date.patch the date is recent enough on its own - Restrict the tornado dep from tom to 5 or older release as the 6.x changed the API - Updae to 1.25.6: * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692) - Require a new enough release of python-six. 1.25.6 needs at least 1.12.0 for ensure_text() and friends. - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. - Explicitly switch off building python 2 version. - update to 1.25.9 (bsc#1177120, CVE-2020-26137): * Added ``InvalidProxyConfigurationWarning`` which is raised when erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently support connecting to HTTPS proxies but will soon be able to and we would like users to migrate properly without much breakage. * Drain connection after ``PoolManager`` redirect (Pull #1817) * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812) * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805) * Allow the CA certificate data to be passed as a string (Pull #1804) * Raise ``ValueError`` if method contains control characters (Pull #1800) * Add ``__repr__`` to ``Timeout`` (Pull #1795) - update to 1.25.10: * Added support for ``SSLKEYLOGFILE`` environment variable for logging TLS session keys with use with programs like Wireshark for decrypting captured web traffic (Pull #1867) * Fixed loading of SecureTransport libraries on macOS Big Sur due to the new dynamic linker cache (Pull #1905) * Collapse chunked request bodies data and framing into one call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906) * Don't insert ``None`` into ``ConnectionPool`` if the pool was empty when requesting a connection (Pull #1866) * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858) - Generate pyc for ssl_match_hostname too - Add CI variable, which makes timeouts in the test suite longer (gh#urllib3/urllib3#2109, bsc#1176389) and test_timeout_errors_cause_retries should not fail. - Skip test for RECENT_DATE. It is a test purely for developers. To maintain reproducibility, keep upstreams possibly outdated RECENT_DATE in the source code. - Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503) * Improve performance of sub-authority splitting in URL - Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804) gh#urllib3/urllib3#3139 * Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. - Add CVE-2023-45803.patch (bsc#1216377, CVE-2023-45803) gh#urllib3/urllib3@4e98d57809da - Add COPYING file - Fix specfile to be able to build for python3 - version 0.6 - Let zypp-plugin-python provide python2-zypp-plugin to be consistent with python3-zypp-plugin. - version 0.6.1 - Don't use a shebang in the module - version 0.6.2 - Switch to singlespec packaging to make it easy to disable either python3 or python2 plugin and make sure all is buildable - version 0.6.3 - Fix a bit the obsoletes/provides to allow migration, previously was overwritten by macros - BR python-rpm-macros to build on older distributions - Fix bit python detection conditions on install phase to be better readable and uniform - Disable singlespec packaging in SLE12* and older distros while it's not working there. They provide python2 packages only. - Provide python3-zypp-plugin in SLE12-SP3 (bsc#1081596) - Provide python3-zypp-plugin down to SLE12 (bsc#1081596) - singlespec in Tumbleweed must support multiple python3 flavors in the future gh#openSUSE/python-rpm-macros#66 - Fix stomp header regex to include '-' (bsc#1227793) - version 0.6.4 - Add COPYING file - Fix specfile to be able to build for python3 - version 0.6 - Let zypp-plugin-python provide python2-zypp-plugin to be consistent with python3-zypp-plugin. - version 0.6.1 - Don't use a shebang in the module - version 0.6.2 - Switch to singlespec packaging to make it easy to disable either python3 or python2 plugin and make sure all is buildable - version 0.6.3 - Fix a bit the obsoletes/provides to allow migration, previously was overwritten by macros - BR python-rpm-macros to build on older distributions - Fix bit python detection conditions on install phase to be better readable and uniform - Disable singlespec packaging in SLE12* and older distros while it's not working there. They provide python2 packages only. - Provide python3-zypp-plugin in SLE12-SP3 (bsc#1081596) - Provide python3-zypp-plugin down to SLE12 (bsc#1081596) - singlespec in Tumbleweed must support multiple python3 flavors in the future gh#openSUSE/python-rpm-macros#66 - Fix stomp header regex to include '-' (bsc#1227793) - version 0.6.4 - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Update to edk2-stable202111 - Features (https://github.com/tianocore/edk2/releases): Add SSDT CPU topology generator Support ACPI 6.4 in GTDT parser and generator Support ACPI 6.4 in DynamicTables FADT parser Support ACPI 6.4 in Acpiview PCCT parser Support ACPI 6.4 in Acpiview HMAT parser Add support for the microvm machine type (qemu) OVMF/ArmVirt: add support for virtio-mmio 1.0 IntelFsp2Pkg: adopt FSP 2.3 specification UefiCpuPkg VTF0 X64: Build page tables using Linear-Address Translation to a 1-GByte Page Enable wildcard host name matching in HTTPS/TLS implementation Add QuickSort function into BaseLib Add SMM NV variable support in universal UEFI payload Add TDVF to OvmfPkg Make package and platform builds reproducible across source format changes - Patches (git log --oneline --reverse edk2-stable202108~..edk2-stable202111): 7b4a99be8a CryptoPkg: BaseCryptLib fix incorrect param order 82f7e315d6 MdeModulePkg/PeiCore: Remove MigrateSecModulesInFv() 8b15024dc7 Maintainers: Add kraxel as Reviewer to ArmVirtPkg and OvmfPkg 80e67af9af OvmfPkg: introduce a common work area ab77b6031b OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b2 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm a82bad9730 ArmPkg/GicV3Dxe: Don't signal EOI on arbitrary interrupts 94e465e5cb OvmfPkg/Virtio10: Add virtio-mmio 1.0 defines 08293e43da OvmfPkg/VirtioMmioDeviceLib: Add virtio 1.0 detection. 212a2b9bb8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Fix SetPageSize. 537a724421 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Fix SetQueueAddress 6a3e9576b8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Add default QueueNum ae12188cf8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Adapt feature bit handling 77d5fa8024 OvmfPkg/VirtioMmioDeviceLib: enable virtio 1.0 b04453d36b MdeModulePkg/EbcDxe: Mitigate memcpy intrinsics dc995ce906 MdeModulePkg: Add BootDiscoveryPolicyOld variable. 443300be46 MdePkg:Update IndustryStandard/Nvme.h with Nvme amdin controller data 0f11537548 MdeModulePkg:Increase Nvme capacity display cae735f613 ArmPkg: Enable boot discovery policy for ARM package. cb0d24637d OvmfPkg/OvmfXen: set PcdAcpiS3Enable at initialization 28152333bc OvmfPkg/LockBoxLib: use PcdAcpiS3Enable to detect S3 support 52e2dabc0f OvmfPkg/PlatformBootManagerLib: use PcdAcpiS3Enable to detect S3 support 5b5f10d746 OvmfPkg/SmmControl2Dxe: use PcdAcpiS3Enable to detect S3 support 9f3eda177a OvmfPkg/OvmfXen: add QemuKernelLoaderFsDxe f0fe55bca4 UefiPayloadPkg: Fix the build error when enable Core ci for UefiPayloadPkg 5d34cc49d5 UefiCpuPkg/PiSmmCpuDxeSmm: Update mPatchCetSupported set condition cdda3f74a1 UefiPayloadPkg/UefiPayloadEntry: Fix memory corruption 3b3f882288 MdeModulePkg/PiSmmCore: Drop deprecated image profiling commands b170806518 UefiCpuPkg: Clean up save state boundary checks and comments. 12e33dca4c IntelFsp2Pkg: Support Config File and Binary delta comparison 63fddc98e0 UefiPayloadPkg: Create .yaml file in UefiPayloadPkg e3ee8c8dbd .azurepipelines: Add UefiPayloadPkg in gate-build-job.yml and CISetting.py b6bc203375 MdeModulePkg/HiiDatabaseDxe:remove dead code block c5e805ffe1 MdeModulePkg: Fix typo of "memory" in RamDiskDxe debug message 81d71fb86e Maintainers.txt: Update maintainer/reviewer roles in MdeModulePkg edf8bc6d24 SecurityPkg/MemoryOverwriteControl: Add missing argument to DEBUG print 4473834e7d OvmfPkg/OvmfXen: Fix build with QemuKernelLoaderFsDxe a7cf2c5664 RedfishPkg: Fix various typos 851785ea67 UefiPayloadPkg: Include more modules in UefiPayloadPkg. d248516b3a UefiPayloadPkg: Include Network modules in UefiPayloadPkg. 6c7d6d4a5e UefiCpuPkg: ResetVector Tool Support for Python 3 cf7c650592 UefiCpuPkg: ResetVector Tool additional debug prints d96df7e993 UefiPayloadPkg: Fix the bug in dump guid HOB info functions dcd3d63f4f UefiPayloadPkg: Dump hob info from gEdkiiBootManagerMenuFileGuid 610d8073f2 SecurityPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from edk2-platforms 4d5f39cd22 SecurityPkg/TPM: Fix bugs in imported PeiDxeTpmPlatformHierarchyLib ebbc8ab2cd SecrutiyPkg/Tcg: Import Tcg2PlatformDxe from edk2-platforms 2906e572c6 SecurityPkg/Tcg: Make Tcg2PlatformDxe buildable and fix style issues f108178c56 SecurityPkg: Introduce new PCD PcdRandomizePlatformHierarchy a4867dea2a SecurityPkg/Tcg: Import Tcg2PlatformPei from edk2-platforms 2fa89c8e11 SecurityPkg/Tcg: Make Tcg2PlatformPei buildable and fix style issues 3b69fcf5f8 SecurityPkg: Add references to header and inf files to SecurityPkg 6c80564b89 MdeModulePkg/Core/Pei: Fix typo in function descriptions 6f501a7c9b MdeModulePkg/Core/Pei: Make migrated PEIM message verbose c19d18136e MdeModulePkg/Core/Pei: Fix pointer size mismatch in EvacuateTempRam() f4e72cf9d6 UefiPayloadPkg: Add script to build UniversalPayload in UefiPayloadPkg bda3546c55 UefiPayloadPkg: Fix the warning when building UefiPayloadPkg with IA32+X64 010753b7e7 UefiCpuPkg: Refactor initialization of CPU features during S3 resume 89f7ed8b29 UefiCpuPkg: Prevent from re-initializing CPU features during S3 resume 60d8bb9f28 UefiCpuPkg: VTF0 Linear-Address Translation to a 1-GByte Page till 512GB ac6388add4 ArmPkg/ProcessorSubClassDxe: Fix the format of ProcessorId e3e47d7963 UefiCpuPkg: SecCoreNative without ResetVector 542cba73d2 SecurityPkg: Add debug log for indicating IBB verified OBB successfully f334c5a41d IntelFsp2WrapperPkg: Make PcdFspModeSelection dynamic 79019c7a42 OvmfPkg: set a default value for the WorkAreaHeader PCD fdeff3fdae EmbeddedPkg: Remove duplicate libfdt.h include f2a7e24e38 EmbeddedPkg: AndroidBootImgBoot error handling updates c0cd26f43c EmbeddedPkg: Install FDT if UpdateDtb is not present 7ea7f9c077 EmbeddedPkg: Add LoadFile2 for linux initrd d60915b751 UefiPayloadPkg: Add Macro to enable or disable some drivers. 46b4606ba2 MdeModulePkg/PciBusDxe: Improve the flow of testing support attributes f57040b038 MdeModulePkg/BootManagerMenuApp: Limit string drawing within one line b0f1b1c5fd MdePkg: Fix DEVICE_SECURITY_EVENT_DATA_HEADER version definition cc5a67269e UefiPayloadPkg: Build a HOB from bootloader ACPI table dc430ccf3f UefiPayloadPkg: Use dummy constructor for PlatformHookLib 4a1899dd79 UefiPayloadPkg: Add ".upld_info" in universal payload 2ea0a0a414 BaseTools: Switch to downloading the ARM compiler from Arm's site 1ce6ceb75b BaseTools: Switch to downloading the AARCH64 compiler from Arm's site c214128a38 BaseTools/GenMake: Use ToolDefinition as fallback option 259c184c8f BaseTools/build: Set MakefileName 445c39f757 BaseTools: Remove Makefile/MakefileName fields c7d5b046d9 BaseTools: Remove hard-coded strings for target and tools_def 442e46d3b6 UefiPayloadPkg: Update maximum logic processor to 256 499c4608b1 OvmfPkg/TPM PPI: Connect default consoles for user interaction b8675deaa8 OvmfPkg: Handle TPM 2 physical presence opcodes much earlier 8ab8fbc016 OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compilation bd298d7593 OvmfPkg: Reference new Tcg2PlatformPei in the build system f86de75862 MdePkg: MmCommunication: Added definition of MM Communication PPI 8b4bb94f64 MdePkg: CI YAML: Added new GUID to ignore duplicate list 9e950cda6a MdeModulePkg: CI YAML: Added new GUID to ignore duplicate list 2273799677 SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start 422e5d2f7f UefiPayloadPkg: Remove asm code and sharing libraries 0875443f7e DynamicTablesPkg: Extract AcpiHelperLib from TableHelperLib 20775950c6 DynamicTablesPkg: Update TableHelperLib.inf 1ad5182500 DynamicTablesPkg: Rename single char input parameter 653113412f DynamicTablesPkg: Add HexFromAscii() to AcpiHelperLib 72ab552554 DynamicTablesPkg: Add AmlGetEisaIdFromString() to AcpiHelperLib 96e006b37e DynamicTablesPkg: Add Configuration Manager Object parser 235ff9fcd1 DynamicTablesPkg: Use %a formatter in AmlDbgPrint 7a8c037e9e DynamicTablesPkg: Update DynamicTablesPkg.ci.yaml 691c5f7762 DynamicTablesPkg: Deprecate Crs specific methods in AmlLib 22873f58c4 DynamicTablesPkg: Rework AmlResourceDataCodegen.c/h 4cc1458dbe IntelFsp2Pkg: Adopt FSP 2.3 specification. c49cb8f30e ArmPkg: SmbiosMiscDxe: Don't populate ExtendedBiosSize when size < 16MB 282122ec5f ArmVirtPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib b3685956d2 ArmVirtPkg: Reference new TPM classes in the build system for compilation c806b76865 ArmVirtPkg: Disable the TPM2 platform hierarchy 606340fba3 OvmfPkg/Microvm: copy OvmfPkgX64 files as-is 4932f05a00 OvmfPkg/Microvm: rename output files, fix includes 2a49c19b9e OvmfPkg/Microvm: no smm 60d55c4156 OvmfPkg/Microvm: no secure boot 0569c52b15 OvmfPkg/Microvm: no tpm 06fa1f1931 OvmfPkg/Microvm: no sev 6073bf6cd8 OvmfPkg/Microvm: no csm b9dd64b80e OvmfPkg/Microvm: no emulated scsi 27de86ae41 OvmfPkg/Microvm: use MdePkg/Library/SecPeiDxeTimerLibCpu 76602f45dc OvmfPkg/Microvm: use XenTimerDxe (lapic timer) 6a8e9ad24b OvmfPkg/Microvm: PlatformPei/MemDetect tweaks 8583b57c5c OvmfPkg/Microvm: PlatformPei/Platform memory map tweaks bf02d73e74 OvmfPkg/Microvm: PlatformPei/Platform: add id. 1d3e89f349 OvmfPkg/ResetSystemLib: add driver for microvm 2c467c9be2 OvmfPkg/Microvm: BdsPlatform: PciAcpiInitialization tweak. 8456785986 OvmfPkg/Microvm: use PciHostBridgeLibNull 55f47d2299 OvmfPkg/Microvm: wire up serial console, drop super-io 862e814de4 OvmfPkg/Microvm: add Maintainers.txt entry 06a326caf1 DynamicTablesPkg: Update FADT generator to ACPI 6.4 f09dbf20b9 DynamicTablesPkg: Rename SBSA generic watchdog 942c9bd357 ShellPkg: Update Acpiview GTDT parser to ACPI 6.4 80e67bcb23 ShellPkg: Update Acpiview PCCT parser to ACPI 6.4 b4da6c29f1 ShellPkg: Add Type 5 PCC Subspace Structure parser 5ece2ad36c MdeModulePkg/Core/Dxe: Add lock protection in CoreLocateHandleBuffer() 30400318a2 ShellPkg: Update Acpiview HMAT parser to ACPI spec version 6.4 71c3c9c0c4 DynamicTablesPkg: Remove unnecessary includes 25cf58a163 DynamicTablesPkg: Add missing parameter check bfaf7c8b9e DynamicTablesPkg: Add AddSsdtAcpiHeader() 28b2df475f DynamicTablesPkg: Add AmlRdSetEndTagChecksum() 74addfeab6 DynamicTablesPkg: Add AmlSetRdListCheckSum() 7b2022d39e DynamicTablesPkg: Set EndTag's Checksum if RdList is modified 2dd7dd3952 DynamicTablesPkg: Clear pointer in node creation fcts 37bd08176c DynamicTablesPkg: Update error handling for node creation 6d2777d85f DynamicTablesPkg: Make AmlNodeGetIntegerValue public f995f8672b DynamicTablesPkg: AML Code generation for Register() 9454d1ebcb DynamicTablesPkg: AML Code generation for Resource data EndTag 1e33479b39 DynamicTablesPkg: AML code generation for a Package 12e65fd258 DynamicTablesPkg: Helper function to compute package length ce15936f2f DynamicTablesPkg: AML code generation for a ResourceTemplate de62ccbf4f DynamicTablesPkg: AML code generation for a Method e2d7b4950b DynamicTablesPkg: AML code generation to Return a NameString 3e958e93ce DynamicTablesPkg: AML code generation for a Method returning a NS 018a962d92 DynamicTablesPkg: AML code generation for a _LPI object a5e36ad9bc DynamicTablesPkg: AML code generation to add an _LPI state f17ef10e63 DynamicTablesPkg: Add CM_ARM_LPI_INFO object 769e63999f DynamicTablesPkg: SSDT CPU topology and LPI state generator 19ee56c4b3 UefiPayloadPkg: Add a macro to select the SecurityStubDxe driver. 782d018703 MdePkg: Add ProcessorUpgradeSocketLGA4677 from SMBIOS 3.5.0 ba4ae92234 ShellPkg: Support ProcessorUpgradeSocketLGA4677 from SMBIOS 3.5.0 f22feb0e3b CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in Pkcs7Verify() 4225a464c6 MdePkg/BaseLib: Add QuickSort function on BaseLib 6ed6abd6c1 BaseTools: Change RealPath to AbsPath 978d428ec3 UefiPayloadPkg: Add PCI root bridge info hob support for SBL 43b3840873 MdeModulePkg/Sd: Corrections for Extra.uni files a7fcab7aa3 MdeModulePkg/Core/Dxe: Acquire a lock when iterating gHandleList e40fefafa9 ArmVirtPkg/FdtClintDxe: Move FdtClientDxe to EmbeddedPkg fb759b8b73 MdePkg: Add PcdPciIoTranslation PCD 7d78a86ecf ArmPkg: Use PcdPciIoTranslation PCD from MdePkg 77e9b3a7c6 ArmVirtPkg/FdtPciPcdProducerLib: Relocate PciPcdProducerLib to OvmfPkg d881c6ddf5 ArmVirtPkg/HighMemDxe: Relocate HighMemDxe to OvmfPkg 47bd85e9f9 OvmfPkg/HighMemDxe: Add RISC-V in the supported arch. f8d0501ded ArmVirtPkg/QemuFwCfgLib: Relocate QemuFwCfgLib to OvmfPkg 26aa241d2f OvmfPkg/QemuFwCfgLibMmio: Add RISC-V arch support c6770f4b88 MdePkg: Add PcdPciMmio32(64)Translation PCDs 9a7509e465 ArmVirtPkg/FdtPciHostBridgeLib: Relocate FdtPciHostBridgeLib to OvmfPkg/Fdt b21c6794de OvmfPkg/FdtPciHostBridgeLib: Add RISC-V in the supported arch. e0c23cba5e ArmVirtPkg/VirtioFdtDxe: Relocate VirtioFdtDxe to OvmfPkg/Fdt f2400e06db BaseTools: add edk2-test repo to SetupGit.py 785cfd3305 UefiPayloadPkg: Use SECURITY_STUB_ENABLE to control the SecurityStubDxe 7e43d3e086 ArmPkg/Smbios: Fix max cache size 2 wrong issue f10a112f08 UefiPayloadPkg: Fix the build issue for coreboot 2108698346 StandaloneMmPkg: Support CLANGPDB builds 11a4af85a4 Ovmfpkg: update Ia32 build to use new work area 36b561623a OvmfPkg/AmdSev: update the fdf to use new workarea PCD 91a978ce7e UefiPayloadPkg: Replace MEMROY_ENTRY by MEMORY_ENTRY 6ef5797447 UefiPayloadPkg: Fix ECC reported issues 90246a6d9f UefiPayloadPkg: Fix the build failure for non-universal payload 37a33f02aa UefiCpuPkg: Cpu feature data stored in memory may be migrated 4fdf843c75 DynamicTablesPkg: Fix unitialized variable use 6893865b30 DynamicTablesPkg: Fix void pointer arithmetic 99325a8b65 MdeModulePkg/SortLib: Add QuickSort function on BaseLib 305fd6bee0 UefiCpuPkg/CpuCacheInfoLib: Add QuickSort function on BaseLib 2f286930a8 ShellPkg: Parse I/O APIC and x2APIC structure bd5ec03d87 NetworkPkg/HttpBootDxe: make file extension check case-insensitive 6254037223 ArmPkg: Implement PlatformBootManagerLib for LinuxBoot f079e9b450 OvmfPkg: Copy Main.asm from UefiCpuPkg to OvmfPkg's ResetVector 5a2411784b OvmfPkg: Clear WORK_AREA_GUEST_TYPE in Main.asm c9ec74a198 OvmfPkg: Add IntelTdxMetadata.asm 8b76f23534 OvmfPkg: Enable TDX in ResetVector 87a34ca0cf UefiPayloadPkg: Add a common SmmAccessDxe module e7e8ea27d4 UefiPayloadPkg: Add a common SMM control Runtime DXE module bed990aae6 UefiPayloadPkg: Add bootloader SMM support module 1d66480aa4 UefiPayloadPkg: Add SpiFlashLib 04714cef46 UefiPayloadPkg: Add FlashDeviceLib ae8acce8ae UefiPayloadPkg: Add a common FVB SMM module 242dcfe30f UefiPayloadPkg: Add a SMM dispatch module b80c17b62d UefiPayloadPkg: Add SMM support and SMM variable support 2f6f3329ad FmpDevicePkg/FmpDxe: Use new Variable Lock interface 9a95d11023 IntelFsp2Pkg/SplitFspBin.py: adopt FSP 2.3 specification. bb146ce32d MdePkg Cpuid.h: Define CPUID.(EAX=7,ECX=0):EDX[30] 1bc232aae3 RedfishPkg: Update link to staging/RedfishClientPkg in Readme.md e7663fdd82 UefiPayloadPkg: Remove SystemTableInfo GUID. 91b772ab62 RedfishPkg: Add more information to Readme.md c8594a5311 SecurityPkg/FvReportPei: Remove the ASSERT to allow neither M nor V 939c2355da IntelFsp2Pkg SplitFspBin.py: Correct file name in file header 6f9e83f757 NetworkPkg/HttpDxe: Enable wildcard host name matching for HTTP+TLS. b258f12889 BaseTools/VrfCompile: Fix uninitialized field from unnamed field 0f4cdad25b DynamicTablesPkg: Add missing BaseStackCheckLib instance e13e53cb2f NetworkPkg/NetworkPkg.dsc: Add RngLib mapping for ARM and RISCV64 c1f2287635 SecurityPkg/SecurityPkg.dsc: Add missing RngLib for ARM and RISCV64 b0a03ca4a9 SignedCapsulePkg/SignedCapsulePkg.dsc: Add RngLib mapping 15e635d1b5 UefiCpuPkg/MtrrLib/UnitTest: Fix 32-bit GCC build issues 4050c873b5 MdeModulePkg/Variable/RuntimeDxeUnitTest: Fix 32-bit GCC builds d79df34beb BaseTools: Fix StructurePcd offset error. b5d4a35d90 MdeModulePkg/XhciSched: Fix missing DEBUG arguments 48452993ad MdePkg/Include: Enhance DebugLib to support reproduce builds 5948ec3647 MdePkg: Reproduce builds across source format changes f331310a10 ArmPkg: Reproduce builds across source format changes 77dcd03ecf MdeModulePkg: Reproduce builds across source format changes 45137bca2f NetworkPkg: Reproduce builds across source format changes d939a25d41 SecurityPkg: Reproduce builds across source format changes fd42dcb1fc OvmfPkg: Reproduce builds across source format changes 8c1b1fe634 ShellPkg: Add comment that ItemPtr is set after validation d6e6337cd6 MdePkg: Fix ACPI memory aggregator/device type mismatch c974257821 MdeModulePkg AtaAtapiPassThru: Always do S.M.A.R.T. check if device support aab6bb3d32 MdeModulePkg/DxeCapsuleLibFmp: Capsule on Disk file name capsule a7b35aae13 MdeModulePkg\UfsBlockIoPei: UFS MMIO address size support both 32/64 bits f826b20811 UefiCpuPkg/UefiCpuLib: Add GetCpuFamilyModel and GetCpuSteppingId 8c8867c5da MdeModulePkg/DxeCapsuleLibFmp: Use new Variable Lock interface 22c3b5a865 BaseTools: Add authenticated variable store support a92559671a OvmfPkg/Xen: Fix VS2019 build issues 4c495e5e3d OvmfPkg/Bhyve/PlatformPei: Fix VS2019 X64 NOOPT build issue 466ebdd2e0 MdeModulePkg/FPDT: Lock boot performance table address variable at EndOfDxe 455b0347a7 UefiCpuPkg/PiSmmCpuDxeSmm: Use SMM Interrupt Shadow Stack e1e7306b54 OvmfPkg/Library/ResetSystemLib: Fix Microvm VS2019 NOOPT build issue 4c7ce0d285 MdeModulePkg AtaAtapiPassThru: Skip the potential NULL pointer access bb1bba3d77 NetworkPkg: Fix invalid pointer for DNS response token on error - Removed patches which are merged to mainline: - ovmf-OvmfPkg-OvmfXen-set-PcdAcpiS3Enable-at-initializatio.patch to fix the S3 detection in ovmf-xen - cb0d24637d edk2-stable202111-rc1~220 - ovmf-OvmfPkg-OvmfXen-add-QemuKernelLoaderFsDxe.patch to add QemuKernelLoaderFsDxe to ovmf-xen to load kernel from qemu fw_cfg - 9f3eda177a edk2-stable202111-rc1~216 - ovmf-OvmfPkg-OvmfXen-Fix-build-with-QemuKernelLoaderFsDxe.patch - 4473834e7d edk2-stable202111-rc1~203 - The edk2-stable202111 includes the following patches for bsc#1192126 to fix unlimited reset. (bsc#1192126) 80e67af9af OvmfPkg: introduce a common work area ab77b6031b OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b2 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm - Removed useless patch files because they are merged to edk2-stable202111 - ovmf-OvmfPkg-OvmfXen-Fix-build-with-QemuKernelLoaderFsDxe.patch - ovmf-OvmfPkg-OvmfXen-add-QemuKernelLoaderFsDxe.patch - ovmf-OvmfPkg-OvmfXen-set-PcdAcpiS3Enable-at-initializatio.patch - Updated URL to the edk2 repo on github - Use downloaded edk2-edk2-stable%{version}.tar.gz instead of the URL for Source0 because the edk2-edk2-stable202111 tarball is broken in tianocore repo which can not pass the "osc service runall download_files" testing. - We ill change it back to the following setting when upstream fixed tarball: Source0: https://github.com/tianocore/edk2/releases/download/edk2-stable%{version}/edk2-edk2-stable%{version}.tar.gz - Modified gdb_uefi.py.in for python3 (bsc#1192126) - change 'long' to 'int' - using print (' instead of print " - Sort file lists for reproducible build results - Update to edk2-stable202202 - Features (https://github.com/tianocore/edk2/releases): OvmfPkg Add new target for Cloud Hypervisor Add TDVF to OvmfPkg Add new APIs to UefiCpuPkg/UefiCpuLib Add AMD Secure Nested Paging Support Add SSDT PCI generator in DynamicTablesPkg Support ACPI 6.4 PPTT changes Add FdtHwInfoParser library Add DynamicPlatRepo library Make package and platform builds reproducible across source format changes Add Uncrustify CI Plugin Apply uncrustify changes to all package C and H files - Patches (git log --oneline --reverse edk2-stable202111~..edk2-stable202202): bb1bba3d77 NetworkPkg: Fix invalid pointer for DNS response token on error ef9a059cdb EmulatorPkg/Win/Host: Update CC_FLAGS 69877614fd .pytool/Plugin/EccCheck: Remove RevertCode() 854462bd34 .pytool/Plugin/EccCheck: Remove temp directory on exception 3019f1bbab .pytool/Plugin/EccCheck: Add performance optimizations 99f84ff473 .pytools/Plugin/LicenseCheck: Use temp directory for git diff output 76a1ce4d5f .azurepipelines/templates: Update max pipeline job time to 2 hours 365dced2c3 ArmPkg: Update YAML to ignore specific ECC files/errors 1939fc9569 ArmPlatformPkg: Update YAML to ignore specific ECC files/errors c97fee87f0 ArmVirtPkg: Update YAML to ignore specific ECC files/errors d5744ecba8 CryptoPkg: Update YAML to ignore specific ECC files/errors d7d30e8f21 EmulatorPkg: Update YAML to ignore specific ECC files/errors 9deb937076 MdeModulePkg: Update YAML to ignore specific ECC files/errors df790cd6b3 MdePkg: Update YAML to ignore specific ECC files/errors 60fa40be45 SecurityPkg: Update YAML to ignore specific ECC files/errors 9944508e85 ShellPkg: Update YAML to ignore specific ECC files/errors c30c40d6c6 StandaloneMmPkg: Update YAML to ignore specific ECC files/errors c057347977 UefiPayloadPkg: Update YAML to ignore specific ECC files/errors f0f3f5aae7 UnitTestFrameworkPkg: Update YAML to ignore specific ECC files/errors dfafa8e453 MdeModulePkg/DxeCorePerformanceLib:Variable Initial a4a582e180 ArmPkg: Change use of EFI_D_* to DEBUG_* 1d2482e1e3 ArmPlatformPkg: Change use of EFI_D_* to DEBUG_* c5b3a56e4f ArmVirtPkg: Change use of EFI_D_* to DEBUG_* a1878955b2 EmbeddedPkg: Change use of EFI_D_* to DEBUG_* 9c7da8d804 EmulatorPkg: Change use of EFI_D_* to DEBUG_* 917e98f3e5 FatPkg: Change use of EFI_D_* to DEBUG_* 87000d7708 MdeModulePkg: Change use of EFI_D_* to DEBUG_* 5f289f3ae3 MdePkg: Change use of EFI_D_* to DEBUG_* c49ca4a29e NetworkPkg: Change use of EFI_D_* to DEBUG_* 47719926e8 OvmfPkg: Change use of EFI_D_* to DEBUG_* ca56749b0e PcAtChipsetPkg: Change use of EFI_D_* to DEBUG_* e905fbb05a SecurityPkg: Change use of EFI_D_* to DEBUG_* 4a1aee13d8 ShellPkg: Change use of EFI_D_* to DEBUG_* 586fda4800 SourceLevelDebugPkg: Change use of EFI_D_* to DEBUG_* 96e1cba5c1 UefiCpuPkg: Change use of EFI_D_* to DEBUG_* 1871d28eaf ArmPkg: Change OPTIONAL keyword usage style 2863ba97ca ArmPlatformPkg: Change OPTIONAL keyword usage style 9607597a74 ArmVirtPkg: Change OPTIONAL keyword usage style c8f46130f8 CryptoPkg: Change OPTIONAL keyword usage style fe2d81892f DynamicTablesPkg: Change OPTIONAL keyword usage style 792433088c EmbeddedPkg: Change OPTIONAL keyword usage style c69fc80c80 EmulatorPkg: Change OPTIONAL keyword usage style 9c721071d3 FmpDevicePkg: Change OPTIONAL keyword usage style e3917e22e7 MdeModulePkg: Change OPTIONAL keyword usage style d0e2f8232a MdePkg: Change OPTIONAL keyword usage style 8874fa199d NetworkPkg: Change OPTIONAL keyword usage style 79d49e162e OvmfPkg: Change OPTIONAL keyword usage style 237295f46d PcAtChipsetPkg: Change OPTIONAL keyword usage style dc8fe5ec95 RedfishPkg: Change OPTIONAL keyword usage style 12710fe93b SecurityPkg: Change OPTIONAL keyword usage style 9b8507cabe ShellPkg: Change OPTIONAL keyword usage style 18908e6131 SignedCapsulePkg: Change OPTIONAL keyword usage style f9c9215b55 SourceLevelDebugPkg: Change OPTIONAL keyword usage style 902e76de19 StandaloneMmPkg: Change OPTIONAL keyword usage style 4ec586b9f6 UefiCpuPkg: Change OPTIONAL keyword usage style e35dd32821 UefiPayloadPkg: Change OPTIONAL keyword usage style 78bc3bdd2a UnitTestFrameworkPkg: Change OPTIONAL keyword usage style ea85f0fe13 ArmVirtPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() e3b855f283 CryptoPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 4a9d411662 DynamicTablesPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() db52c7f755 MdeModulePkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 098307e082 MdePkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() ed7f7c9168 NetworkPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 8e875037bf OvmfPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() deba54761a PcAtChipsetPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() f9f4fb2329 SecurityPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 7c2a6033c1 UefiCpuPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 429309e0c6 ArmPkg: Apply uncrustify changes 40b0b23ed3 ArmPlatformPkg: Apply uncrustify changes 2b16a4fb91 ArmVirtPkg: Apply uncrustify changes 7c34237831 CryptoPkg: Apply uncrustify changes 731c67e1d7 DynamicTablesPkg: Apply uncrustify changes e7108d0e96 EmbeddedPkg: Apply uncrustify changes a550d468a6 EmulatorPkg: Apply uncrustify changes bcdcc4160d FatPkg: Apply uncrustify changes 45ce0a67bb FmpDevicePkg: Apply uncrustify changes 111f2228dd IntelFsp2Pkg: Apply uncrustify changes 7c7184e201 IntelFsp2WrapperPkg: Apply uncrustify changes 1436aea4d5 MdeModulePkg: Apply uncrustify changes 2f88bd3a12 MdePkg: Apply uncrustify changes d1050b9dff NetworkPkg: Apply uncrustify changes ac0a286f4d OvmfPkg: Apply uncrustify changes 5220bd211d PcAtChipsetPkg: Apply uncrustify changes 39de741e2d RedfishPkg: Apply uncrustify changes c411b485b6 SecurityPkg: Apply uncrustify changes 47d20b54f9 ShellPkg: Apply uncrustify changes b878648967 SignedCapsulePkg: Apply uncrustify changes c1e126b119 SourceLevelDebugPkg: Apply uncrustify changes 91415a36ae StandaloneMmPkg: Apply uncrustify changes 053e878bfb UefiCpuPkg: Apply uncrustify changes e5efcf8be8 UefiPayloadPkg: Apply uncrustify changes 7c0ad2c338 UnitTestFrameworkPkg: Apply uncrustify changes dc453b5164 .pytool/Plugin/UncrustifyCheck: Add Uncrustify CI plugin 1832eb15aa UefiPayloadPkg/UefiPayloadPkg.fdf: Update DXE Apriori list ca78281c25 UefiPayloadPkg/PayloadEntry: Inherit 4/5-level paging from bootloader b2f7ee2ded UefiPayloadPkg: Increase SystemMemoryUefiRegionSize from 32M to 64M 94e0a7bddb UefiPayloadPkg: Add missing Guid gUefiAcpiBoardInfoGuid 2527723de9 UefiPayloadPkg: Add performance measurement feature ffdde9d719 UefiPayloadPkg: Skip ModuleInfo HOB in Payload 965292135b UefiPayloadPkg/UefiPayloadPkg.dsc:Add BootManagerLib for BootManagerMenuApp 85a678bf76 UefiPayloadPkg: Add integration instruction for coreboot common error 7b28310008 BaseTools: Increase the DevicePath length for support more PCD value. d25b803e51 MdeModulePkg/Bus/Pci/UhciDxe: Fix the UsbHc memory allocate and free issue c82ab4d8c1 BaseTools/VfrCompile: Correct Bit Field Flags for numeric/one of 2ddacfb6b8 OvmfPkg/SecMain: move SEV specific routines in AmdSev.c e2289d19d8 UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c 2fe8edfe55 OvmfPkg/ResetVector: move clearing GHCB in SecMain 3053183d41 OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use 707c71a01b OvmfPkg: reserve SNP secrets page cca9cd3dd6 OvmfPkg: reserve CPUID page f2dc28f0b6 OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase 34819f2cac OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values d9822304ce OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() 7c3b2892ea OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest d2b998fbdc OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values a19b648952 OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest 19914edc5a OvmfPkg/AmdSevDxe: do not use extended PCI config space ade62c18f4 OvmfPkg/MemEncryptSevLib: add support to validate system RAM d706f8fec2 OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 11b15336f0 OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM d39f8d88ec OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI phase 202fb22be6 OvmfPkg/SecMain: validate the memory used for decompressing Fv 8eb79b5f4f OvmfPkg/PlatformPei: validate the system RAM when SNP is active 26210f9436 MdePkg: Define ConfidentialComputingGuestAttr 504ae26b80 OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is active b95908e043 UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status f4e3ce5f53 UefiCpuPkg: add PcdGhcbHypervisorFeatures f5a6e1bab5 OvmfPkg/PlatformPei: set the Hypervisor Features PCD 2c354252be MdePkg/GHCB: increase the GHCB protocol max version 9c703bc0f1 UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is enabled d4d7c9ad5f UefiCpuPkg/MpInitLib: use BSP to do extended topology check b928eb44d5 OvmfPkg/MemEncryptSevLib: change the page state in the RMP table b7b8872031 OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address ea3a12d970 OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map 67484aed69 OvmfPkg/AmdSev: expose the SNP reserved pages through configuration table 06544455d0 UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs 0f1d7477c0 OvmfPkg: Remove unused print service driver (PrintDxe) 30631f0a26 MdePkg: Add missing Cache ID (in)valid define 0077c22f6d MdePkg: Remove PPTT ID type structure a50b65ce22 ShellPkg: Update Acpiview PPTT parser to ACPI 6.4 8cf2bdfcfb ShellPkg: Add Cache ID to PPTT parser b2bbe3df54 DynamicTablesPkg: Remove PPTT ID structure from ACPI 6.4 generator e139829dd6 DynamicTablesPkg: Update PPTT generator to ACPI 6.4 e81a81e584 DynamicTablesPkg: Add CacheId to PPTT generator 9afcd48a94 OvmfPkg: Handle Cloud Hypervisor host bridge 2ccefa32a6 OvmfPkg: Create global entry point for SMBIOS parsing d8ef774346 OvmfPkg: Retrieve SMBIOS from Cloud Hypervisor 66bce05f6d OvmfPkg: Generalize AcpiPlatformDxe 7594c5bfe2 OvmfPkg: Install ACPI tables for Cloud Hypervisor f6df289a1c OvmfPkg/OvmfXen: Fix Xen build 2b20a34fd5 OvmfPkg-EmuVariableFvbRuntimeDxe: Support Access To Memory Above 4G d5efc875ef MdePkg: Introduce CcMeasurementProtocol for CC Guest firmware a124cd4ef9 SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib 8c06c53b58 SecurityPkg: Support CcMeasurementProtocol in DxeTpmMeasurementLib adf070ff56 OvmfPkg/Microvm: add PcdConfidentialComputingGuestAttr 2686468c43 OvmfPkg/Bhyve: add MemEncryptSevLib 61be49e0f7 OvmfPkg/PlatformCI: factor out PlatformBuildLib.py 21ee379407 OvmfPkg/PlatformCI: add QEMU_SKIP 64bccda534 OvmfPkg/PlatformCI: add BhyveBuild.py 04eacd3943 OvmfPkg/PlatformCI: add MicrovmBuild.py 8b8ae609a7 OvmfPkg/PlatformCI: add AmdSevBuild.py 2722856a87 OvmfPkg/PlatformCI: dummy grub.efi for AmdSev 1203eba58e OvmfPkg/PlatformCI: add XenBuild.py 64ef0dd1d3 OvmfPkg/Microvm/fdt: add device tree support 79dcaf7054 OvmfPkg/Microvm/fdt: load fdt from fw_cfg c802f8935c OvmfPkg/Microvm/fdt: add empty fdt 2a68abf6ee OvmfPkg/Microvm/virtio: add virtio-mmio support e07d27e24d OvmfPkg/Microvm: add README 7f1861be2b DynamicTablesPkg: AML Code generation for memory ranges 0e7147fe75 DynamicTablesPkg: AML Code generation to create a named Package() fd5fc4bbb7 DynamicTablesPkg: AML Code generation to create a named ResourceTemplate() b2b8def4e3 DynamicTablesPkg: AML Code generation to add _PRT entries 69ddfee1c3 DynamicTablesPkg: Add AmlAttachNode() ce306e48eb DynamicTablesPkg: Add Pci related objects e35a746cf5 DynamicTablesPkg: SSDT Pci express generator ec37fd9c1f DynamicTablesPkg: Fix multiple objects parsing 557dede8a6 OvmfPkg/PlatformPei: ScanOrAdd64BitE820Ram improvements 759e3c6d21 OvmfPkg/PlatformPei: prefer etc/e820 for memory detection 41d8bb3038 OvmfPkg/PlatformPei: stop using cmos for memory detection 7a6e6ae933 EmulatorPkg: Update lldbefi.py to work with current lldb which uses python3 4d30352445 ArmPkg: Add SMC helper functions c039fa7ff0 ArmPkg: Update SMC calls to use the new ArmCallSmc0/1/2/3 functions 90ad4b3b34 DynamicTablesPkg: Definition for HwInfoParser interface d59c5a20f8 DynamicTablesPkg: FdtHwInfoParser: CM Object descriptor helper 5d8b5d171c DynamicTablesPkg: FdtHwInfoParser: Add FDT utility functions 8d2691c3d5 DynamicTablesPkg: FdtHwInfoParser: Add Boot Arch parser 3ebe1ff5c9 DynamicTablesPkg: FdtHwInfoParser: Generic Timer Parser 51941f7558 DynamicTablesPkg: FdtHwInfoParser: Add Serial port parser e366a41ef0 DynamicTablesPkg: FdtHwInfoParser: Add GICC parser 0fa1217726 DynamicTablesPkg: FdtHwInfoParser: Add GICD parser b04cf355a0 DynamicTablesPkg: FdtHwInfoParser: Add MSI Frame parser d250d408cf DynamicTablesPkg: FdtHwInfoParser: Add ITS parser 7b6c8b30a5 DynamicTablesPkg: FdtHwInfoParser: Add GICR parser 26bf034a59 DynamicTablesPkg: FdtHwInfoParser: Add GIC dispatcher c67bf628c8 DynamicTablesPkg: FdtHwInfoParser: Add PCI config parser deb01dfd7f DynamicTablesPkg: Add FdtHwInfoParser library 9006967c8d DynamicTablesPkg: Handle 16550_WITH_GAS id b2d0ed20fd DynamicTablesPkg: Definition for DynamicPlatRepoLib interface 2e2db65e39 DynamicTablesPkg: DynamicPlatRepo: Add TokenGenerator 740e3bb634 DynamicTablesPkg: DynamicPlatRepo: Add TokenFixer 5fe5b6f94f DynamicTablesPkg: DynamicPlatRepo: Add TokenMapper 38f6d78c3b DynamicTablesPkg: Add DynamicPlatRepo library f14fff5135 StandaloneMmPkg/FvLib: Support large file with EFI_FFS_FILE_HEADER2. 3a72ec71cd OvmfPkg: remove unused TPM options from MicrovmX64.dsc b47575801e OvmfPkg: move tcg configuration to dsc and fdf include files 5711ff4d0b OvmfPkg: drop TPM_CONFIG_ENABLE b819388772 OvmfPkg: create Tcg12ConfigPei.inf 4de8d61bce OvmfPkg: rework TPM configuration e6ea1464a8 OvmfPkg/PlatformPei: Revert "stop using cmos for memory detection" a6c0418651 ArmPkg/SmbiosMiscDxe: Remove duplicate HII string definition 45e3842970 ArmPkg/SmbiosMiscDxe: Get full SMBIOS strings from OemMiscLib b451c69088 ArmPkg/ProcessorSubClassDxe: Get serial and part number from OemMiscLib 8ed8568922 SecurityPkg: Debug code to audit BIOS TPM extend operations 195f011973 SecurityPkg: Reallocate TPM Active PCRs based on platform support ab5ab2f603 SecurityPkg: TPM must go to Idle state on CRB command completion c63a10ecb7 EmbeddedPkg/AcpiLib: Add more helper functions f129b1f06f OvmfPkg/Bhyve: fix tls-enabled build ee1f8262b8 OvmfPkg: Call PlatformInitializeConsole for GPU passthrough case de9e5b7dc7 IntelFsp2WrapperPkg : FSPM/S UPD data address based on Build Type 9ec2cc1f31 IntelFsp2WrapperPkg : Remove EFIAPI from local functions. ae8272ef78 MdeModulePkg/UsbBusDxe: fix NOOPT build error 15c596aeeb OvmfPkg: Bhyve: Delete unused AcpiTables/Ssdt.asl file 6612ff8561 UefiCpuPkg: Extend measurement of microcode patches to TPM e910f076ad BaseTools: Fix the bug of --cmd-len build option 7935be0fbd IntelFsp2Pkg/FspSecCore: ExtendedImageRevision was not printed. c095122d4b MdeModulePkg/PciBusDxe: Enumerator to check for RCiEP before looking for RP d463c56ddd MdeModulePkg: Replace with UFS_UNIT_DESC to fix timeout problem 45920941d9 MdeModulePkg: Refactoring UFS DME request and fix timing problem 13d9e8ec98 MdeModulePkg: Put off UFS HCS.DP checking to fix timing problem 079a58276b OvmfPkg/AmdSev/SecretPei: Mark SEV launch secret area as reserved 9dd14fc91c MdePkg: Add registers of boot partition feature 14a731096d UnitTestFrameworkPkg: CI YAML: Grant cmockery spell check exception 6062002bd5 MdeModulePkg/PartitionDxe: Add break to handle invalid LBA0 in MBR 7438a85bf1 BaseTools: Fix wrong variable header size c712ce2bb1 OvmfPkg/CloudHv: Add new target for Cloud Hypervisor a2da72b2ca OvmfPkg/CloudHv: Replace legacy 8254 PIT with local APIC timer 6ecdda71fe OvmfPkg/CloudHv: Connect serial console 1552050ce7 OvmfPkg/CloudHv: Remove legacy 8259 PIC support fdcea7ff6f OvmfPkg/CloudHv: Remove Q35 specifics 71082d3d1b OvmfPkg/CloudHv: Reduce dependency on QemuFwCfg 196be601f9 OvmfPkg/CloudHv: Remove video support 7b6cbe0a81 OvmfPkg/CloudHv: Remove USB support e73d1bf96a OvmfPkg/CloudHv: Remove CSM support b66056ef21 OvmfPkg/CloudHv: add Maintainers.txt entry 5302bd81d9 OvmfPkg: Add CloudHvX64 to the CI 59c48c9314 UefiPayloadPkg: Change the user interface name of the Uiapp 5801910013 UefiPayloadPkg: Not use BaseCpuTimerLib by default. 772c5bb8dc FmpDevicePkg/FmpDxe: Update FmpDeviceCheckImageWithStatus() handling 7709988dd8 RedfishPkg/RedfishRestExDxe:Simplify status check 21320ef669 MdeModulePkg/Variable: Make only EFI_VARIABLE_NON_VOLATILE invalid 7e5c603cba MdeModulePkg/SdMmcPciHcDxe: Robust improvements for SD card 1.8V switch ee67067f17 MdeModulePkg: VariableSmmRuntimeDxe: Fix Variable Policy Message Length 5b39832e18 MdePkg: MmCommunication2: Update MM communicate2 function description ce37f45955 ArmPkg: MmCommunicationDxe: MM communicate function argument attributes 541a077bd1 ArmPkg: MmCommunicationDxe: Update MM communicate `CommBuffer**` checks 1aa1ec4574 ArmPkg: MmCommunicationDxe: Update MM communicate `CommSize` check 8cc5590eab ArmPkg: MmCommunicationDxe: Update MM communicate `MessageLength` check 6777e67383 EmbeddedPkg: Fix a build error in FwVol.c in X64 arch a867f3a704 UefiPayloadPkg: Use BaseCpuTimerLib for Universal Payload by default f4b7b473b4 MdeModulePkg/UefiBootManagerLib: Convert BmLoadOption to Variable Policy 76b3d45b75 ShellPkg: Add the missing VariablePolicyHelperLib in ShellPkg.dsc 8542fc5f95 NetworkPkg: Add the missing VariablePolicyHelperLib in NetworkPkg.dsc ae35314e7b Maintainers.txt: Add Sami Mujawar as reviewer for ArmPkg 862ea6e836 OvmfPkg: change qemu default resolution to 1280x800 e95b44c90e ArmVirtPkg: change qemu default resolution to 1280x800 929804b172 OvmfPkg: add PcdVideoResolutionSource 7f25ddbc03 OvmfPkg/QemuVideoDxe: simplify InitializeBochsGraphicsMode 336da55ca8 OvmfPkg/QemuVideoDxe: drop QEMU_VIDEO_BOCHS_MODES->ColorDepth 55c05427b9 OvmfPkg/QemuVideoDxe: factor out QemuVideoBochsAddMode 49a2d8cbf5 OvmfPkg/QemuVideoDxe: parse edid blob, detect display resolution ba79becd55 OvmfPkg/BaseCachingPciExpressLib: Migrate BaseCachingPciExpressLib 103fa647d1 ArmPkg: Replace CoreId and ClusterId with Mpidr in ARM_CORE_INFO struct 742dafd2cc DynamicTablesPkg: Print specifier macro for CM_OBJECT_ID 13136cc311 DynamicTablesPkg: FdtHwInfoParserLib: Parse Pmu info 5751d60821 DynamicTablesPkg: AmlLib: AmlAddPrtEntry() to handle GSI 5816bd3eab DynamicTablesPkg: AcpiSsdtPcieLibArm: Remove link device generation dc1118fa0d ArmVirtPkg: Add cspell exceptions 0dbd356983 ArmVirtPkg/Kvmtool: Add DSDT ACPI table 312ef7a0a4 ArmVirtPkg/Kvmtool: Add Configuration Manager 17a02163bd ArmVirtPkg/Kvmtool: Enable ACPI support 5b3c682d91 ArmVirtPkg/Kvmtool: Enable Acpiview 017564d637 ArmPkg/ArmMmuLib AARCH64: avoid EL0 accessible mappings 45b1612659 DynamicTablesPkg: Add Memory32Fixed function 007a95055b DynamicTablesPkg: Remove redundant cast in AmlCodeGenReturn 33189f0527 DynamicTablesPkg: Add AmlCodeGenMethodRetInteger function a4b7aa362d MdeModulePkg/Bus/Pci/PciBusDxe: Support platform PCI ROM override 6fb09da89f ShellPkg: Fix incorrect PPTT FlagName dereference c09dbc92e9 BaseTools/Conf: Add new macro for customizing dll file reduction. d4ac53aa91 BaseTools: Fix error leg in DscBuildData.py f78b937c95 MdeModulePkg/RuntimeDxe: clear mVirtualMapMaxIndex 96b8b5fd10 MdeModulePkg/UiApp: Fix spelling of 'FRONTPAGE' bd676f080a Maintainers.txt: add missing github IDs to OvmfPkf/Fdt reviewers 1f54eaa725 Maintainers.txt: update email for Leif Lindholm b360b0b589 Maintainers.txt: Update email address c9b7c6e0cc BaseTools: Update CLANG{35,38}_WARNING_OVERRIDES to ignore unused vars 42af706dfb BaseTools: Update brotli submodule 1193aa2dfb MdeModulePkg: update brotli submodule 85589ddbf6 OvmfPkg/VmgExitLib: Fix uninitialized variable warning with XCODE5 c28e376edc OvmfPkg/FvbServicesSmm: use the VmgExitLibNull 8a57673316 ShellPkg: Fix Ping GetTimerPeriod API failure b24306f15d NetworkPkg: Fix incorrect unicode string of the AKM/Cipher Suite - Add amd-sev-es to the following descriptors because James Fehlig tested them (bsc#1196879): 60-ovmf-x86_64.json 60-ovmf-x86_64-2m.json 60-ovmf-x86_64-ms.json 60-ovmf-x86_64-2m-ms.json - Backported patches in ovmf-bsc1196879-sev-fix.patch for fixing SEV: de463163d9 OvmfPkg/AmdSev: reserve snp pages 63c50d3ff2 OvmfPkg/ResetVector: cache the SEV status MSR value in workarea f1d1c337e7 OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea - TPM_ENABLE got renamed to TPM2_ENABLE and TPM_CONFIG_ENABLE removed (except on ARM for some reason) (boo#1197104) - Add GCC 12 workaround (ovmf-ignore-spurious-GCC-12-warning.patch) that handles: https://bugzilla.tianocore.org/show_bug.cgi?id=3816 The same patch is already included in qemu package. - Respin amd-sev and amd-sev-es features After more testing, we found that not all descriptors can support both amd-sev with amd-sev-es. So we removed all amd-sev and amd-sev-es feature tags but only keep them in ovmf-x86_64-2m.json and 60-ovmf-x86_64.json. (bsc#1198246#c75) - add ovmf-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch. It fixes crashes when linked using gcc 12 (bsc#1199597). - Update to edk2-stable202205 - Features (https://github.com/tianocore/edk2/releases): Support PEI 64bit in IntelFsp2Pkg and IntelFsp2WrapperPkg IntelFsp2Pkg: BaseFspCommonLib Support for X64 Build Add PrmPkg BaseTools Enhance GenFw to support PRM GCC build Enable Intel TDX in OvmfPkg Generate CloudHv target as PVH ELF binary Add parallel hash feature into BaseCryptLib Configure/Enable elliptic curve ciphers in OpenSSL Add FMMT tool into edk2 BaseTools Dynamic variable flash information cannot be passed in Standalone MM - Patches (git log --oneline --reverse edk2-stable202202~..edk2-stable202205): b24306f15d NetworkPkg: Fix incorrect unicode string of the AKM/Cipher Suite 2dbed52506 ArmVirtPkg/ArmVirtMemoryInitPeiLib: avoid redundant cache invalidation 54cddc3ad4 ArmVirtPkg/ArmVirtKvmTool: wire up configurable timeout de463163d9 OvmfPkg/AmdSev: reserve snp pages 63c50d3ff2 OvmfPkg/ResetVector: cache the SEV status MSR value in workarea f1d1c337e7 OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea b1b89f9009 MdeModulePkg: Correct high-memory use in NvmExpressDxe 84338c0d49 MdeModulePkg: Replace Opcode with the corresponding instructions. d3febfd9ad MdePkg: Replace Opcode with the corresponding instructions. 7bc8b1d9f4 SourceLevelDebugPkg: Replace Opcode with the corresponding instructions. 2aa107c0aa UefiCpuPkg: Replace Opcode with the corresponding instructions. bbaa00dd01 MdePkg: Remove the macro definitions regarding Opcode. 6a890db161 BaseTools: Upgrade the version of NASM tool 497ac7b6d7 UefiPayloadPkg/PayloadLoaderPeim: Use INT64 as input parameter dc39554d58 edk2/MdeModulePkg/Debuglib: Add Standalone MM support 906242343f MdeModulePkg/GraphicsConsoleDxe: Check status to make sure no error b422b0fcf9 EmulatorPkg/EmuGopDxe: Set ModeInfo after Open successfully 589d51df26 MdeModulePkg/Usb/Keyboard.c: Don't request protocol before setting b909b4ad09 OvmfPkg: Make the Xen ELF header generator more flexible 0a707eb258 OvmfPkg: Xen: Use a new fdf include for the PVH ELF header 0015a4e0a8 OvmfPkg: Xen: Generate fdf include file from ELF header generator 9ac8c85d50 OvmfPkg: CloudHv: Remove VARS and CODE sections e1c7f9b4e5 OvmfPkg: Generate CloudHv as a PVH ELF binary d50d9e5549 OvmfPkg: CloudHv: Retrieve RSDP address from PVH 82bfd2e86d OvmfPkg: CloudHv: Rely on PVH memmap instead of CMOS b83d0a6438 OvmfPkg: CloudHv: Add README 4a68176cb5 UefiCpuPkg: Extend SMM CPU Service with rendezvous support. 949b8a3d97 Maintainers.txt: Add new reviewer for UefiPayloadPkg 091b6a1197 UefiPayloadPkg: Add build option for Above 4G Memory 4adc364c75 UefiPayloadPkg: Fix case of protocol 79f2734e5a MdeModulePkg: Add a check for metadata size in NvmExpress Driver af74efe494 UefiPayloadPkg: Make Boot Manager Key configurable 62fa37fe7b BlSupportSmm: fix definition of SetSmrr() 56530dec11 .pytool/Plugin/UncrustifyCheck: Output file diffs by default 2aac8bb7ef .pytool: Update to newest pytools c63ef58698 .azurepipelines: Updated python version f06941cc46 MdeModulePkg: Add bRefClkFreq card attribute programming support 2b175eeb6a RedfishPkg: fix memory leak issue 10b4c8f3b7 Maintainers: Update Maintainers.txt for edk2 Redfish modules 0fdd466c75 UefiCpuPkg/MpInitLib:remove optional in declaration 52e09dcd7a UefiCpuPkg: Support FFS3 GUID in SearchForBfvBase.asm a13dfc769b MdeModulePkg/DxeIpl: Create 5-level page table for long mode c8ea48bdf9 DynamicTablesPkg: Fix serial port namespace path in DBG2 414cd2a4d5 BaseTools/GenFw: Enhance GenFw to support PRM GCC build 33438f7354 EmulatorPkg/RedfishPlatformCredentialLib: Check EFI_SECURE_BOOT_MODE_NAME 5b56c52b5c EmulatorPkg/RedfishPlatformCredentialLib: Don't stop Redfish service 0531f61376 IntelFsp2Pkg: BaseFspDebugLibSerialPort Support for X64 411b3ff6dd IntelFsp2Pkg: BaseFspSwitchStackLib Support for X64 b429959bb6 MdeModulePkg/SdMmcPciHcDxe: Make timeout for SD card configurable 79a705fbaf UefiPayloadPkg: Hookup SD/MMC timeout 28eeb08d86 MdePkg/Include: Smbios Specification 3.5.0 changes c1e662101a CryptoPkg: Add new hash algorithm ParallelHash256HashAll in BaseCryptLib. 267a92fef3 MdePkg/AcpiXX.h: Update Error Severity type for Generic Error Status Block ec0b54849b IntelFsp2Pkg: BaseFspCommonLib Support for X64 5d8d8b5148 MdeModulePkg/NvmExpressDxe: fix check for Cap.Css 69218d5d28 MdeModulePkg/NvmExpressPei: fix check for NVM command set bf9230a9f3 BaseTools: Add the FeatureFlagExpression usage to the Source Section 3115377bf0 BaseTools: Remove the redundant __FLEXIBLE_SIZE from PcdValueInit.c 4a2e1000a1 CryptoPkg: update openssl submodule to 1.1.1n 355515a06a CryptoPkg? Redefinition bug in CrtLibSupport.h. 7b005f344e BaseTools: fix gcc12 warning 85021f8cf2 BaseTools: fix gcc12 warning 22130dcd98 Basetools: turn off gcc12 warning ec30a4a0c3 BaseTools:Support decimal version number in ECC check 3ef2071927 UefiCpuPkg: Update BFV searching algorithm in VTF0 691b178667 ShellPkg/AcpiView: Adds ACPI_PARSER bitfield parser 40004ff9d5 ShellPkg/AcpiView: PrintFormatter for FADT Flags field 7456990e8e MdeModulePkg/Ufs: bRefClkFreq attribute be programmed after fDeviceInit 237c966396 UefiPayloadPkg/UefiPayloadPkg.ci.yaml: Remove duplicated entry 76191052fd UefiPayloadPkg: Fix build error 449eb01a8d UefiPayloadPkg: Fix architecture in the build instruction c248802e40 UefiPayloadPkg: Fix PciHostBridgeLib 2b4b8013fe UefiPayloadPkg/Library/PlatformBootManagerLib: Remove broken VGA detection 55637a2894 UefiPayloadPkg: Make Boot Timeout configurable 2268920afc .azurepipelines: Use Python 3.8 c3ca70669e .azurepipelines: Use windows-2019 VM image 3b0de44759 EmulatorPkg: Use windows-2019 VM image 75628d27c0 OvmfPkg: Use windows-2019 VM image b328bb54c6 BaseTools/Bin: Update GCC ARM compiler version 3f0c788a5f MdePkg: Add Tdx.h 77228269e7 MdePkg: Update Cpuid.h for Tdx 818bc9596d MdePkg: Introduce basic Tdx functions in BaseLib c3001cb744 MdePkg: Add TdxLib to wrap Tdx operations eddcba40b5 UefiCpuPkg: Extend VmgExitLibNull to handle #VE exception daf8f642f3 OvmfPkg: Extend VmgExitLib to handle #VE exception de327f7d8a UefiCpuPkg/CpuExceptionHandler: Add base support for the #VE exception ab9d790901 MdePkg: Add helper functions for Tdx guest in BaseIoLibIntrinsic b6b2de8848 MdePkg: Support mmio for Tdx guest in BaseIoLibIntrinsic d74e932681 MdePkg: Support IoFifo for Tdx guest in BaseIoLibIntrinsic 3571fc906f MdePkg: Support IoRead/IoWrite for Tdx guest in BaseIoLibIntrinsic 7bed7ae6c5 UefiCpuPkg: Support TDX in BaseXApicX2ApicLib d983b102b3 MdePkg: Add macro to check SEV / TDX guest 88da06ca76 UefiCpuPkg: Enable Tdx support in MpInitLib 352eabdcd5 OvmfPkg: Add IntelTdx.h in OvmfPkg/Include/IndustryStandard 6a608255bb OvmfPkg: Add TdxMailboxLib 57bcfc3b06 OvmfPkg: Create initial version of PlatformInitLib 102cafedad OvmfPkg/PlatformInitLib: Add hob functions 9a9b33b3d6 OvmfPkg/PlatformPei: Move global variables to PlatformInfoHob 5a2574a82e OvmfPkg/PlatformPei: Refactor MiscInitialization 6d2ce5fd5c OvmfPkg/PlatformPei: Refactor MiscInitialization for CloudHV 3dd47f9544 OvmfPkg/PlatformPei: Refactor AddressWidthInitialization 432e4acd87 OvmfPkg/PlatformPei: Refactor MaxCpuCountInitialization f3801cf26c OvmfPkg/PlatformPei: Refactor QemuUc32BaseInitialization e510326245 OvmfPkg/PlatformPei: Refactor InitializeRamRegions 12e860a1e8 OvmfPkg/PlatformPei: Refactor MemMapInitialization cec82a64cf OvmfPkg/PlatformPei: Refactor NoexecDxeInitialization f53f449f15 OvmfPkg/PlatformPei: Refactor MiscInitialization 10460942ff OvmfPkg/PlatformInitLib: Create MemDetect.c 96047b6663 OvmfPkg/PlatformInitLib: Move functions to Platform.c b22ac35b75 OvmfPkg: Update PlatformInitLib to process Tdx hoblist ccca1c2d5d OvmfPkg/Sec: Declare local variable as volatile in SecCoreStartupWithStack 2b80269d98 OvmfPkg: Update Sec to support Tdx 6b27c11690 OvmfPkg: Check Tdx in QemuFwCfgPei to avoid DMA operation bec9104201 MdeModulePkg: Skip setting IA32_ERER.NXE if it has already been set fd306d1dbc MdeModulePkg: Add PcdTdxSharedBitMask cc3620f304 UefiCpuPkg: Update AddressEncMask in CpuPageTable e23f8f52fd OvmfPkg: Update PlatformInitLib for Tdx guest cf17156d7d OvmfPkg: Update PlatformPei to support Tdx guest 9fdc70af6b OvmfPkg: Update AcpiPlatformDxe to alter MADT table 5aa8018639 OvmfPkg/BaseMemEncryptTdxLib: Add TDX helper library fae5c1464d OvmfPkg: Add TdxDxe driver 07c721fea7 OvmfPkg/QemuFwCfgLib: Support Tdx in QemuFwCfgDxe 2520182122 OvmfPkg: Update IoMmuDxe to support TDX c2e7be4055 OvmfPkg: Rename XenTimerDxe to LocalApicTimerDxe 299c44cd4f UefiCpuPkg: Setting initial-count register as the last step c37cbc030d OvmfPkg: Switch timer in build time for OvmfPkg 580a6b616b OvmfPkg: Add TdxWorkArea definition 75942a52ae OvmfPkg: Add PrePiHobListPointerLibTdx 4fe2678411 OvmfPkg: Add PeilessStartupLib 1f29de4d20 OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest 55fda68a80 OvmfPkg: Update TdxDxe to set TDX PCDs f674fa9cde OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob 149ed8e421 OvmfPkg/IncompatiblePciDeviceSupportDxe: Refine the configuration c477b2783f OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest cb8349f01a MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if needed 44a53a3bdd OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B 7fda517c3d OvmfPkg: Add dependency of VariableSmm driver to make it work normally. b953265a27 UefiPayloadPkg: Add a new DebugPrintErrorLevelLib instance 0023e35cf4 UefiPayloadPkg: Change some configuration of the payload 3e130e40fc UefiPayloadPkg: Consume the new added DebugPrintErrorLevelLib instance f16b05a13b .pytool/Plugin/UncrustifyCheck: Update func to return absolute paths dbfbaedb21 .pytool/Plugin/UncrustifyCheck: Add ignore file support d932199d39 OvmfPkg: Revert Uncrustify formatting in VbeShim.h files ad6816c319 OvmfPkg: Do not check VbeShim.h formatting with Uncrustify d2998af211 PrmPkg: Add package and include headers 5f76c3e471 PrmPkg: Add PrmConfig protocol interface e189e01af2 PrmPkg/PrmContextBufferLib: Add initial library instance 3f7af17c6b PrmPkg/PrmConfigDxe: Add initial driver 9276e0d2b9 PrmPkg: Add initial PrmSamplePrintModule c63905aba7 PrmPkg: Add initial PrmSampleMemoryAllocationModule 27b1a840e4 PrmPkg: Add initial PrmSampleHardwareAccessModule 7c41ec47ca PrmPkg: Add initial PrmSampleContextBufferModule 97ab54c1b1 PrmPkg: Add initial package DSC file d2cb6e67a4 Readme.md: Add initial content e846797662 PrmPkg: Add ALLOCATE_CONTEXT_BUFFER_IN_FW build option a6f8946bc9 PrmPkg: Enable variable growth for the PRM_MODULE_EXPORT macro ef05955996 PrmPkg: Publish PRM operation region to support PRM ACPI _DSM invocation f96517f4d0 PrmPkg: Export major/minor version in PRM module PE COFF header 50e1432a40 PrmPkg: Add initial PrmSsdtInstallDxe module a409f4b67d PrmPkg: Remove PRM Module Update Lock 0797989c5d PrmPkg: Remove ALLOCATE_CONTEXT_BUFFER_IN_FW build flag 0b469caff6 PrmPkg/PrmContextBuffer.h: Add ACPI parameter support structures be2c927d7c PrmPkg/PrmLoaderDxe: Add ACPI parameter buffer support c1a7a50f67 PrmPkg/PrmSampleContextBufferModule: Remove OS debug print requirement 4c8486fd72 PrmPkg/PrmSampleHardwareAccessModule: Add non-print PRM handlers 7217263514 PrmPkg/SampleAcpiParameterBufferModule: Add initial module fec018624c PrmPkg/HardwareAccessModuleConfigLib: Add initial library d10b8dc5d8 PrmPkg/Samples/Readme.md: Add initial file 6b7dde7cdd PrmPkg: Refactor some PrmLoaderDxe functionality into libraries 4348c72ad0 PrmPkg/Application/PrmInfo: Add initial application e10c776487 PrmPkg: Enforce stricter types 2e55b0cd9e PrmPkg/Test/PrmPkgHostTest.dsc: Add initial file 3599f5479d PrmPkg/Test/UnitTest/Library: Add initial UEFI Boot Services test lib 82d15dc6c1 PrmPkg/Library/DxePrmContextBufferLib: Add host-based unit tests 68ee42c991 PrmPkg/DxePrmModuleDiscoveryLib: Add initial host-based unit tests c040831cf9 PrmPkg: Add PlatformGuid a9302b89a9 PrmPkg: Update PRM OpRegion f8e68587e2 Readme.md: Add iASL note and QEMU sample link 4a4aeaa446 PrmPkg: Replace PcdPrmPlatformGuid with EDKII_DSC_PLATFORM_GUID 17b2d64ced PrmPkg/Samples: Remove PrmSampleMemoryAllocationModule 050b2ba27d PrmPkg/Samples: Remove PrmSamplePrintModule 88f3d734f5 PrmPkg: Remove the concept of OS services deea4e58b0 Readme.md: Add a link to PRM Specification f3c11224b5 PrmPkg: Changes for edk2 repo transition a298a84478 PrmPkg: Apply uncrustify changes 94f905b3bf MdeModulePkg/HiiDatabase: Fix Setup numeric default value incorrect issue b8c5ba2337 BaseTools: efi_debugging.py: Add debugger agnostic dbg Python Classes 0d7fec9f79 BaseTools: Scripts/efi_gdb.py: Add gdb EFI commands and pretty Print 4f4afcd288 BaseTools: Scripts/efi_lldb.py: Add lldb EFI commands and pretty Print bfefdc2c49 UefiPayloadPkg: Fix PciHostBridgeLib 676084303d UefiPayloadPkg: Support IA32 Build 63e155f24d UefiPayloadPkg: Add dependency of VariableSmm driver. dab96cf02e UefiPayloadPkg: Add --quiet argument to Universal Payload build script 35a4b63247 NetworkPkg: Add PCDs for HTTP DNS RetryCount and RetryInterval 38a9afd0fb NetworkPkg/HttpDxe: Decofigure Tcp4 before reconfiguring 3974aa539e NetworkPkg/HttpDxe: Decofigure Tcp6 before reconfiguring c43ff5188d NetworkPkg/HttpDxe: Add ConnectionClose flag fo HTTP_PROTOCOL 753fd319e2 NetworkPkg/HttpDxe: Detect 'Connection: close' header 12a50c9ce1 NetworkPkg/HttpDxe: Detect HTTP/1.0 servers 5576b17363 BaseTools: Fix DevicePath tool build failure issue 4352d115c4 CryptoPkg/CrtLibSupport: add fcntl.h 3b4b49cf00 CryptoPkg/CrtLibSupport: add strstr() 58771f4b2d CryptoPkg/CrtLibSupport: add INT_MIN 2759e42fbc CryptoPkg/CrtLibSupport: add UINT_MAX fd5f347c84 CryptoPkg/CrtLibSupport: add MODULESDIR 03951e5645 CryptoPkg/CrtLibSupport: add off_t fab6285a73 CryptoPkg/CrtLibSupport: fix strcpy f5508a91e3 CryptoPkg/UnitTest: fix DH testcase c411566fad pip-requirements.txt: Update basetools version to 0.1.17 8a5727c7a8 Maintainers.txt: Add Michael Kubacki as UnitTestFrameworkPkg maintainer 1a49e2aa3c CryptoPkg: Add instrinsics to support building ECC on IA32 windows efc39e65e5 CryptoPkg: Reconfigure OpensslLib to add EC algorithms 0c901fcc20 CryptoPkg: Make EC source file config-able f3da13461c CryptoPkg/TlsLibNull: Remove MU_CHANGE comment markers 4cfb28f12a UefiPayloadPkg: Fix the build failure 9bf7291d63 ShellPkg: Update smbiosview type 41 with SMBIOS 3.5 fields 630df8c86e IntelFsp2Pkg: X64 compatible changes to support PEI in 64bit 6f219bef55 IntelFsp2Pkg: Add FSPx_ARCH2_UPD support for X64 d40965b987 IntelFsp2Pkg: Update FSP_GLOBAL_DATA and FSP_PLAT_DATA for X64 00aa71ce20 IntelFsp2Pkg: FspSecCore support for X64 6bec5a66ea IntelFsp2Pkg: SecFspSecPlatformLibNull support for X64 4a6ed7e46a IntelFsp2WrapperPkg: Adopt FSPM_UPD_COMMON_FSP24 for X64 86a2f3c439 IntelFsp2WrapperPkg: BaseFspWrapperApiLib support for X64 91a03f78ba IntelFsp2WrapperPkg: SecFspWrapperPlatformSecLibSample support for X64 3d97733f44 MdePkg: Add CC_GUEST_TYPE in ConfidentialComputingGuestAttr.h d020ac55b6 OvmfPkg: Replace GUEST_TYPE with CC_GUEST_TYPE 74a3eb975d MdePkg: Add CcProbeLibNull 2f44d77c68 OvmfPkg: Add CcProbeLib 2a7e1e890d OvmfPkg: Add CcProbeLib in *.dsc 7012cb73c4 MdePkg: Probe Cc guest in BaseIoLibIntrinsicSev 76fda1def3 OvmfPkg: Call CcProbe in SecMain.c instead of TsIsEnabled 532bd4ec38 CryptoPkg/Crt: fix strcpy build on older VS compilers 6d2baf9dfb PrmPkg/DxePrmContextBufferLib: Fix unit test GCC compilation errors 892787fed5 OvmfPkg/OvmfPkgX64: Adjust load sequence of TdxDxe and AmdSevDxe driver b06a007b64 CryptoPkg: Declare PcdEcEnabled in Library consuming OpensslLib fdfbf1fdab MdePkg: Update smbiosview type 9 with SMBIOS 3.5 fields a85ae8d964 ShellPkg: Update smbiosview type 9 with SMBIOS 3.5 fields 2306555bf9 UefiPayloadPkg: Fix IA32 entry build failure f4dfec6ca1 BaseTools: Move gPlatformFinalPcd to Datapipe and optimize size ee582858c4 .azurepipelines: Add NOOPT to all package builds 2d9d605714 .pytool/Plugin/UncrustifyCheck: Add Azure DevOps UI debug instructions b807174fec MdeModulePkg/GraphicsConsoleDxe: add modes 5a17629902 OvmfPkg: clear PcdConOut{Row,Column} 96e1d337e0 ArmVirtPkg: clear PcdConOut{Row,Column} 483d3bb716 ShellPkg: Update smbiosview type 0 with SMBIOS 3.5 fields ecc79b092e OvmfPkg/VirtioGpuDxe: add VirtioGpuSendCommandWithReply 182122914c OvmfPkg/VirtioGpuDxe: add GetDisplayInfo to virtio-gpu spec header. 82c07f2cc7 OvmfPkg/VirtioGpuDxe: add VirtioGpuGetDisplayInfo 5f6ecaa398 OvmfPkg/VirtioGpuDxe: use GopQueryMode in GopSetMode 86de090b99 OvmfPkg/VirtioGpuDxe: move code to GopInitialize 916f90baa5 OvmfPkg/VirtioGpuDxe: query native display resolution from host d372ab585a BaseTools/Conf: Fix Dynamic-Library-File template cabd96ad03 OvmfPkg: restore CompatImageLoaderDxe chunk 4092f1d397 OvmfPkg/Bhyve: add support for QemuFwCfg daa6cd8763 ArmPlatformPkg: Fix error message in Scripts/Ds5/edk2_debugger.py 5299568ce6 ArmPlatformPkg: Fix target initialisation in cmd_load_symbols.py 101f4c7892 ArmPlatformPkg: Fix EDK2_DSC check in Scripts/Makefile a64b944942 BaseTools: Add FMMT Python Tool 826527c9db UefiPayloadPkg: Add definition for PayloadCommandLine HOB d4eef3fe7c MdePkg: Add CpuLib to module INFs that depend on UefiCpuLib. a63b086e69 IntelFsp2Pkg: Add CpuLib to module INFs that depend on UefiCpuLib 3afa0a2096 IntelFsp2WrapperPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 1783b099d3 OvmfPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 86d41c077e UefiCpuPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 2434f6f206 UefiPayloadPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 247a0fc65e OvmfPkg: Add README for TDVF 8079d4dc4f MdePkg: add SmmCpuRendezvousLib.h and SmmCpuRendezvousLibNull implement. 1a6c837638 UefiPayloadPkg: Fix the UPL build failure 29ae55a0b8 PcAtChipsetPkg: Change the flow of PcRtcInit() a658ed30e5 MdeModulePkg/PCD: Pcd initialize DXE have assert 0e31124877 .pytool: Fix python command error in self introduction doc 43613b2fe8 CryptoPkg: Rename PCD about openssl EC configuration f753c36209 CryptoPkg: Separate auto-generated openssl config and edk2 openssl config 499b0d5fa5 CryptoPkg: Update process_files.pl to automatically add PCD config option a332ffb6ef CryptoPkg/openssl: update generated files 9dd964f5e5 CryptoPkg/openssl: disable codestyle checks for generated files b5cd30a79b UefiCpuPkg: Revert "UefiCpuPkg: Enable Tdx support in MpInitLib" ad629b5c5a OvmfPkg: Add MpInitLibDepLib related PPI/Protocol definitions 2f06e5af47 OvmfPkg: Add MpInitLibDepLib b63a49e056 OvmfPkg/Sec: Install MpInitLibDepLib PPIs in SecMain.c 73d6d41de0 OvmfPkg/TdxDxe: Install MpInitLibDepLib protocols deee7a100b OvmfPkg: Enable 2 different CpuMpPei and CpuDxe drivers 17702186b5 MdeModulePkg: PiSmmCore: Inspect memory guarded with pool headers d0efa681b6 UefiPayloadPkg: Simplify code logic 57ebb2994d UefiPayloadPkg: Add Serial IO device path according to related protocol ef01d63ef3 UefiPayloadPkg: Connect all root bridge in PlatformBootManagerBeforeConsole 35d9b7ea2d ArmPkg: Remove RVCT support b55b6d33e4 ArmPlatformPkg: Remove RVCT support e9eeb0ad2b CryptoPkg: Remove RVCT support 48b919cb14 MdePkg: Remove RVCT support 5621d81edf FatPkg: Remove RVCT support cc070e9e0c NetworkPkg: Remove RVCT support a744199470 ArmVirtPkg: Remove RVCT support b7a446f224 EmbeddedPkg: Remove RVCT support 57c84113a1 OvmfPkg: Remove RVCT support 708620d29d BaseTools: Remove RVCT support 2d1138a1a8 .azurepipelines: Fix cspell version to v5.20.0 7b126978e1 .pytool/plugin/SpellCheck: Allow compound words 2189c71026 .pytool/plugin/SpellCheck: Add more common words 0903042b66 MdeModulePkg: Add Variable Flash Info HOB 60b519456c MdeModulePkg/VariableFlashInfoLib: Add initial library 4dbebc2d10 MdeModulePkg/Variable: Consume Variable Flash Info 8db39c60cd MdeModulePkg/FaultTolerantWrite: Consume Variable Flash Info 524a15c1fa ArmVirtPkg/ArmVirt.dsc.inc: Add VariableFlashInfoLib a69eac7578 EmulatorPkg: Add VariableFlashInfoLib a7d3d4e7c4 OvmfPkg: Add VariableFlashInfoLib 1f026ababf UefiPayloadPkg: Add VariableFlashInfoLib a72d552f19 OvmfPkg/OvmfPkgX64: Use different CcProbeLib when SMM is on or off a21a3438f7 OvmfPkg: Make an Ia32/X64 hybrid build work with SEV 9c733f0b90 OvmfPkg: TdxDxe: Fix AsmRelocateApMailBoxLoop 07c0c2eb0a OvmfPkg: fix PcdFSBClock 16779ede2d Removed prefix to match AsmRelocateApMailBoxLoopStart - Removed patches in ovmf-bsc1196879-sev-fix.patch which are merged to mainline: - OvmfPkg/AmdSev: reserve snp pages - de463163d9 edk2-stable202205-rc1~292 - OvmfPkg/ResetVector: cache the SEV status MSR value - 63c50d3ff2 edk2-stable202205-rc1~291 - OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR - f1d1c337e7 edk2-stable202205-rc1~290 - Add the following patches for building edk2-stable202205 with nasm-2.14 on SLE15-SP3/SP4 and Leap 15.3/15.4. Those patches add marco back because nasm-2.14 doesn't support corresponding instructions. (jsc#PED-1410) - ovmf-Revert-MdePkg-Remove-the-macro-definitions-regarding.patch ovmf-Revert-UefiCpuPkg-Replace-Opcode-with-the-correspond.patch ovmf-Revert-SourceLevelDebugPkg-Replace-Opcode-with-the-c.patch ovmf-Revert-MdePkg-Replace-Opcode-with-the-corresponding-.patch ovmf-Revert-MdeModulePkg-Replace-Opcode-with-the-correspo.patch - Then reverted 5 patches in 84338c0d49~..bbaa00dd01 MdeModulePkg: Replace Opcode with the corresponding MdePkg: Replace Opcode with the corresponding SourceLevelDebugPkg: Replace Opcode with the UefiCpuPkg: Replace Opcode with the corresponding MdePkg: Remove the macro definitions regarding Opcode. - Change the size of ovmf-x86_64 to 4MB, otherwise OBS exposes the following error: [ 266s] GenFv: ERROR 3000: Invalid [ 266s] the required fv image size 0x1afed8 exceeds the set fv image size 0x1ac000 - [ovmf-x86_64]="-p OvmfPkg/OvmfPkgX64.dsc -D FD_SIZE_4MB" - Removed patches in ovmf-bsc1196879-sev-fix.patch which are merged to edk2-stable202205: - OvmfPkg/AmdSev: reserve snp pages - de463163d9 edk2-stable202205-rc1~292 - OvmfPkg/ResetVector: cache the SEV status MSR value - 63c50d3ff2 edk2-stable202205-rc1~291 - OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR - f1d1c337e7 edk2-stable202205-rc1~290 - Because 5 revert patches in edk2-stable202205 for nasm-2.14 is against 15-SP4/Leap 15.4 and earlier version. So add suse_version and sle_version checking logic in ovmf.spec when applying revert patches. (jsc#PED-1410) - Modified ovmf.changes log, using PED-1410 instead of PED-1359 for pushing to SLE15-SP5. - Add patches to disable option ROM on sev (bsc#1199156) ovmf-bsc1199156-OvmfPkg-IncompatiblePciDeviceSupportDxe-Ignore-Optio.patch - Update to edk2-stable202208 (jsc#PED-1410) - Features (https://github.com/tianocore/edk2/releases): Add CRC16 and CRC32C to MdePkg IntelFsp2Pkg/ConfigEditor: Support FSP 2.3 header Extend SecureBootVariableLib interfaces UEFI HTTPS Boot Support for HTTP Client Authentication (Basic or Digest) Support 64bit FspResetType for X64 build IntelFsp2Pkg/FspSecCore: Add FSP-I entry for SMM support Add PCI_DEVICE_PPI definition to EDK2 Support to assign the subject name to sign the capsule file - Patches (git log --oneline --reverse edk2-stable202205..edk2-stable202208): 7f0890776e MdeModulePkg/UniversalPayload: Align Identifier value with UPL spec b4be5f05dd UefiPayloadPkg: Align Identifier value with UPL spec dac2fc8146 UefiPayloadPkg: Align SpecRevision value with UPL spec 3ca7326b37 OvmfPkg/VirtioGpuDxe: replace struct copy with CopyMem call fa2b212d61 IntelFsp2Pkg: Add FSP 2.3 header support 11d8abcba2 IntelFsp2Pkg: FSP_TEMP_RAM_INIT call must follow X64 Calling Convention df1c7e91b4 IntelFsp2WrapperPkg: FSP_TEMP_RAM_INIT call for X64 Calling Convention 62044aa99b OvmfPkg/ResetVector: Removing SEV-ES CPUID bit check 54cd0d9b2f OvmfPkg: Fix TDVMCALL error in ApRunLoop.nasm 64706ef761 OvmfPkg: Search EFI_RESOURCE_MEMORY_UNACCEPTED for Fw hoblist 81ab97b7b9 OvmfPkg/AmdSev: remove unused SMM bits from .dsc and .fdf files 0223898f3e OvmfPkg/Microvm: drop CODE and VARS files b57911c84c OvmfPkg/FdtPciHostBridgeLib: io range is not mandatory 47f44097eb OvmfPkg/Platform: unfix PcdPciExpressBaseAddress ad3bafa7d5 OvmfPkg/Microvm/pcie: no vbeshim please bd10d4e201 OvmfPkg/Microvm/pcie: mPhysMemAddressWidth tweak 632574ced1 OvmfPkg/Microvm/pcie: add pcie support 5c9f151e0c OvmfPkg: CloudHv: Fix FW_BASE_ADDRESS 43f3cfce19 OvmfPkg: Check for QemuFwCfg availability before accessing it 3129ed374c OvmfPkg: CloudHv: Rely on QemuFwCfgLibNull implementation bf25f27e00 OvmfPkg: Don't access A20 gate register on Cloud Hypervisor 72c5afd0b4 Security: Add HashLibTdx b1567b2e15 CryptoPkg: Add SecCryptLib dc443e4437 SecurityPkg: Add definition of EFI_CC_EVENT_HOB_GUID a708536dce OvmfPkg: Introduce SecMeasurementLib 4b0a622635 OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV ac03c339de OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table f8264e1303 MdePkg: Define CC Measure EventLog ACPI Table 57a6ee3461 OvmfPkg/IntelTdx: Add TdTcg2Dxe 0a4019ec9d OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot 0b36dea3f8 BaseTools: Fix dependency issue in PcdValueInit 4f89e4b3e8 .pytool: UncrustifyCheck: Set IgnoreFiles path relative to package path 2818fda9bc Security: Add SecTpmMeasurementLibTdx ff0ffe5999 OvmfPkg: Implement MeasureHobList/MeasureFvImage a81a650da1 OvmfPkg: Delete SecMeasurementLibTdx ff36b2550f OvmfPkg/Sec: fix stack switch 21a9b605b8 CpuException: Avoid allocating code pages for DXE instance 34d505123e CpuException: Init global variables in-place 2fbc5ff0a5 CpuException: Avoid allocating page but using global variables 2a09527ebc CpuException: Remove InitializeCpuInterruptHandlers e7abb94d1f CpuException: Add InitializeSeparateExceptionStacks 54aeed7e00 MpInitLib: Allocate code buffer for PEI phase 76323c3145 MpInitLib: remove unneeded global ASM_PFX b4d7b9d2b5 MpInitLib: Put SEV logic in separate file 283ab9437a MpInitLib: Only allocate below 1MB memory for 16bit code ccc269756f MpInitLib: Move the Above1Mb vector allocation to MpInitLibInitialize f0b97e165e Revert "OvmfPkg/Sec: fix stack switch" b09ada6edc MdePkg: Remove "assert" from SmmCpuRendevousLibNull.c 92288f4334 MdePkg/BaseLib: Add CRC16-ANSI and CRC32c implementations e2ae0bed29 ArmPkg/ArmExceptionLib: Follow new CpuExceptionHandlerLib APIs 6676162f64 DxeMain: Fix the bug that StackGuard is not enabled 16d97fa601 OvmfPkg: Use PcdOvmfWorkAreaBase instead of PcdSevEsWorkAreaBase 05e57cc9ce SecurityPkg/HashLibTdx: Return EFI_UNSUPPORTED if it is not Tdx guest 92ab049719 BaseTools: output the intermediate library instance when error occurs cc2db6ebfb UefiPayloadPkg: Increase the PcdMaximumUnicodeStringLength e8034b534a UefiPayloadPkg: Always split page table entry to 4K if it covers stack. cfe165140a UefiPayloadPkg: UniversalPayloadBuild.py to support --pcd feature b97243dea3 MdeModulePkg/XhciDxe: Check return value of XHC_PAGESIZE register 3930d1791a ArmPlatformPkg: Remove overly verbose DEBUG lines in LcdGraphicsBlt aa1bce0e5e OvmfPkg: reduce the number of dsc include files for tpm libs 6c9f218bc0 OvmfPkg/Library: Create base HardwareInfoLib for PCI Host Bridges 2b1a5b8c61 Ovmf/HardwareInfoLib: Create Pei lib to parse directly from fw-cfg a1bd79c514 Ovmf/HardwareInfoLib: Add Dxe lib to dynamically parse heterogenous data 3497fd5c26 Ovmf/PlatformPei: Use host-provided GPA end if available 3f5b1b9132 OvmfPkg/PciHostBridgeUtilityLib: Initialize RootBridges apertures with spec f304308e1c ArmPlatformPkg: Add PCD for serial debug port interrupt 4bfd668e5e UefiCpuPkg: CpuDxe: Set RW and P Attributes on Split Pages 2aee08c0b6 UefiPayloadPkg: Backward support with python 3.6 8f0722434b ArmVirtPkg: Include DxeHardwareInfoLib library class in dsc 15b25045e6 Ovmf: Include HardwareInfoLib library classes for IntelTdx b600f253b3 BaseTools/Ecc: Fix grammar in Ecc error message 7f4eca4cc2 MdeModulePkg/XhciDxe: Add access xHCI Extended Capabilities Pointer 5914128871 BaseTools: Fix the GenMake bug for .cpp source file c13377153f MdePkg/Acpi62: Add type 7 NFIT Platform Capabilities Structure support 21e6ef7522 UefiPayloadPkg: Align Attribute value with UPL spec 8d0564deaf pip-requirements.txt: Update basetools version to 0.1.24 f966093f5b OvmfPkg/PlatformCI: add IntelTdxBuild.py 70586d4e3a MdePkg/Acpi62: Add bit definitions to NFIT Platform Capabilities Structure 7861b24dc9 ArmPkg/Drivers: ArmGicIsInterruptEnabled returns incorrect value e1eef3a8b0 NetworkPkg: Add Wi-Fi Wpa3 support in WifiConnectManager 134fbd552c SecurityPkg: UefiSecureBoot: Definitions of cert and payload structures d6bee54c45 SecurityPkg: PlatformPKProtectionLib: Added PK protection interface 56c717aafa SecurityPkg: SecureBootVariableLib: Updated time based payload creator 6de7c084db SecurityPkg: SecureBootVariableLib: Updated signature list creator 6eb4079475 SecurityPkg: SecureBootVariableLib: Added newly supported interfaces fe73e9cd89 SecurityPkg: SecureBootVariableProvisionLib: Updated implementation d2a0f379d5 SecurityPkg: Secure Boot Drivers: Added common header files 5678ebb42b SecurityPkg: SecureBootConfigDxe: Updated invocation pattern dbc4e3675f SecurityPkg: SecureBootVariableLib: Added unit tests 152e37cc5a OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency f193b945ea EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency 9ab18fec82 StandaloneMmPkg: Fix issue about SpPcpuSharedBufSize field 31d3eeb103 StandaloneMmPkg: Replace DEBUG_INFO with DEBUG_ERROR 5496c763aa StandaloneMmPkg: Fix check buffer address failed issue from TF-A e93bc6309b UefiCpuPkg/SecCore: Add debug messages to illuminate data flow 86a0f84470 ArmVirtPkg: Pipeline: Resolving newly introduced dependency c8e30482fd .gitignore: Ignore build tools build logs f6f3cc7ead UefiPayloadPkg: Add CryptoDxe driver to UefiPayload 12dd064a18 MdePkg/include: Update DMAR definitions to Intel VT-d spec ver4.0 9ab389c01b UefiCpuPkg: Update SEC_IDT_TABLE struct 470206ba7f IntelFsp2Pkg: Update SEC_IDT_TABLE struct 0d23c447d6 DynamicTablesPkg: Add support to specify FADT minor revision 07c8e5e59b UefiPayloadPkg/PlatformBootManagerLib: Evenly space boot prompt 176016387f BaseTools: add '-p' for Linux 'cp' command. 039bdb4d3e BaseTools: Fix DSC LibraryClass precedence rule fc4a132c0e DynamicTables: Fix DT PCI interrupt flags parsing 792ebb6374 DynamicTablesPkg: Fix generated _HID value for SBSA c966204049 IntelFsp2Pkg: Add Definition of EDKII_PEI_VARIABLE_PPI 586b4a104b Maintainers.txt: Add IntelFsp2*Pkg Maintainer e18a5f813c Maintainers.txt: Update Maintainers/reviewers for UefiPayloadPkg e21b203911 UefiPayloadPkg: Add macro to support selective driver in UPL f0064ac3af Maintainers.txt: Update email address 6cda306da1 DynamicTablesPkg: AcpiSsdtPcieLibArm: Correct translation value 9ac155bf0b DynamicTablesPkg: AcpiSsdtPcieLibArm: Support UID > 0xF 19a8768365 DynamicTablesPkg: AcpiSsdtPcieLibArm: Create support library 671b0cea51 NetworkPkg/HttpBootDxe: Add Support for HTTP Boot Basic Authentication 140446cd59 IntelFsp2Pkg: Support 64bit FspResetType for X64 build. 24eac4caf3 IntelFsp2WrapperPkg: Support 64bit FspResetType for X64 build. 4824924377 IntelFsp2Pkg/FspSecCore: Add FSP-I API for SMM support. 3b8cee1781 Maintainers.txt: update Gary's email address 7ef91af84c EmulatorPkg/PosixFileSystem: Add NULL check on memory allocation 494f333aba MdeModulePkg/CoreDxe: Allow DXE Drivers to use untested memory 343f37b5c0 MdeModulePkg/SetupBrowserDxe:Follow spec'd way to reconnect driver c8af26627a ArmPkg/CpuDxe: drop ARM_PROCESSOR_TABLE pseudo-ACPI table 5a3641bfcd IntelFsp2Pkg: Add FSPI_ARCH_UPD. bf1ff540d9 MdePkg/UefiDevicePathLib: Add support for PEIMs 6964b5c48c MdeModulePkg/Include: Long debug string is truncated to 104 char d32a84b5ad BaseTools: INF should use latest Pcd value instead of default value 8ee26529d1 BaseTools/VolInfo: Correct alignment attributes display c0b7679aac BaseTools/VolInfo: Increase define for highest section value fca5de51e1 BaseTools/VolInfo: Correct EFI_SECTION_VERSION display 8a5782d704 UefiCpuPkg: Fix nasm warning "signed byte value exceeds" a47241f133 UefiPayloadPkg: Add macro to support selection of CryptoDxe driver 69f76d0f72 Maintainers.txt: Remove OvmfPkg/XenTimerDxe reference a8c4fe23c4 Maintainers.txt: Add missing github ids 7f1c89f167 Maintainers.txt: Remove reviewer Harry Han b68d566439 BaseTools/Capsule: Support signtool input subject name to sign capsule file e3d468acb9 BaseTools/VolInfo: Show encapsulation sections 2677286307 UefiPayloadPkg: Fix RelaAddress type always mismatch in if condition f26b70cb9f UefiPayloadPkg: Add support for logging to CBMEM console 57783adfb5 OvmfPkg: Change default to disable MptScsi and PvScsi 1774a44ad9 Maintainers.txt: Remove MptScsi and PvScsi reviewers 0e7add1d75 OvmfPkg/XenHypercallLib: Fix naming of AArch64 3eca64f157 IntelFsp2Pkg: FSPI_UPD is not mandatory. 0d0bfcb457 IntelFsp2Pkg: Fix GenCfgOpt bug for FSPI_UPD support. 8a210b9ac0 ShellPkg: Acpiview: Abbreviate field names to preserve alignment 65c4f3f2be DynamicTablesPkg: Handle error when IdMappingToken is NULL f5cea604a6 DynamicTablesPkg: IORT set reference to Id array only if present 238f903e8d DynamicTablesPkg: IORT set reference to interrupt array if present 4c55f6394f MdePkg: IORT header update for IORT Rev E.d spec cd67efa1b2 ShellPkg: Acpiview: IORT parser update for IORT Rev E.d spec de200b7e2c DynamicTablesPkg: Update ArmNameSpaceObjects for IORT Rev E.d e9150618ec DynamicTablesPkg: IORT generator updates for Rev E.d spec 6f4e10d6db SecurityPkg: Add retry mechanism for tpm command 19cbfaa431 OvmfPkg/QemuVideoDxe: Zero out PixelInformation in QueryMode a551de0d93 ArmVirtPkg: Fix KVM Guest Firmware 0dc9b78a46 Maintainers.txt: Add missing Github IDs for OvmfPkg TPM/TGC modules d219119721 UefiPayloadPkg/PlatformBootManagerLib: Correct spacing in boot prompt 79aab22fca UefiPayloadPkg: Add a Macro to enable Boot Logo 444260d45e UefiPayloadPkg: Load Boot Logo into ACPI table 86757f0b47 MdeModulePkg: Add EDKII_PCI_DEVICE_PPI definition a8f59e2eb4 MdeModulePkg/AhciPei: Use PCI_DEVICE_PPI to manage AHCI device 3e599bbc10 DynamicTablesPkg: Fix using RmrNodeCount unitlitialised a0a03b5154 BaseTools/GenSec: Fix typo f5f8c08db9 BaseTools/VolInfo: Show FV section boundaries d241a09afb BaseTools/VolInfo: Parse EFI_SECTION_FREEFORM_SUBTYPE_GUID header cf02322c98 BaseTools/GenSec: Support EFI_SECTION_FREEFORM_SUBTYPE_GUID sections 1ee1622817 Basetools/GenFw: Allow AARCH64 builds to use the --prm flag 9f197e44b1 PrmPkg: Enable external visibility on PRM symbols 21200d9fe6 PrmPkg: Build Prm Samples with GCC for AARCH64 57faeb782a PrmPkg: Support AArch64 builds using GCC 1da2012d93 PrmPkg: Add details on AArch64 build to the Readme. 0f7bccf584 UefiCpuPkg: Simplify InitializeSeparateExceptionStacks 9a24c3546e MdeModulePkg: Move CPU_EXCEPTION_INIT_DATA to UefiCpuPkg f1688ec9da UefiCpuPkg: Simplify the struct definition of CPU_EXCEPTION_INIT_DATA 75e3c2435c UefiCpuPkg: Create CpuPageTableLib for manipulating X86 paging structs f336e30ba1 UefiCpuPkg/CpuPageTableLib: Return error on invalid parameters bf334513b3 CpuPageTableLib: Fix a bug when a bit is 1 in Attribute, 0 in Mask 13a0471bfd CpuPageTableLib: Refactor the logic 9cb8974f06 CpuPageTableLib: Split the page entry when LA is aligned but PA is not c16f02f776 CpuPageTableLib: Avoid treating non-leaf entry as leaf one f4c845e46b CpuPageTableLib: Fix parent attributes are not inherited properly 9f53fd4ba7 CpuPageTableLib: Fix a bug to avoid unnecessary changing to page table 927113c83b CpuPageTableLib: Fix bug that wrongly requires extra size for mapping e9e2ecab2d CpuPageTableLib: define IA32_PAGE_LEVEL enum type internally e76496530c MdePkg/Library/UefiDevicePathLib: Add back StandaloneMm INF file bd06717863 MdeModulePkg: Enhance bus scan for all root bridge instances 74f44d920a ShellPkg/SmbiosView: Display extended memory info in smbiosview -t 17 83d5871184 UefiCpuPkg/PiSmmCpuDxeSmm: Add a new mIsShadowStack flag 7b4754904e UefiCpuPkg/PiSmmCpuDxeSmm: Remove mInternalCr3 in PiSmmCpuDxeSmm 62391b4ce9 MdeModulePkg/DxeIpl: Remove clearing CR0.WP when protecting pagetable 803ed060ee UefiPayloadPkg: Remove clearing CR0.WP when protecting pagetable a2b61de2f6 IntelFsp2Pkg: FSPM_ARCH2_UPD mismatching bug. 809b5a3d2a MdeModulePkg: Update the SMBIOS version by UPL 2812668bfc UefiCpuPkg/CpuPageTableLib/UnitTest: Add host based unit test 30d62f5e31 OvmfPkg/PlatformDxe: Check ExtractConfig and RouteConfig arguments b94836b224 OvmfPkg/VirtioGpuDxe: Check QueryMode arguments 3f282f4510 OvmfPkg/VirtioFsDxe: Check GetDriverName arguments 64a20bea97 MdeModulePkg/DumpDynPcd: Remove unsupported format specifiers 9102518d29 MdePkg: Improved Smbios Type9 table and Smbios spec v3.5.0 Changes 35d167ef3c ShellPkg: Improved Smbios Type 9 table changes in PrintInfo.c 68bf712d4f MdePkg: Added support for SMBIOS spec v3.6.0 to Smbios.h e2ac68a23b BaseTools/Source/C/GenSec: Fix EFI_SECTION_FREEFORM_SUBTYPE_GUID header d5fd86f256 ShellPkg: Adds Local APIC parser to AcpiView 2bb0020675 UefiPayloadPkg: Return PciRootBridges instead of NULL c15c9fa420 UefiPayloadPkg: Add macro to control NvmExpressDxe 938430741f RedfishPkg/RedfishDiscoverDxe: USB Redfish host interface is not supported eebef1b3b7 RedfishPkg: Redfish modules may need to use the functions which are private f2bf043aaa RedfishPkg: Redfish functions for REST requests are not fully spec complied dfdba857a6 UefiPayloadPkg: Fix Coverity report defect 4d83ee04f4 ShellPkg: Add revision check for DSDT Header on Arm 0ede7cad73 Maintainers.txt: Update maintainers list 722e03bc2e Revert "UefiCpuPkg/CpuPageTableLib/UnitTest: Add host based unit test" 166c49c212 Revert "ShellPkg: Adds Local APIC parser to AcpiView" 39ff9769ca Revert "BaseTools: Fix DSC LibraryClass precedence rule" ba0e0e4c6a BaseTools: Fix DevicePath GNUmakefile for macOS - Respin the following patches: ovmf-Revert-UefiCpuPkg-Replace-Opcode-with-the-correspond.patch - Change the size of ovmf-x86_64 back to 2MB, and remove EFI shell to reduce the fv image size. - Originally the reason of changing the size of ovmf-x86_64 to 4MB is for preventing OBS exposes the following error: [ 266s] GenFv: ERROR 3000: Invalid [ 266s] the required fv image size 0x1afed8 exceeds the set fv image size 0x1ac000 The fv image size is too big. But we found that change ovmf-x86_64 to 4MB causes live migration problem on qemu. (bsc#1204220) - So let's change the size of ovmf_x86_64 back to 2MB and remove EFI shell to reduce the fv image size. If user wants to use EFI shell, they should move to ovmf-x86_64-4m image. So we add the "-D EXCLUDE_SHELL" build option to ovmf-x86_64 flavor in ovmf.spec. (bsc#1204220) - Add ovmf-Revert-OvmfPkg-OvmfXen-Set-PcdFSBClock.patch to revert 71cdb91f313380152d7bf38cfeebe76f5b2d39ac patch (bsc#1205613) - 71cdb91f313380152d7bf38cfeebe76f5b2d39ac OvmfPkg/OvmfXen: Set PcdFSBClock - We are waiting better upsteam patch, revert the issue patch first. Then PcdFSBClock will back to fixed variable. - Reference: https://edk2.groups.io/g/devel/topic/94891128#96077 https://bugzilla.tianocore.org/show_bug.cgi?id=4340 - Add ovmf-MdeModulePkg-PiSmmCore-SmmEntryPoint-underflow-CVE-2.patch for MdeModulePkg/PiSmmCore: SmmEntryPoint underflow (CVE-2021-38578) (bsc#1196741) - Add ovmf-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch to check result of GetEfiGlobalVariable2 (CVE-2019-14560, bsc#1174246) - Add ovmf-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount (bsc#1225889, CVE-2024-1298) - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Update to edk2-stable202111 - Features (https://github.com/tianocore/edk2/releases): Add SSDT CPU topology generator Support ACPI 6.4 in GTDT parser and generator Support ACPI 6.4 in DynamicTables FADT parser Support ACPI 6.4 in Acpiview PCCT parser Support ACPI 6.4 in Acpiview HMAT parser Add support for the microvm machine type (qemu) OVMF/ArmVirt: add support for virtio-mmio 1.0 IntelFsp2Pkg: adopt FSP 2.3 specification UefiCpuPkg VTF0 X64: Build page tables using Linear-Address Translation to a 1-GByte Page Enable wildcard host name matching in HTTPS/TLS implementation Add QuickSort function into BaseLib Add SMM NV variable support in universal UEFI payload Add TDVF to OvmfPkg Make package and platform builds reproducible across source format changes - Patches (git log --oneline --reverse edk2-stable202108~..edk2-stable202111): 7b4a99be8a CryptoPkg: BaseCryptLib fix incorrect param order 82f7e315d6 MdeModulePkg/PeiCore: Remove MigrateSecModulesInFv() 8b15024dc7 Maintainers: Add kraxel as Reviewer to ArmVirtPkg and OvmfPkg 80e67af9af OvmfPkg: introduce a common work area ab77b6031b OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b2 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm a82bad9730 ArmPkg/GicV3Dxe: Don't signal EOI on arbitrary interrupts 94e465e5cb OvmfPkg/Virtio10: Add virtio-mmio 1.0 defines 08293e43da OvmfPkg/VirtioMmioDeviceLib: Add virtio 1.0 detection. 212a2b9bb8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Fix SetPageSize. 537a724421 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Fix SetQueueAddress 6a3e9576b8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Add default QueueNum ae12188cf8 OvmfPkg/VirtioMmioDeviceLib: virtio 1.0: Adapt feature bit handling 77d5fa8024 OvmfPkg/VirtioMmioDeviceLib: enable virtio 1.0 b04453d36b MdeModulePkg/EbcDxe: Mitigate memcpy intrinsics dc995ce906 MdeModulePkg: Add BootDiscoveryPolicyOld variable. 443300be46 MdePkg:Update IndustryStandard/Nvme.h with Nvme amdin controller data 0f11537548 MdeModulePkg:Increase Nvme capacity display cae735f613 ArmPkg: Enable boot discovery policy for ARM package. cb0d24637d OvmfPkg/OvmfXen: set PcdAcpiS3Enable at initialization 28152333bc OvmfPkg/LockBoxLib: use PcdAcpiS3Enable to detect S3 support 52e2dabc0f OvmfPkg/PlatformBootManagerLib: use PcdAcpiS3Enable to detect S3 support 5b5f10d746 OvmfPkg/SmmControl2Dxe: use PcdAcpiS3Enable to detect S3 support 9f3eda177a OvmfPkg/OvmfXen: add QemuKernelLoaderFsDxe f0fe55bca4 UefiPayloadPkg: Fix the build error when enable Core ci for UefiPayloadPkg 5d34cc49d5 UefiCpuPkg/PiSmmCpuDxeSmm: Update mPatchCetSupported set condition cdda3f74a1 UefiPayloadPkg/UefiPayloadEntry: Fix memory corruption 3b3f882288 MdeModulePkg/PiSmmCore: Drop deprecated image profiling commands b170806518 UefiCpuPkg: Clean up save state boundary checks and comments. 12e33dca4c IntelFsp2Pkg: Support Config File and Binary delta comparison 63fddc98e0 UefiPayloadPkg: Create .yaml file in UefiPayloadPkg e3ee8c8dbd .azurepipelines: Add UefiPayloadPkg in gate-build-job.yml and CISetting.py b6bc203375 MdeModulePkg/HiiDatabaseDxe:remove dead code block c5e805ffe1 MdeModulePkg: Fix typo of "memory" in RamDiskDxe debug message 81d71fb86e Maintainers.txt: Update maintainer/reviewer roles in MdeModulePkg edf8bc6d24 SecurityPkg/MemoryOverwriteControl: Add missing argument to DEBUG print 4473834e7d OvmfPkg/OvmfXen: Fix build with QemuKernelLoaderFsDxe a7cf2c5664 RedfishPkg: Fix various typos 851785ea67 UefiPayloadPkg: Include more modules in UefiPayloadPkg. d248516b3a UefiPayloadPkg: Include Network modules in UefiPayloadPkg. 6c7d6d4a5e UefiCpuPkg: ResetVector Tool Support for Python 3 cf7c650592 UefiCpuPkg: ResetVector Tool additional debug prints d96df7e993 UefiPayloadPkg: Fix the bug in dump guid HOB info functions dcd3d63f4f UefiPayloadPkg: Dump hob info from gEdkiiBootManagerMenuFileGuid 610d8073f2 SecurityPkg/TPM: Import PeiDxeTpmPlatformHierarchyLib.c from edk2-platforms 4d5f39cd22 SecurityPkg/TPM: Fix bugs in imported PeiDxeTpmPlatformHierarchyLib ebbc8ab2cd SecrutiyPkg/Tcg: Import Tcg2PlatformDxe from edk2-platforms 2906e572c6 SecurityPkg/Tcg: Make Tcg2PlatformDxe buildable and fix style issues f108178c56 SecurityPkg: Introduce new PCD PcdRandomizePlatformHierarchy a4867dea2a SecurityPkg/Tcg: Import Tcg2PlatformPei from edk2-platforms 2fa89c8e11 SecurityPkg/Tcg: Make Tcg2PlatformPei buildable and fix style issues 3b69fcf5f8 SecurityPkg: Add references to header and inf files to SecurityPkg 6c80564b89 MdeModulePkg/Core/Pei: Fix typo in function descriptions 6f501a7c9b MdeModulePkg/Core/Pei: Make migrated PEIM message verbose c19d18136e MdeModulePkg/Core/Pei: Fix pointer size mismatch in EvacuateTempRam() f4e72cf9d6 UefiPayloadPkg: Add script to build UniversalPayload in UefiPayloadPkg bda3546c55 UefiPayloadPkg: Fix the warning when building UefiPayloadPkg with IA32+X64 010753b7e7 UefiCpuPkg: Refactor initialization of CPU features during S3 resume 89f7ed8b29 UefiCpuPkg: Prevent from re-initializing CPU features during S3 resume 60d8bb9f28 UefiCpuPkg: VTF0 Linear-Address Translation to a 1-GByte Page till 512GB ac6388add4 ArmPkg/ProcessorSubClassDxe: Fix the format of ProcessorId e3e47d7963 UefiCpuPkg: SecCoreNative without ResetVector 542cba73d2 SecurityPkg: Add debug log for indicating IBB verified OBB successfully f334c5a41d IntelFsp2WrapperPkg: Make PcdFspModeSelection dynamic 79019c7a42 OvmfPkg: set a default value for the WorkAreaHeader PCD fdeff3fdae EmbeddedPkg: Remove duplicate libfdt.h include f2a7e24e38 EmbeddedPkg: AndroidBootImgBoot error handling updates c0cd26f43c EmbeddedPkg: Install FDT if UpdateDtb is not present 7ea7f9c077 EmbeddedPkg: Add LoadFile2 for linux initrd d60915b751 UefiPayloadPkg: Add Macro to enable or disable some drivers. 46b4606ba2 MdeModulePkg/PciBusDxe: Improve the flow of testing support attributes f57040b038 MdeModulePkg/BootManagerMenuApp: Limit string drawing within one line b0f1b1c5fd MdePkg: Fix DEVICE_SECURITY_EVENT_DATA_HEADER version definition cc5a67269e UefiPayloadPkg: Build a HOB from bootloader ACPI table dc430ccf3f UefiPayloadPkg: Use dummy constructor for PlatformHookLib 4a1899dd79 UefiPayloadPkg: Add ".upld_info" in universal payload 2ea0a0a414 BaseTools: Switch to downloading the ARM compiler from Arm's site 1ce6ceb75b BaseTools: Switch to downloading the AARCH64 compiler from Arm's site c214128a38 BaseTools/GenMake: Use ToolDefinition as fallback option 259c184c8f BaseTools/build: Set MakefileName 445c39f757 BaseTools: Remove Makefile/MakefileName fields c7d5b046d9 BaseTools: Remove hard-coded strings for target and tools_def 442e46d3b6 UefiPayloadPkg: Update maximum logic processor to 256 499c4608b1 OvmfPkg/TPM PPI: Connect default consoles for user interaction b8675deaa8 OvmfPkg: Handle TPM 2 physical presence opcodes much earlier 8ab8fbc016 OvmfPkg: Reference new Tcg2PlatformDxe in the build system for compilation bd298d7593 OvmfPkg: Reference new Tcg2PlatformPei in the build system f86de75862 MdePkg: MmCommunication: Added definition of MM Communication PPI 8b4bb94f64 MdePkg: CI YAML: Added new GUID to ignore duplicate list 9e950cda6a MdeModulePkg: CI YAML: Added new GUID to ignore duplicate list 2273799677 SecurityPkg: Fix SecureBootDefaultKeysDxe failed to start 422e5d2f7f UefiPayloadPkg: Remove asm code and sharing libraries 0875443f7e DynamicTablesPkg: Extract AcpiHelperLib from TableHelperLib 20775950c6 DynamicTablesPkg: Update TableHelperLib.inf 1ad5182500 DynamicTablesPkg: Rename single char input parameter 653113412f DynamicTablesPkg: Add HexFromAscii() to AcpiHelperLib 72ab552554 DynamicTablesPkg: Add AmlGetEisaIdFromString() to AcpiHelperLib 96e006b37e DynamicTablesPkg: Add Configuration Manager Object parser 235ff9fcd1 DynamicTablesPkg: Use %a formatter in AmlDbgPrint 7a8c037e9e DynamicTablesPkg: Update DynamicTablesPkg.ci.yaml 691c5f7762 DynamicTablesPkg: Deprecate Crs specific methods in AmlLib 22873f58c4 DynamicTablesPkg: Rework AmlResourceDataCodegen.c/h 4cc1458dbe IntelFsp2Pkg: Adopt FSP 2.3 specification. c49cb8f30e ArmPkg: SmbiosMiscDxe: Don't populate ExtendedBiosSize when size < 16MB 282122ec5f ArmVirtPkg/TPM: Add a NULL implementation of TpmPlatformHierarchyLib b3685956d2 ArmVirtPkg: Reference new TPM classes in the build system for compilation c806b76865 ArmVirtPkg: Disable the TPM2 platform hierarchy 606340fba3 OvmfPkg/Microvm: copy OvmfPkgX64 files as-is 4932f05a00 OvmfPkg/Microvm: rename output files, fix includes 2a49c19b9e OvmfPkg/Microvm: no smm 60d55c4156 OvmfPkg/Microvm: no secure boot 0569c52b15 OvmfPkg/Microvm: no tpm 06fa1f1931 OvmfPkg/Microvm: no sev 6073bf6cd8 OvmfPkg/Microvm: no csm b9dd64b80e OvmfPkg/Microvm: no emulated scsi 27de86ae41 OvmfPkg/Microvm: use MdePkg/Library/SecPeiDxeTimerLibCpu 76602f45dc OvmfPkg/Microvm: use XenTimerDxe (lapic timer) 6a8e9ad24b OvmfPkg/Microvm: PlatformPei/MemDetect tweaks 8583b57c5c OvmfPkg/Microvm: PlatformPei/Platform memory map tweaks bf02d73e74 OvmfPkg/Microvm: PlatformPei/Platform: add id. 1d3e89f349 OvmfPkg/ResetSystemLib: add driver for microvm 2c467c9be2 OvmfPkg/Microvm: BdsPlatform: PciAcpiInitialization tweak. 8456785986 OvmfPkg/Microvm: use PciHostBridgeLibNull 55f47d2299 OvmfPkg/Microvm: wire up serial console, drop super-io 862e814de4 OvmfPkg/Microvm: add Maintainers.txt entry 06a326caf1 DynamicTablesPkg: Update FADT generator to ACPI 6.4 f09dbf20b9 DynamicTablesPkg: Rename SBSA generic watchdog 942c9bd357 ShellPkg: Update Acpiview GTDT parser to ACPI 6.4 80e67bcb23 ShellPkg: Update Acpiview PCCT parser to ACPI 6.4 b4da6c29f1 ShellPkg: Add Type 5 PCC Subspace Structure parser 5ece2ad36c MdeModulePkg/Core/Dxe: Add lock protection in CoreLocateHandleBuffer() 30400318a2 ShellPkg: Update Acpiview HMAT parser to ACPI spec version 6.4 71c3c9c0c4 DynamicTablesPkg: Remove unnecessary includes 25cf58a163 DynamicTablesPkg: Add missing parameter check bfaf7c8b9e DynamicTablesPkg: Add AddSsdtAcpiHeader() 28b2df475f DynamicTablesPkg: Add AmlRdSetEndTagChecksum() 74addfeab6 DynamicTablesPkg: Add AmlSetRdListCheckSum() 7b2022d39e DynamicTablesPkg: Set EndTag's Checksum if RdList is modified 2dd7dd3952 DynamicTablesPkg: Clear pointer in node creation fcts 37bd08176c DynamicTablesPkg: Update error handling for node creation 6d2777d85f DynamicTablesPkg: Make AmlNodeGetIntegerValue public f995f8672b DynamicTablesPkg: AML Code generation for Register() 9454d1ebcb DynamicTablesPkg: AML Code generation for Resource data EndTag 1e33479b39 DynamicTablesPkg: AML code generation for a Package 12e65fd258 DynamicTablesPkg: Helper function to compute package length ce15936f2f DynamicTablesPkg: AML code generation for a ResourceTemplate de62ccbf4f DynamicTablesPkg: AML code generation for a Method e2d7b4950b DynamicTablesPkg: AML code generation to Return a NameString 3e958e93ce DynamicTablesPkg: AML code generation for a Method returning a NS 018a962d92 DynamicTablesPkg: AML code generation for a _LPI object a5e36ad9bc DynamicTablesPkg: AML code generation to add an _LPI state f17ef10e63 DynamicTablesPkg: Add CM_ARM_LPI_INFO object 769e63999f DynamicTablesPkg: SSDT CPU topology and LPI state generator 19ee56c4b3 UefiPayloadPkg: Add a macro to select the SecurityStubDxe driver. 782d018703 MdePkg: Add ProcessorUpgradeSocketLGA4677 from SMBIOS 3.5.0 ba4ae92234 ShellPkg: Support ProcessorUpgradeSocketLGA4677 from SMBIOS 3.5.0 f22feb0e3b CryptoPkg/BaseCryptLib: Eliminate extra buffer copy in Pkcs7Verify() 4225a464c6 MdePkg/BaseLib: Add QuickSort function on BaseLib 6ed6abd6c1 BaseTools: Change RealPath to AbsPath 978d428ec3 UefiPayloadPkg: Add PCI root bridge info hob support for SBL 43b3840873 MdeModulePkg/Sd: Corrections for Extra.uni files a7fcab7aa3 MdeModulePkg/Core/Dxe: Acquire a lock when iterating gHandleList e40fefafa9 ArmVirtPkg/FdtClintDxe: Move FdtClientDxe to EmbeddedPkg fb759b8b73 MdePkg: Add PcdPciIoTranslation PCD 7d78a86ecf ArmPkg: Use PcdPciIoTranslation PCD from MdePkg 77e9b3a7c6 ArmVirtPkg/FdtPciPcdProducerLib: Relocate PciPcdProducerLib to OvmfPkg d881c6ddf5 ArmVirtPkg/HighMemDxe: Relocate HighMemDxe to OvmfPkg 47bd85e9f9 OvmfPkg/HighMemDxe: Add RISC-V in the supported arch. f8d0501ded ArmVirtPkg/QemuFwCfgLib: Relocate QemuFwCfgLib to OvmfPkg 26aa241d2f OvmfPkg/QemuFwCfgLibMmio: Add RISC-V arch support c6770f4b88 MdePkg: Add PcdPciMmio32(64)Translation PCDs 9a7509e465 ArmVirtPkg/FdtPciHostBridgeLib: Relocate FdtPciHostBridgeLib to OvmfPkg/Fdt b21c6794de OvmfPkg/FdtPciHostBridgeLib: Add RISC-V in the supported arch. e0c23cba5e ArmVirtPkg/VirtioFdtDxe: Relocate VirtioFdtDxe to OvmfPkg/Fdt f2400e06db BaseTools: add edk2-test repo to SetupGit.py 785cfd3305 UefiPayloadPkg: Use SECURITY_STUB_ENABLE to control the SecurityStubDxe 7e43d3e086 ArmPkg/Smbios: Fix max cache size 2 wrong issue f10a112f08 UefiPayloadPkg: Fix the build issue for coreboot 2108698346 StandaloneMmPkg: Support CLANGPDB builds 11a4af85a4 Ovmfpkg: update Ia32 build to use new work area 36b561623a OvmfPkg/AmdSev: update the fdf to use new workarea PCD 91a978ce7e UefiPayloadPkg: Replace MEMROY_ENTRY by MEMORY_ENTRY 6ef5797447 UefiPayloadPkg: Fix ECC reported issues 90246a6d9f UefiPayloadPkg: Fix the build failure for non-universal payload 37a33f02aa UefiCpuPkg: Cpu feature data stored in memory may be migrated 4fdf843c75 DynamicTablesPkg: Fix unitialized variable use 6893865b30 DynamicTablesPkg: Fix void pointer arithmetic 99325a8b65 MdeModulePkg/SortLib: Add QuickSort function on BaseLib 305fd6bee0 UefiCpuPkg/CpuCacheInfoLib: Add QuickSort function on BaseLib 2f286930a8 ShellPkg: Parse I/O APIC and x2APIC structure bd5ec03d87 NetworkPkg/HttpBootDxe: make file extension check case-insensitive 6254037223 ArmPkg: Implement PlatformBootManagerLib for LinuxBoot f079e9b450 OvmfPkg: Copy Main.asm from UefiCpuPkg to OvmfPkg's ResetVector 5a2411784b OvmfPkg: Clear WORK_AREA_GUEST_TYPE in Main.asm c9ec74a198 OvmfPkg: Add IntelTdxMetadata.asm 8b76f23534 OvmfPkg: Enable TDX in ResetVector 87a34ca0cf UefiPayloadPkg: Add a common SmmAccessDxe module e7e8ea27d4 UefiPayloadPkg: Add a common SMM control Runtime DXE module bed990aae6 UefiPayloadPkg: Add bootloader SMM support module 1d66480aa4 UefiPayloadPkg: Add SpiFlashLib 04714cef46 UefiPayloadPkg: Add FlashDeviceLib ae8acce8ae UefiPayloadPkg: Add a common FVB SMM module 242dcfe30f UefiPayloadPkg: Add a SMM dispatch module b80c17b62d UefiPayloadPkg: Add SMM support and SMM variable support 2f6f3329ad FmpDevicePkg/FmpDxe: Use new Variable Lock interface 9a95d11023 IntelFsp2Pkg/SplitFspBin.py: adopt FSP 2.3 specification. bb146ce32d MdePkg Cpuid.h: Define CPUID.(EAX=7,ECX=0):EDX[30] 1bc232aae3 RedfishPkg: Update link to staging/RedfishClientPkg in Readme.md e7663fdd82 UefiPayloadPkg: Remove SystemTableInfo GUID. 91b772ab62 RedfishPkg: Add more information to Readme.md c8594a5311 SecurityPkg/FvReportPei: Remove the ASSERT to allow neither M nor V 939c2355da IntelFsp2Pkg SplitFspBin.py: Correct file name in file header 6f9e83f757 NetworkPkg/HttpDxe: Enable wildcard host name matching for HTTP+TLS. b258f12889 BaseTools/VrfCompile: Fix uninitialized field from unnamed field 0f4cdad25b DynamicTablesPkg: Add missing BaseStackCheckLib instance e13e53cb2f NetworkPkg/NetworkPkg.dsc: Add RngLib mapping for ARM and RISCV64 c1f2287635 SecurityPkg/SecurityPkg.dsc: Add missing RngLib for ARM and RISCV64 b0a03ca4a9 SignedCapsulePkg/SignedCapsulePkg.dsc: Add RngLib mapping 15e635d1b5 UefiCpuPkg/MtrrLib/UnitTest: Fix 32-bit GCC build issues 4050c873b5 MdeModulePkg/Variable/RuntimeDxeUnitTest: Fix 32-bit GCC builds d79df34beb BaseTools: Fix StructurePcd offset error. b5d4a35d90 MdeModulePkg/XhciSched: Fix missing DEBUG arguments 48452993ad MdePkg/Include: Enhance DebugLib to support reproduce builds 5948ec3647 MdePkg: Reproduce builds across source format changes f331310a10 ArmPkg: Reproduce builds across source format changes 77dcd03ecf MdeModulePkg: Reproduce builds across source format changes 45137bca2f NetworkPkg: Reproduce builds across source format changes d939a25d41 SecurityPkg: Reproduce builds across source format changes fd42dcb1fc OvmfPkg: Reproduce builds across source format changes 8c1b1fe634 ShellPkg: Add comment that ItemPtr is set after validation d6e6337cd6 MdePkg: Fix ACPI memory aggregator/device type mismatch c974257821 MdeModulePkg AtaAtapiPassThru: Always do S.M.A.R.T. check if device support aab6bb3d32 MdeModulePkg/DxeCapsuleLibFmp: Capsule on Disk file name capsule a7b35aae13 MdeModulePkg\UfsBlockIoPei: UFS MMIO address size support both 32/64 bits f826b20811 UefiCpuPkg/UefiCpuLib: Add GetCpuFamilyModel and GetCpuSteppingId 8c8867c5da MdeModulePkg/DxeCapsuleLibFmp: Use new Variable Lock interface 22c3b5a865 BaseTools: Add authenticated variable store support a92559671a OvmfPkg/Xen: Fix VS2019 build issues 4c495e5e3d OvmfPkg/Bhyve/PlatformPei: Fix VS2019 X64 NOOPT build issue 466ebdd2e0 MdeModulePkg/FPDT: Lock boot performance table address variable at EndOfDxe 455b0347a7 UefiCpuPkg/PiSmmCpuDxeSmm: Use SMM Interrupt Shadow Stack e1e7306b54 OvmfPkg/Library/ResetSystemLib: Fix Microvm VS2019 NOOPT build issue 4c7ce0d285 MdeModulePkg AtaAtapiPassThru: Skip the potential NULL pointer access bb1bba3d77 NetworkPkg: Fix invalid pointer for DNS response token on error - Removed patches which are merged to mainline: - ovmf-OvmfPkg-OvmfXen-set-PcdAcpiS3Enable-at-initializatio.patch to fix the S3 detection in ovmf-xen - cb0d24637d edk2-stable202111-rc1~220 - ovmf-OvmfPkg-OvmfXen-add-QemuKernelLoaderFsDxe.patch to add QemuKernelLoaderFsDxe to ovmf-xen to load kernel from qemu fw_cfg - 9f3eda177a edk2-stable202111-rc1~216 - ovmf-OvmfPkg-OvmfXen-Fix-build-with-QemuKernelLoaderFsDxe.patch - 4473834e7d edk2-stable202111-rc1~203 - The edk2-stable202111 includes the following patches for bsc#1192126 to fix unlimited reset. (bsc#1192126) 80e67af9af OvmfPkg: introduce a common work area ab77b6031b OvmfPkg/ResetVector: update SEV support to use new work area format b9af5037b2 OvmfPkg/ResetVector: move the GHCB page setup in AmdSev.asm - Removed useless patch files because they are merged to edk2-stable202111 - ovmf-OvmfPkg-OvmfXen-Fix-build-with-QemuKernelLoaderFsDxe.patch - ovmf-OvmfPkg-OvmfXen-add-QemuKernelLoaderFsDxe.patch - ovmf-OvmfPkg-OvmfXen-set-PcdAcpiS3Enable-at-initializatio.patch - Updated URL to the edk2 repo on github - Use downloaded edk2-edk2-stable%{version}.tar.gz instead of the URL for Source0 because the edk2-edk2-stable202111 tarball is broken in tianocore repo which can not pass the "osc service runall download_files" testing. - We ill change it back to the following setting when upstream fixed tarball: Source0: https://github.com/tianocore/edk2/releases/download/edk2-stable%{version}/edk2-edk2-stable%{version}.tar.gz - Modified gdb_uefi.py.in for python3 (bsc#1192126) - change 'long' to 'int' - using print (' instead of print " - Sort file lists for reproducible build results - Update to edk2-stable202202 - Features (https://github.com/tianocore/edk2/releases): OvmfPkg Add new target for Cloud Hypervisor Add TDVF to OvmfPkg Add new APIs to UefiCpuPkg/UefiCpuLib Add AMD Secure Nested Paging Support Add SSDT PCI generator in DynamicTablesPkg Support ACPI 6.4 PPTT changes Add FdtHwInfoParser library Add DynamicPlatRepo library Make package and platform builds reproducible across source format changes Add Uncrustify CI Plugin Apply uncrustify changes to all package C and H files - Patches (git log --oneline --reverse edk2-stable202111~..edk2-stable202202): bb1bba3d77 NetworkPkg: Fix invalid pointer for DNS response token on error ef9a059cdb EmulatorPkg/Win/Host: Update CC_FLAGS 69877614fd .pytool/Plugin/EccCheck: Remove RevertCode() 854462bd34 .pytool/Plugin/EccCheck: Remove temp directory on exception 3019f1bbab .pytool/Plugin/EccCheck: Add performance optimizations 99f84ff473 .pytools/Plugin/LicenseCheck: Use temp directory for git diff output 76a1ce4d5f .azurepipelines/templates: Update max pipeline job time to 2 hours 365dced2c3 ArmPkg: Update YAML to ignore specific ECC files/errors 1939fc9569 ArmPlatformPkg: Update YAML to ignore specific ECC files/errors c97fee87f0 ArmVirtPkg: Update YAML to ignore specific ECC files/errors d5744ecba8 CryptoPkg: Update YAML to ignore specific ECC files/errors d7d30e8f21 EmulatorPkg: Update YAML to ignore specific ECC files/errors 9deb937076 MdeModulePkg: Update YAML to ignore specific ECC files/errors df790cd6b3 MdePkg: Update YAML to ignore specific ECC files/errors 60fa40be45 SecurityPkg: Update YAML to ignore specific ECC files/errors 9944508e85 ShellPkg: Update YAML to ignore specific ECC files/errors c30c40d6c6 StandaloneMmPkg: Update YAML to ignore specific ECC files/errors c057347977 UefiPayloadPkg: Update YAML to ignore specific ECC files/errors f0f3f5aae7 UnitTestFrameworkPkg: Update YAML to ignore specific ECC files/errors dfafa8e453 MdeModulePkg/DxeCorePerformanceLib:Variable Initial a4a582e180 ArmPkg: Change use of EFI_D_* to DEBUG_* 1d2482e1e3 ArmPlatformPkg: Change use of EFI_D_* to DEBUG_* c5b3a56e4f ArmVirtPkg: Change use of EFI_D_* to DEBUG_* a1878955b2 EmbeddedPkg: Change use of EFI_D_* to DEBUG_* 9c7da8d804 EmulatorPkg: Change use of EFI_D_* to DEBUG_* 917e98f3e5 FatPkg: Change use of EFI_D_* to DEBUG_* 87000d7708 MdeModulePkg: Change use of EFI_D_* to DEBUG_* 5f289f3ae3 MdePkg: Change use of EFI_D_* to DEBUG_* c49ca4a29e NetworkPkg: Change use of EFI_D_* to DEBUG_* 47719926e8 OvmfPkg: Change use of EFI_D_* to DEBUG_* ca56749b0e PcAtChipsetPkg: Change use of EFI_D_* to DEBUG_* e905fbb05a SecurityPkg: Change use of EFI_D_* to DEBUG_* 4a1aee13d8 ShellPkg: Change use of EFI_D_* to DEBUG_* 586fda4800 SourceLevelDebugPkg: Change use of EFI_D_* to DEBUG_* 96e1cba5c1 UefiCpuPkg: Change use of EFI_D_* to DEBUG_* 1871d28eaf ArmPkg: Change OPTIONAL keyword usage style 2863ba97ca ArmPlatformPkg: Change OPTIONAL keyword usage style 9607597a74 ArmVirtPkg: Change OPTIONAL keyword usage style c8f46130f8 CryptoPkg: Change OPTIONAL keyword usage style fe2d81892f DynamicTablesPkg: Change OPTIONAL keyword usage style 792433088c EmbeddedPkg: Change OPTIONAL keyword usage style c69fc80c80 EmulatorPkg: Change OPTIONAL keyword usage style 9c721071d3 FmpDevicePkg: Change OPTIONAL keyword usage style e3917e22e7 MdeModulePkg: Change OPTIONAL keyword usage style d0e2f8232a MdePkg: Change OPTIONAL keyword usage style 8874fa199d NetworkPkg: Change OPTIONAL keyword usage style 79d49e162e OvmfPkg: Change OPTIONAL keyword usage style 237295f46d PcAtChipsetPkg: Change OPTIONAL keyword usage style dc8fe5ec95 RedfishPkg: Change OPTIONAL keyword usage style 12710fe93b SecurityPkg: Change OPTIONAL keyword usage style 9b8507cabe ShellPkg: Change OPTIONAL keyword usage style 18908e6131 SignedCapsulePkg: Change OPTIONAL keyword usage style f9c9215b55 SourceLevelDebugPkg: Change OPTIONAL keyword usage style 902e76de19 StandaloneMmPkg: Change OPTIONAL keyword usage style 4ec586b9f6 UefiCpuPkg: Change OPTIONAL keyword usage style e35dd32821 UefiPayloadPkg: Change OPTIONAL keyword usage style 78bc3bdd2a UnitTestFrameworkPkg: Change OPTIONAL keyword usage style ea85f0fe13 ArmVirtPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() e3b855f283 CryptoPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 4a9d411662 DynamicTablesPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() db52c7f755 MdeModulePkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 098307e082 MdePkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() ed7f7c9168 NetworkPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 8e875037bf OvmfPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() deba54761a PcAtChipsetPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() f9f4fb2329 SecurityPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 7c2a6033c1 UefiCpuPkg: Change complex DEBUG_CODE() to DEBUG_CODE_BEGIN/END() 429309e0c6 ArmPkg: Apply uncrustify changes 40b0b23ed3 ArmPlatformPkg: Apply uncrustify changes 2b16a4fb91 ArmVirtPkg: Apply uncrustify changes 7c34237831 CryptoPkg: Apply uncrustify changes 731c67e1d7 DynamicTablesPkg: Apply uncrustify changes e7108d0e96 EmbeddedPkg: Apply uncrustify changes a550d468a6 EmulatorPkg: Apply uncrustify changes bcdcc4160d FatPkg: Apply uncrustify changes 45ce0a67bb FmpDevicePkg: Apply uncrustify changes 111f2228dd IntelFsp2Pkg: Apply uncrustify changes 7c7184e201 IntelFsp2WrapperPkg: Apply uncrustify changes 1436aea4d5 MdeModulePkg: Apply uncrustify changes 2f88bd3a12 MdePkg: Apply uncrustify changes d1050b9dff NetworkPkg: Apply uncrustify changes ac0a286f4d OvmfPkg: Apply uncrustify changes 5220bd211d PcAtChipsetPkg: Apply uncrustify changes 39de741e2d RedfishPkg: Apply uncrustify changes c411b485b6 SecurityPkg: Apply uncrustify changes 47d20b54f9 ShellPkg: Apply uncrustify changes b878648967 SignedCapsulePkg: Apply uncrustify changes c1e126b119 SourceLevelDebugPkg: Apply uncrustify changes 91415a36ae StandaloneMmPkg: Apply uncrustify changes 053e878bfb UefiCpuPkg: Apply uncrustify changes e5efcf8be8 UefiPayloadPkg: Apply uncrustify changes 7c0ad2c338 UnitTestFrameworkPkg: Apply uncrustify changes dc453b5164 .pytool/Plugin/UncrustifyCheck: Add Uncrustify CI plugin 1832eb15aa UefiPayloadPkg/UefiPayloadPkg.fdf: Update DXE Apriori list ca78281c25 UefiPayloadPkg/PayloadEntry: Inherit 4/5-level paging from bootloader b2f7ee2ded UefiPayloadPkg: Increase SystemMemoryUefiRegionSize from 32M to 64M 94e0a7bddb UefiPayloadPkg: Add missing Guid gUefiAcpiBoardInfoGuid 2527723de9 UefiPayloadPkg: Add performance measurement feature ffdde9d719 UefiPayloadPkg: Skip ModuleInfo HOB in Payload 965292135b UefiPayloadPkg/UefiPayloadPkg.dsc:Add BootManagerLib for BootManagerMenuApp 85a678bf76 UefiPayloadPkg: Add integration instruction for coreboot common error 7b28310008 BaseTools: Increase the DevicePath length for support more PCD value. d25b803e51 MdeModulePkg/Bus/Pci/UhciDxe: Fix the UsbHc memory allocate and free issue c82ab4d8c1 BaseTools/VfrCompile: Correct Bit Field Flags for numeric/one of 2ddacfb6b8 OvmfPkg/SecMain: move SEV specific routines in AmdSev.c e2289d19d8 UefiCpuPkg/MpInitLib: move SEV specific routines in AmdSev.c 2fe8edfe55 OvmfPkg/ResetVector: move clearing GHCB in SecMain 3053183d41 OvmfPkg/ResetVector: introduce SEV metadata descriptor for VMM use 707c71a01b OvmfPkg: reserve SNP secrets page cca9cd3dd6 OvmfPkg: reserve CPUID page f2dc28f0b6 OvmfPkg/ResetVector: pre-validate the data pages used in SEC phase 34819f2cac OvmfPkg/ResetVector: use SEV-SNP-validated CPUID values d9822304ce OvmfPkg/MemEncryptSevLib: add MemEncryptSevSnpEnabled() 7c3b2892ea OvmfPkg/SecMain: register GHCB gpa for the SEV-SNP guest d2b998fbdc OvmfPkg/VmgExitLib: use SEV-SNP-validated CPUID values a19b648952 OvmfPkg/PlatformPei: register GHCB gpa for the SEV-SNP guest 19914edc5a OvmfPkg/AmdSevDxe: do not use extended PCI config space ade62c18f4 OvmfPkg/MemEncryptSevLib: add support to validate system RAM d706f8fec2 OvmfPkg/MemEncryptSevLib: add function to check the VMPL0 11b15336f0 OvmfPkg/BaseMemEncryptSevLib: skip the pre-validated system RAM d39f8d88ec OvmfPkg/MemEncryptSevLib: add support to validate > 4GB memory in PEI phase 202fb22be6 OvmfPkg/SecMain: validate the memory used for decompressing Fv 8eb79b5f4f OvmfPkg/PlatformPei: validate the system RAM when SNP is active 26210f9436 MdePkg: Define ConfidentialComputingGuestAttr 504ae26b80 OvmfPkg/PlatformPei: set PcdConfidentialComputingAttr when SEV is active b95908e043 UefiCpuPkg/MpInitLib: use PcdConfidentialComputingAttr to check SEV status f4e3ce5f53 UefiCpuPkg: add PcdGhcbHypervisorFeatures f5a6e1bab5 OvmfPkg/PlatformPei: set the Hypervisor Features PCD 2c354252be MdePkg/GHCB: increase the GHCB protocol max version 9c703bc0f1 UefiCpuPkg/MpLib: add support to register GHCB GPA when SEV-SNP is enabled d4d7c9ad5f UefiCpuPkg/MpInitLib: use BSP to do extended topology check b928eb44d5 OvmfPkg/MemEncryptSevLib: change the page state in the RMP table b7b8872031 OvmfPkg/MemEncryptSevLib: skip page state change for Mmio address ea3a12d970 OvmfPkg/PlatformPei: mark cpuid and secrets memory reserved in EFI map 67484aed69 OvmfPkg/AmdSev: expose the SNP reserved pages through configuration table 06544455d0 UefiCpuPkg/MpInitLib: Use SEV-SNP AP Creation NAE event to launch APs 0f1d7477c0 OvmfPkg: Remove unused print service driver (PrintDxe) 30631f0a26 MdePkg: Add missing Cache ID (in)valid define 0077c22f6d MdePkg: Remove PPTT ID type structure a50b65ce22 ShellPkg: Update Acpiview PPTT parser to ACPI 6.4 8cf2bdfcfb ShellPkg: Add Cache ID to PPTT parser b2bbe3df54 DynamicTablesPkg: Remove PPTT ID structure from ACPI 6.4 generator e139829dd6 DynamicTablesPkg: Update PPTT generator to ACPI 6.4 e81a81e584 DynamicTablesPkg: Add CacheId to PPTT generator 9afcd48a94 OvmfPkg: Handle Cloud Hypervisor host bridge 2ccefa32a6 OvmfPkg: Create global entry point for SMBIOS parsing d8ef774346 OvmfPkg: Retrieve SMBIOS from Cloud Hypervisor 66bce05f6d OvmfPkg: Generalize AcpiPlatformDxe 7594c5bfe2 OvmfPkg: Install ACPI tables for Cloud Hypervisor f6df289a1c OvmfPkg/OvmfXen: Fix Xen build 2b20a34fd5 OvmfPkg-EmuVariableFvbRuntimeDxe: Support Access To Memory Above 4G d5efc875ef MdePkg: Introduce CcMeasurementProtocol for CC Guest firmware a124cd4ef9 SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib 8c06c53b58 SecurityPkg: Support CcMeasurementProtocol in DxeTpmMeasurementLib adf070ff56 OvmfPkg/Microvm: add PcdConfidentialComputingGuestAttr 2686468c43 OvmfPkg/Bhyve: add MemEncryptSevLib 61be49e0f7 OvmfPkg/PlatformCI: factor out PlatformBuildLib.py 21ee379407 OvmfPkg/PlatformCI: add QEMU_SKIP 64bccda534 OvmfPkg/PlatformCI: add BhyveBuild.py 04eacd3943 OvmfPkg/PlatformCI: add MicrovmBuild.py 8b8ae609a7 OvmfPkg/PlatformCI: add AmdSevBuild.py 2722856a87 OvmfPkg/PlatformCI: dummy grub.efi for AmdSev 1203eba58e OvmfPkg/PlatformCI: add XenBuild.py 64ef0dd1d3 OvmfPkg/Microvm/fdt: add device tree support 79dcaf7054 OvmfPkg/Microvm/fdt: load fdt from fw_cfg c802f8935c OvmfPkg/Microvm/fdt: add empty fdt 2a68abf6ee OvmfPkg/Microvm/virtio: add virtio-mmio support e07d27e24d OvmfPkg/Microvm: add README 7f1861be2b DynamicTablesPkg: AML Code generation for memory ranges 0e7147fe75 DynamicTablesPkg: AML Code generation to create a named Package() fd5fc4bbb7 DynamicTablesPkg: AML Code generation to create a named ResourceTemplate() b2b8def4e3 DynamicTablesPkg: AML Code generation to add _PRT entries 69ddfee1c3 DynamicTablesPkg: Add AmlAttachNode() ce306e48eb DynamicTablesPkg: Add Pci related objects e35a746cf5 DynamicTablesPkg: SSDT Pci express generator ec37fd9c1f DynamicTablesPkg: Fix multiple objects parsing 557dede8a6 OvmfPkg/PlatformPei: ScanOrAdd64BitE820Ram improvements 759e3c6d21 OvmfPkg/PlatformPei: prefer etc/e820 for memory detection 41d8bb3038 OvmfPkg/PlatformPei: stop using cmos for memory detection 7a6e6ae933 EmulatorPkg: Update lldbefi.py to work with current lldb which uses python3 4d30352445 ArmPkg: Add SMC helper functions c039fa7ff0 ArmPkg: Update SMC calls to use the new ArmCallSmc0/1/2/3 functions 90ad4b3b34 DynamicTablesPkg: Definition for HwInfoParser interface d59c5a20f8 DynamicTablesPkg: FdtHwInfoParser: CM Object descriptor helper 5d8b5d171c DynamicTablesPkg: FdtHwInfoParser: Add FDT utility functions 8d2691c3d5 DynamicTablesPkg: FdtHwInfoParser: Add Boot Arch parser 3ebe1ff5c9 DynamicTablesPkg: FdtHwInfoParser: Generic Timer Parser 51941f7558 DynamicTablesPkg: FdtHwInfoParser: Add Serial port parser e366a41ef0 DynamicTablesPkg: FdtHwInfoParser: Add GICC parser 0fa1217726 DynamicTablesPkg: FdtHwInfoParser: Add GICD parser b04cf355a0 DynamicTablesPkg: FdtHwInfoParser: Add MSI Frame parser d250d408cf DynamicTablesPkg: FdtHwInfoParser: Add ITS parser 7b6c8b30a5 DynamicTablesPkg: FdtHwInfoParser: Add GICR parser 26bf034a59 DynamicTablesPkg: FdtHwInfoParser: Add GIC dispatcher c67bf628c8 DynamicTablesPkg: FdtHwInfoParser: Add PCI config parser deb01dfd7f DynamicTablesPkg: Add FdtHwInfoParser library 9006967c8d DynamicTablesPkg: Handle 16550_WITH_GAS id b2d0ed20fd DynamicTablesPkg: Definition for DynamicPlatRepoLib interface 2e2db65e39 DynamicTablesPkg: DynamicPlatRepo: Add TokenGenerator 740e3bb634 DynamicTablesPkg: DynamicPlatRepo: Add TokenFixer 5fe5b6f94f DynamicTablesPkg: DynamicPlatRepo: Add TokenMapper 38f6d78c3b DynamicTablesPkg: Add DynamicPlatRepo library f14fff5135 StandaloneMmPkg/FvLib: Support large file with EFI_FFS_FILE_HEADER2. 3a72ec71cd OvmfPkg: remove unused TPM options from MicrovmX64.dsc b47575801e OvmfPkg: move tcg configuration to dsc and fdf include files 5711ff4d0b OvmfPkg: drop TPM_CONFIG_ENABLE b819388772 OvmfPkg: create Tcg12ConfigPei.inf 4de8d61bce OvmfPkg: rework TPM configuration e6ea1464a8 OvmfPkg/PlatformPei: Revert "stop using cmos for memory detection" a6c0418651 ArmPkg/SmbiosMiscDxe: Remove duplicate HII string definition 45e3842970 ArmPkg/SmbiosMiscDxe: Get full SMBIOS strings from OemMiscLib b451c69088 ArmPkg/ProcessorSubClassDxe: Get serial and part number from OemMiscLib 8ed8568922 SecurityPkg: Debug code to audit BIOS TPM extend operations 195f011973 SecurityPkg: Reallocate TPM Active PCRs based on platform support ab5ab2f603 SecurityPkg: TPM must go to Idle state on CRB command completion c63a10ecb7 EmbeddedPkg/AcpiLib: Add more helper functions f129b1f06f OvmfPkg/Bhyve: fix tls-enabled build ee1f8262b8 OvmfPkg: Call PlatformInitializeConsole for GPU passthrough case de9e5b7dc7 IntelFsp2WrapperPkg : FSPM/S UPD data address based on Build Type 9ec2cc1f31 IntelFsp2WrapperPkg : Remove EFIAPI from local functions. ae8272ef78 MdeModulePkg/UsbBusDxe: fix NOOPT build error 15c596aeeb OvmfPkg: Bhyve: Delete unused AcpiTables/Ssdt.asl file 6612ff8561 UefiCpuPkg: Extend measurement of microcode patches to TPM e910f076ad BaseTools: Fix the bug of --cmd-len build option 7935be0fbd IntelFsp2Pkg/FspSecCore: ExtendedImageRevision was not printed. c095122d4b MdeModulePkg/PciBusDxe: Enumerator to check for RCiEP before looking for RP d463c56ddd MdeModulePkg: Replace with UFS_UNIT_DESC to fix timeout problem 45920941d9 MdeModulePkg: Refactoring UFS DME request and fix timing problem 13d9e8ec98 MdeModulePkg: Put off UFS HCS.DP checking to fix timing problem 079a58276b OvmfPkg/AmdSev/SecretPei: Mark SEV launch secret area as reserved 9dd14fc91c MdePkg: Add registers of boot partition feature 14a731096d UnitTestFrameworkPkg: CI YAML: Grant cmockery spell check exception 6062002bd5 MdeModulePkg/PartitionDxe: Add break to handle invalid LBA0 in MBR 7438a85bf1 BaseTools: Fix wrong variable header size c712ce2bb1 OvmfPkg/CloudHv: Add new target for Cloud Hypervisor a2da72b2ca OvmfPkg/CloudHv: Replace legacy 8254 PIT with local APIC timer 6ecdda71fe OvmfPkg/CloudHv: Connect serial console 1552050ce7 OvmfPkg/CloudHv: Remove legacy 8259 PIC support fdcea7ff6f OvmfPkg/CloudHv: Remove Q35 specifics 71082d3d1b OvmfPkg/CloudHv: Reduce dependency on QemuFwCfg 196be601f9 OvmfPkg/CloudHv: Remove video support 7b6cbe0a81 OvmfPkg/CloudHv: Remove USB support e73d1bf96a OvmfPkg/CloudHv: Remove CSM support b66056ef21 OvmfPkg/CloudHv: add Maintainers.txt entry 5302bd81d9 OvmfPkg: Add CloudHvX64 to the CI 59c48c9314 UefiPayloadPkg: Change the user interface name of the Uiapp 5801910013 UefiPayloadPkg: Not use BaseCpuTimerLib by default. 772c5bb8dc FmpDevicePkg/FmpDxe: Update FmpDeviceCheckImageWithStatus() handling 7709988dd8 RedfishPkg/RedfishRestExDxe:Simplify status check 21320ef669 MdeModulePkg/Variable: Make only EFI_VARIABLE_NON_VOLATILE invalid 7e5c603cba MdeModulePkg/SdMmcPciHcDxe: Robust improvements for SD card 1.8V switch ee67067f17 MdeModulePkg: VariableSmmRuntimeDxe: Fix Variable Policy Message Length 5b39832e18 MdePkg: MmCommunication2: Update MM communicate2 function description ce37f45955 ArmPkg: MmCommunicationDxe: MM communicate function argument attributes 541a077bd1 ArmPkg: MmCommunicationDxe: Update MM communicate `CommBuffer**` checks 1aa1ec4574 ArmPkg: MmCommunicationDxe: Update MM communicate `CommSize` check 8cc5590eab ArmPkg: MmCommunicationDxe: Update MM communicate `MessageLength` check 6777e67383 EmbeddedPkg: Fix a build error in FwVol.c in X64 arch a867f3a704 UefiPayloadPkg: Use BaseCpuTimerLib for Universal Payload by default f4b7b473b4 MdeModulePkg/UefiBootManagerLib: Convert BmLoadOption to Variable Policy 76b3d45b75 ShellPkg: Add the missing VariablePolicyHelperLib in ShellPkg.dsc 8542fc5f95 NetworkPkg: Add the missing VariablePolicyHelperLib in NetworkPkg.dsc ae35314e7b Maintainers.txt: Add Sami Mujawar as reviewer for ArmPkg 862ea6e836 OvmfPkg: change qemu default resolution to 1280x800 e95b44c90e ArmVirtPkg: change qemu default resolution to 1280x800 929804b172 OvmfPkg: add PcdVideoResolutionSource 7f25ddbc03 OvmfPkg/QemuVideoDxe: simplify InitializeBochsGraphicsMode 336da55ca8 OvmfPkg/QemuVideoDxe: drop QEMU_VIDEO_BOCHS_MODES->ColorDepth 55c05427b9 OvmfPkg/QemuVideoDxe: factor out QemuVideoBochsAddMode 49a2d8cbf5 OvmfPkg/QemuVideoDxe: parse edid blob, detect display resolution ba79becd55 OvmfPkg/BaseCachingPciExpressLib: Migrate BaseCachingPciExpressLib 103fa647d1 ArmPkg: Replace CoreId and ClusterId with Mpidr in ARM_CORE_INFO struct 742dafd2cc DynamicTablesPkg: Print specifier macro for CM_OBJECT_ID 13136cc311 DynamicTablesPkg: FdtHwInfoParserLib: Parse Pmu info 5751d60821 DynamicTablesPkg: AmlLib: AmlAddPrtEntry() to handle GSI 5816bd3eab DynamicTablesPkg: AcpiSsdtPcieLibArm: Remove link device generation dc1118fa0d ArmVirtPkg: Add cspell exceptions 0dbd356983 ArmVirtPkg/Kvmtool: Add DSDT ACPI table 312ef7a0a4 ArmVirtPkg/Kvmtool: Add Configuration Manager 17a02163bd ArmVirtPkg/Kvmtool: Enable ACPI support 5b3c682d91 ArmVirtPkg/Kvmtool: Enable Acpiview 017564d637 ArmPkg/ArmMmuLib AARCH64: avoid EL0 accessible mappings 45b1612659 DynamicTablesPkg: Add Memory32Fixed function 007a95055b DynamicTablesPkg: Remove redundant cast in AmlCodeGenReturn 33189f0527 DynamicTablesPkg: Add AmlCodeGenMethodRetInteger function a4b7aa362d MdeModulePkg/Bus/Pci/PciBusDxe: Support platform PCI ROM override 6fb09da89f ShellPkg: Fix incorrect PPTT FlagName dereference c09dbc92e9 BaseTools/Conf: Add new macro for customizing dll file reduction. d4ac53aa91 BaseTools: Fix error leg in DscBuildData.py f78b937c95 MdeModulePkg/RuntimeDxe: clear mVirtualMapMaxIndex 96b8b5fd10 MdeModulePkg/UiApp: Fix spelling of 'FRONTPAGE' bd676f080a Maintainers.txt: add missing github IDs to OvmfPkf/Fdt reviewers 1f54eaa725 Maintainers.txt: update email for Leif Lindholm b360b0b589 Maintainers.txt: Update email address c9b7c6e0cc BaseTools: Update CLANG{35,38}_WARNING_OVERRIDES to ignore unused vars 42af706dfb BaseTools: Update brotli submodule 1193aa2dfb MdeModulePkg: update brotli submodule 85589ddbf6 OvmfPkg/VmgExitLib: Fix uninitialized variable warning with XCODE5 c28e376edc OvmfPkg/FvbServicesSmm: use the VmgExitLibNull 8a57673316 ShellPkg: Fix Ping GetTimerPeriod API failure b24306f15d NetworkPkg: Fix incorrect unicode string of the AKM/Cipher Suite - Add amd-sev-es to the following descriptors because James Fehlig tested them (bsc#1196879): 60-ovmf-x86_64.json 60-ovmf-x86_64-2m.json 60-ovmf-x86_64-ms.json 60-ovmf-x86_64-2m-ms.json - Backported patches in ovmf-bsc1196879-sev-fix.patch for fixing SEV: de463163d9 OvmfPkg/AmdSev: reserve snp pages 63c50d3ff2 OvmfPkg/ResetVector: cache the SEV status MSR value in workarea f1d1c337e7 OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea - TPM_ENABLE got renamed to TPM2_ENABLE and TPM_CONFIG_ENABLE removed (except on ARM for some reason) (boo#1197104) - Add GCC 12 workaround (ovmf-ignore-spurious-GCC-12-warning.patch) that handles: https://bugzilla.tianocore.org/show_bug.cgi?id=3816 The same patch is already included in qemu package. - Respin amd-sev and amd-sev-es features After more testing, we found that not all descriptors can support both amd-sev with amd-sev-es. So we removed all amd-sev and amd-sev-es feature tags but only keep them in ovmf-x86_64-2m.json and 60-ovmf-x86_64.json. (bsc#1198246#c75) - add ovmf-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch. It fixes crashes when linked using gcc 12 (bsc#1199597). - Update to edk2-stable202205 - Features (https://github.com/tianocore/edk2/releases): Support PEI 64bit in IntelFsp2Pkg and IntelFsp2WrapperPkg IntelFsp2Pkg: BaseFspCommonLib Support for X64 Build Add PrmPkg BaseTools Enhance GenFw to support PRM GCC build Enable Intel TDX in OvmfPkg Generate CloudHv target as PVH ELF binary Add parallel hash feature into BaseCryptLib Configure/Enable elliptic curve ciphers in OpenSSL Add FMMT tool into edk2 BaseTools Dynamic variable flash information cannot be passed in Standalone MM - Patches (git log --oneline --reverse edk2-stable202202~..edk2-stable202205): b24306f15d NetworkPkg: Fix incorrect unicode string of the AKM/Cipher Suite 2dbed52506 ArmVirtPkg/ArmVirtMemoryInitPeiLib: avoid redundant cache invalidation 54cddc3ad4 ArmVirtPkg/ArmVirtKvmTool: wire up configurable timeout de463163d9 OvmfPkg/AmdSev: reserve snp pages 63c50d3ff2 OvmfPkg/ResetVector: cache the SEV status MSR value in workarea f1d1c337e7 OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR value from workarea b1b89f9009 MdeModulePkg: Correct high-memory use in NvmExpressDxe 84338c0d49 MdeModulePkg: Replace Opcode with the corresponding instructions. d3febfd9ad MdePkg: Replace Opcode with the corresponding instructions. 7bc8b1d9f4 SourceLevelDebugPkg: Replace Opcode with the corresponding instructions. 2aa107c0aa UefiCpuPkg: Replace Opcode with the corresponding instructions. bbaa00dd01 MdePkg: Remove the macro definitions regarding Opcode. 6a890db161 BaseTools: Upgrade the version of NASM tool 497ac7b6d7 UefiPayloadPkg/PayloadLoaderPeim: Use INT64 as input parameter dc39554d58 edk2/MdeModulePkg/Debuglib: Add Standalone MM support 906242343f MdeModulePkg/GraphicsConsoleDxe: Check status to make sure no error b422b0fcf9 EmulatorPkg/EmuGopDxe: Set ModeInfo after Open successfully 589d51df26 MdeModulePkg/Usb/Keyboard.c: Don't request protocol before setting b909b4ad09 OvmfPkg: Make the Xen ELF header generator more flexible 0a707eb258 OvmfPkg: Xen: Use a new fdf include for the PVH ELF header 0015a4e0a8 OvmfPkg: Xen: Generate fdf include file from ELF header generator 9ac8c85d50 OvmfPkg: CloudHv: Remove VARS and CODE sections e1c7f9b4e5 OvmfPkg: Generate CloudHv as a PVH ELF binary d50d9e5549 OvmfPkg: CloudHv: Retrieve RSDP address from PVH 82bfd2e86d OvmfPkg: CloudHv: Rely on PVH memmap instead of CMOS b83d0a6438 OvmfPkg: CloudHv: Add README 4a68176cb5 UefiCpuPkg: Extend SMM CPU Service with rendezvous support. 949b8a3d97 Maintainers.txt: Add new reviewer for UefiPayloadPkg 091b6a1197 UefiPayloadPkg: Add build option for Above 4G Memory 4adc364c75 UefiPayloadPkg: Fix case of protocol 79f2734e5a MdeModulePkg: Add a check for metadata size in NvmExpress Driver af74efe494 UefiPayloadPkg: Make Boot Manager Key configurable 62fa37fe7b BlSupportSmm: fix definition of SetSmrr() 56530dec11 .pytool/Plugin/UncrustifyCheck: Output file diffs by default 2aac8bb7ef .pytool: Update to newest pytools c63ef58698 .azurepipelines: Updated python version f06941cc46 MdeModulePkg: Add bRefClkFreq card attribute programming support 2b175eeb6a RedfishPkg: fix memory leak issue 10b4c8f3b7 Maintainers: Update Maintainers.txt for edk2 Redfish modules 0fdd466c75 UefiCpuPkg/MpInitLib:remove optional in declaration 52e09dcd7a UefiCpuPkg: Support FFS3 GUID in SearchForBfvBase.asm a13dfc769b MdeModulePkg/DxeIpl: Create 5-level page table for long mode c8ea48bdf9 DynamicTablesPkg: Fix serial port namespace path in DBG2 414cd2a4d5 BaseTools/GenFw: Enhance GenFw to support PRM GCC build 33438f7354 EmulatorPkg/RedfishPlatformCredentialLib: Check EFI_SECURE_BOOT_MODE_NAME 5b56c52b5c EmulatorPkg/RedfishPlatformCredentialLib: Don't stop Redfish service 0531f61376 IntelFsp2Pkg: BaseFspDebugLibSerialPort Support for X64 411b3ff6dd IntelFsp2Pkg: BaseFspSwitchStackLib Support for X64 b429959bb6 MdeModulePkg/SdMmcPciHcDxe: Make timeout for SD card configurable 79a705fbaf UefiPayloadPkg: Hookup SD/MMC timeout 28eeb08d86 MdePkg/Include: Smbios Specification 3.5.0 changes c1e662101a CryptoPkg: Add new hash algorithm ParallelHash256HashAll in BaseCryptLib. 267a92fef3 MdePkg/AcpiXX.h: Update Error Severity type for Generic Error Status Block ec0b54849b IntelFsp2Pkg: BaseFspCommonLib Support for X64 5d8d8b5148 MdeModulePkg/NvmExpressDxe: fix check for Cap.Css 69218d5d28 MdeModulePkg/NvmExpressPei: fix check for NVM command set bf9230a9f3 BaseTools: Add the FeatureFlagExpression usage to the Source Section 3115377bf0 BaseTools: Remove the redundant __FLEXIBLE_SIZE from PcdValueInit.c 4a2e1000a1 CryptoPkg: update openssl submodule to 1.1.1n 355515a06a CryptoPkg? Redefinition bug in CrtLibSupport.h. 7b005f344e BaseTools: fix gcc12 warning 85021f8cf2 BaseTools: fix gcc12 warning 22130dcd98 Basetools: turn off gcc12 warning ec30a4a0c3 BaseTools:Support decimal version number in ECC check 3ef2071927 UefiCpuPkg: Update BFV searching algorithm in VTF0 691b178667 ShellPkg/AcpiView: Adds ACPI_PARSER bitfield parser 40004ff9d5 ShellPkg/AcpiView: PrintFormatter for FADT Flags field 7456990e8e MdeModulePkg/Ufs: bRefClkFreq attribute be programmed after fDeviceInit 237c966396 UefiPayloadPkg/UefiPayloadPkg.ci.yaml: Remove duplicated entry 76191052fd UefiPayloadPkg: Fix build error 449eb01a8d UefiPayloadPkg: Fix architecture in the build instruction c248802e40 UefiPayloadPkg: Fix PciHostBridgeLib 2b4b8013fe UefiPayloadPkg/Library/PlatformBootManagerLib: Remove broken VGA detection 55637a2894 UefiPayloadPkg: Make Boot Timeout configurable 2268920afc .azurepipelines: Use Python 3.8 c3ca70669e .azurepipelines: Use windows-2019 VM image 3b0de44759 EmulatorPkg: Use windows-2019 VM image 75628d27c0 OvmfPkg: Use windows-2019 VM image b328bb54c6 BaseTools/Bin: Update GCC ARM compiler version 3f0c788a5f MdePkg: Add Tdx.h 77228269e7 MdePkg: Update Cpuid.h for Tdx 818bc9596d MdePkg: Introduce basic Tdx functions in BaseLib c3001cb744 MdePkg: Add TdxLib to wrap Tdx operations eddcba40b5 UefiCpuPkg: Extend VmgExitLibNull to handle #VE exception daf8f642f3 OvmfPkg: Extend VmgExitLib to handle #VE exception de327f7d8a UefiCpuPkg/CpuExceptionHandler: Add base support for the #VE exception ab9d790901 MdePkg: Add helper functions for Tdx guest in BaseIoLibIntrinsic b6b2de8848 MdePkg: Support mmio for Tdx guest in BaseIoLibIntrinsic d74e932681 MdePkg: Support IoFifo for Tdx guest in BaseIoLibIntrinsic 3571fc906f MdePkg: Support IoRead/IoWrite for Tdx guest in BaseIoLibIntrinsic 7bed7ae6c5 UefiCpuPkg: Support TDX in BaseXApicX2ApicLib d983b102b3 MdePkg: Add macro to check SEV / TDX guest 88da06ca76 UefiCpuPkg: Enable Tdx support in MpInitLib 352eabdcd5 OvmfPkg: Add IntelTdx.h in OvmfPkg/Include/IndustryStandard 6a608255bb OvmfPkg: Add TdxMailboxLib 57bcfc3b06 OvmfPkg: Create initial version of PlatformInitLib 102cafedad OvmfPkg/PlatformInitLib: Add hob functions 9a9b33b3d6 OvmfPkg/PlatformPei: Move global variables to PlatformInfoHob 5a2574a82e OvmfPkg/PlatformPei: Refactor MiscInitialization 6d2ce5fd5c OvmfPkg/PlatformPei: Refactor MiscInitialization for CloudHV 3dd47f9544 OvmfPkg/PlatformPei: Refactor AddressWidthInitialization 432e4acd87 OvmfPkg/PlatformPei: Refactor MaxCpuCountInitialization f3801cf26c OvmfPkg/PlatformPei: Refactor QemuUc32BaseInitialization e510326245 OvmfPkg/PlatformPei: Refactor InitializeRamRegions 12e860a1e8 OvmfPkg/PlatformPei: Refactor MemMapInitialization cec82a64cf OvmfPkg/PlatformPei: Refactor NoexecDxeInitialization f53f449f15 OvmfPkg/PlatformPei: Refactor MiscInitialization 10460942ff OvmfPkg/PlatformInitLib: Create MemDetect.c 96047b6663 OvmfPkg/PlatformInitLib: Move functions to Platform.c b22ac35b75 OvmfPkg: Update PlatformInitLib to process Tdx hoblist ccca1c2d5d OvmfPkg/Sec: Declare local variable as volatile in SecCoreStartupWithStack 2b80269d98 OvmfPkg: Update Sec to support Tdx 6b27c11690 OvmfPkg: Check Tdx in QemuFwCfgPei to avoid DMA operation bec9104201 MdeModulePkg: Skip setting IA32_ERER.NXE if it has already been set fd306d1dbc MdeModulePkg: Add PcdTdxSharedBitMask cc3620f304 UefiCpuPkg: Update AddressEncMask in CpuPageTable e23f8f52fd OvmfPkg: Update PlatformInitLib for Tdx guest cf17156d7d OvmfPkg: Update PlatformPei to support Tdx guest 9fdc70af6b OvmfPkg: Update AcpiPlatformDxe to alter MADT table 5aa8018639 OvmfPkg/BaseMemEncryptTdxLib: Add TDX helper library fae5c1464d OvmfPkg: Add TdxDxe driver 07c721fea7 OvmfPkg/QemuFwCfgLib: Support Tdx in QemuFwCfgDxe 2520182122 OvmfPkg: Update IoMmuDxe to support TDX c2e7be4055 OvmfPkg: Rename XenTimerDxe to LocalApicTimerDxe 299c44cd4f UefiCpuPkg: Setting initial-count register as the last step c37cbc030d OvmfPkg: Switch timer in build time for OvmfPkg 580a6b616b OvmfPkg: Add TdxWorkArea definition 75942a52ae OvmfPkg: Add PrePiHobListPointerLibTdx 4fe2678411 OvmfPkg: Add PeilessStartupLib 1f29de4d20 OvmfPkg/IntelTdx: Add Sec to bring up both Legacy and Tdx guest 55fda68a80 OvmfPkg: Update TdxDxe to set TDX PCDs f674fa9cde OvmfPkg: Update DxeAcpiTimerLib to read HostBridgeDevId in PlatformInfoHob 149ed8e421 OvmfPkg/IncompatiblePciDeviceSupportDxe: Refine the configuration c477b2783f OvmfPkg/IncompatiblePciDeviceSupportDxe: Ignore OptionRom in Td guest cb8349f01a MdeModulePkg: Update PciEnumeratorSupport to ignore OptionRom if needed 44a53a3bdd OvmfPkg: Introduce IntelTdxX64 for TDVF Config-B 7fda517c3d OvmfPkg: Add dependency of VariableSmm driver to make it work normally. b953265a27 UefiPayloadPkg: Add a new DebugPrintErrorLevelLib instance 0023e35cf4 UefiPayloadPkg: Change some configuration of the payload 3e130e40fc UefiPayloadPkg: Consume the new added DebugPrintErrorLevelLib instance f16b05a13b .pytool/Plugin/UncrustifyCheck: Update func to return absolute paths dbfbaedb21 .pytool/Plugin/UncrustifyCheck: Add ignore file support d932199d39 OvmfPkg: Revert Uncrustify formatting in VbeShim.h files ad6816c319 OvmfPkg: Do not check VbeShim.h formatting with Uncrustify d2998af211 PrmPkg: Add package and include headers 5f76c3e471 PrmPkg: Add PrmConfig protocol interface e189e01af2 PrmPkg/PrmContextBufferLib: Add initial library instance 3f7af17c6b PrmPkg/PrmConfigDxe: Add initial driver 9276e0d2b9 PrmPkg: Add initial PrmSamplePrintModule c63905aba7 PrmPkg: Add initial PrmSampleMemoryAllocationModule 27b1a840e4 PrmPkg: Add initial PrmSampleHardwareAccessModule 7c41ec47ca PrmPkg: Add initial PrmSampleContextBufferModule 97ab54c1b1 PrmPkg: Add initial package DSC file d2cb6e67a4 Readme.md: Add initial content e846797662 PrmPkg: Add ALLOCATE_CONTEXT_BUFFER_IN_FW build option a6f8946bc9 PrmPkg: Enable variable growth for the PRM_MODULE_EXPORT macro ef05955996 PrmPkg: Publish PRM operation region to support PRM ACPI _DSM invocation f96517f4d0 PrmPkg: Export major/minor version in PRM module PE COFF header 50e1432a40 PrmPkg: Add initial PrmSsdtInstallDxe module a409f4b67d PrmPkg: Remove PRM Module Update Lock 0797989c5d PrmPkg: Remove ALLOCATE_CONTEXT_BUFFER_IN_FW build flag 0b469caff6 PrmPkg/PrmContextBuffer.h: Add ACPI parameter support structures be2c927d7c PrmPkg/PrmLoaderDxe: Add ACPI parameter buffer support c1a7a50f67 PrmPkg/PrmSampleContextBufferModule: Remove OS debug print requirement 4c8486fd72 PrmPkg/PrmSampleHardwareAccessModule: Add non-print PRM handlers 7217263514 PrmPkg/SampleAcpiParameterBufferModule: Add initial module fec018624c PrmPkg/HardwareAccessModuleConfigLib: Add initial library d10b8dc5d8 PrmPkg/Samples/Readme.md: Add initial file 6b7dde7cdd PrmPkg: Refactor some PrmLoaderDxe functionality into libraries 4348c72ad0 PrmPkg/Application/PrmInfo: Add initial application e10c776487 PrmPkg: Enforce stricter types 2e55b0cd9e PrmPkg/Test/PrmPkgHostTest.dsc: Add initial file 3599f5479d PrmPkg/Test/UnitTest/Library: Add initial UEFI Boot Services test lib 82d15dc6c1 PrmPkg/Library/DxePrmContextBufferLib: Add host-based unit tests 68ee42c991 PrmPkg/DxePrmModuleDiscoveryLib: Add initial host-based unit tests c040831cf9 PrmPkg: Add PlatformGuid a9302b89a9 PrmPkg: Update PRM OpRegion f8e68587e2 Readme.md: Add iASL note and QEMU sample link 4a4aeaa446 PrmPkg: Replace PcdPrmPlatformGuid with EDKII_DSC_PLATFORM_GUID 17b2d64ced PrmPkg/Samples: Remove PrmSampleMemoryAllocationModule 050b2ba27d PrmPkg/Samples: Remove PrmSamplePrintModule 88f3d734f5 PrmPkg: Remove the concept of OS services deea4e58b0 Readme.md: Add a link to PRM Specification f3c11224b5 PrmPkg: Changes for edk2 repo transition a298a84478 PrmPkg: Apply uncrustify changes 94f905b3bf MdeModulePkg/HiiDatabase: Fix Setup numeric default value incorrect issue b8c5ba2337 BaseTools: efi_debugging.py: Add debugger agnostic dbg Python Classes 0d7fec9f79 BaseTools: Scripts/efi_gdb.py: Add gdb EFI commands and pretty Print 4f4afcd288 BaseTools: Scripts/efi_lldb.py: Add lldb EFI commands and pretty Print bfefdc2c49 UefiPayloadPkg: Fix PciHostBridgeLib 676084303d UefiPayloadPkg: Support IA32 Build 63e155f24d UefiPayloadPkg: Add dependency of VariableSmm driver. dab96cf02e UefiPayloadPkg: Add --quiet argument to Universal Payload build script 35a4b63247 NetworkPkg: Add PCDs for HTTP DNS RetryCount and RetryInterval 38a9afd0fb NetworkPkg/HttpDxe: Decofigure Tcp4 before reconfiguring 3974aa539e NetworkPkg/HttpDxe: Decofigure Tcp6 before reconfiguring c43ff5188d NetworkPkg/HttpDxe: Add ConnectionClose flag fo HTTP_PROTOCOL 753fd319e2 NetworkPkg/HttpDxe: Detect 'Connection: close' header 12a50c9ce1 NetworkPkg/HttpDxe: Detect HTTP/1.0 servers 5576b17363 BaseTools: Fix DevicePath tool build failure issue 4352d115c4 CryptoPkg/CrtLibSupport: add fcntl.h 3b4b49cf00 CryptoPkg/CrtLibSupport: add strstr() 58771f4b2d CryptoPkg/CrtLibSupport: add INT_MIN 2759e42fbc CryptoPkg/CrtLibSupport: add UINT_MAX fd5f347c84 CryptoPkg/CrtLibSupport: add MODULESDIR 03951e5645 CryptoPkg/CrtLibSupport: add off_t fab6285a73 CryptoPkg/CrtLibSupport: fix strcpy f5508a91e3 CryptoPkg/UnitTest: fix DH testcase c411566fad pip-requirements.txt: Update basetools version to 0.1.17 8a5727c7a8 Maintainers.txt: Add Michael Kubacki as UnitTestFrameworkPkg maintainer 1a49e2aa3c CryptoPkg: Add instrinsics to support building ECC on IA32 windows efc39e65e5 CryptoPkg: Reconfigure OpensslLib to add EC algorithms 0c901fcc20 CryptoPkg: Make EC source file config-able f3da13461c CryptoPkg/TlsLibNull: Remove MU_CHANGE comment markers 4cfb28f12a UefiPayloadPkg: Fix the build failure 9bf7291d63 ShellPkg: Update smbiosview type 41 with SMBIOS 3.5 fields 630df8c86e IntelFsp2Pkg: X64 compatible changes to support PEI in 64bit 6f219bef55 IntelFsp2Pkg: Add FSPx_ARCH2_UPD support for X64 d40965b987 IntelFsp2Pkg: Update FSP_GLOBAL_DATA and FSP_PLAT_DATA for X64 00aa71ce20 IntelFsp2Pkg: FspSecCore support for X64 6bec5a66ea IntelFsp2Pkg: SecFspSecPlatformLibNull support for X64 4a6ed7e46a IntelFsp2WrapperPkg: Adopt FSPM_UPD_COMMON_FSP24 for X64 86a2f3c439 IntelFsp2WrapperPkg: BaseFspWrapperApiLib support for X64 91a03f78ba IntelFsp2WrapperPkg: SecFspWrapperPlatformSecLibSample support for X64 3d97733f44 MdePkg: Add CC_GUEST_TYPE in ConfidentialComputingGuestAttr.h d020ac55b6 OvmfPkg: Replace GUEST_TYPE with CC_GUEST_TYPE 74a3eb975d MdePkg: Add CcProbeLibNull 2f44d77c68 OvmfPkg: Add CcProbeLib 2a7e1e890d OvmfPkg: Add CcProbeLib in *.dsc 7012cb73c4 MdePkg: Probe Cc guest in BaseIoLibIntrinsicSev 76fda1def3 OvmfPkg: Call CcProbe in SecMain.c instead of TsIsEnabled 532bd4ec38 CryptoPkg/Crt: fix strcpy build on older VS compilers 6d2baf9dfb PrmPkg/DxePrmContextBufferLib: Fix unit test GCC compilation errors 892787fed5 OvmfPkg/OvmfPkgX64: Adjust load sequence of TdxDxe and AmdSevDxe driver b06a007b64 CryptoPkg: Declare PcdEcEnabled in Library consuming OpensslLib fdfbf1fdab MdePkg: Update smbiosview type 9 with SMBIOS 3.5 fields a85ae8d964 ShellPkg: Update smbiosview type 9 with SMBIOS 3.5 fields 2306555bf9 UefiPayloadPkg: Fix IA32 entry build failure f4dfec6ca1 BaseTools: Move gPlatformFinalPcd to Datapipe and optimize size ee582858c4 .azurepipelines: Add NOOPT to all package builds 2d9d605714 .pytool/Plugin/UncrustifyCheck: Add Azure DevOps UI debug instructions b807174fec MdeModulePkg/GraphicsConsoleDxe: add modes 5a17629902 OvmfPkg: clear PcdConOut{Row,Column} 96e1d337e0 ArmVirtPkg: clear PcdConOut{Row,Column} 483d3bb716 ShellPkg: Update smbiosview type 0 with SMBIOS 3.5 fields ecc79b092e OvmfPkg/VirtioGpuDxe: add VirtioGpuSendCommandWithReply 182122914c OvmfPkg/VirtioGpuDxe: add GetDisplayInfo to virtio-gpu spec header. 82c07f2cc7 OvmfPkg/VirtioGpuDxe: add VirtioGpuGetDisplayInfo 5f6ecaa398 OvmfPkg/VirtioGpuDxe: use GopQueryMode in GopSetMode 86de090b99 OvmfPkg/VirtioGpuDxe: move code to GopInitialize 916f90baa5 OvmfPkg/VirtioGpuDxe: query native display resolution from host d372ab585a BaseTools/Conf: Fix Dynamic-Library-File template cabd96ad03 OvmfPkg: restore CompatImageLoaderDxe chunk 4092f1d397 OvmfPkg/Bhyve: add support for QemuFwCfg daa6cd8763 ArmPlatformPkg: Fix error message in Scripts/Ds5/edk2_debugger.py 5299568ce6 ArmPlatformPkg: Fix target initialisation in cmd_load_symbols.py 101f4c7892 ArmPlatformPkg: Fix EDK2_DSC check in Scripts/Makefile a64b944942 BaseTools: Add FMMT Python Tool 826527c9db UefiPayloadPkg: Add definition for PayloadCommandLine HOB d4eef3fe7c MdePkg: Add CpuLib to module INFs that depend on UefiCpuLib. a63b086e69 IntelFsp2Pkg: Add CpuLib to module INFs that depend on UefiCpuLib 3afa0a2096 IntelFsp2WrapperPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 1783b099d3 OvmfPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 86d41c077e UefiCpuPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 2434f6f206 UefiPayloadPkg: Add CpuLib to module INFs that depend on UefiCpuLib. 247a0fc65e OvmfPkg: Add README for TDVF 8079d4dc4f MdePkg: add SmmCpuRendezvousLib.h and SmmCpuRendezvousLibNull implement. 1a6c837638 UefiPayloadPkg: Fix the UPL build failure 29ae55a0b8 PcAtChipsetPkg: Change the flow of PcRtcInit() a658ed30e5 MdeModulePkg/PCD: Pcd initialize DXE have assert 0e31124877 .pytool: Fix python command error in self introduction doc 43613b2fe8 CryptoPkg: Rename PCD about openssl EC configuration f753c36209 CryptoPkg: Separate auto-generated openssl config and edk2 openssl config 499b0d5fa5 CryptoPkg: Update process_files.pl to automatically add PCD config option a332ffb6ef CryptoPkg/openssl: update generated files 9dd964f5e5 CryptoPkg/openssl: disable codestyle checks for generated files b5cd30a79b UefiCpuPkg: Revert "UefiCpuPkg: Enable Tdx support in MpInitLib" ad629b5c5a OvmfPkg: Add MpInitLibDepLib related PPI/Protocol definitions 2f06e5af47 OvmfPkg: Add MpInitLibDepLib b63a49e056 OvmfPkg/Sec: Install MpInitLibDepLib PPIs in SecMain.c 73d6d41de0 OvmfPkg/TdxDxe: Install MpInitLibDepLib protocols deee7a100b OvmfPkg: Enable 2 different CpuMpPei and CpuDxe drivers 17702186b5 MdeModulePkg: PiSmmCore: Inspect memory guarded with pool headers d0efa681b6 UefiPayloadPkg: Simplify code logic 57ebb2994d UefiPayloadPkg: Add Serial IO device path according to related protocol ef01d63ef3 UefiPayloadPkg: Connect all root bridge in PlatformBootManagerBeforeConsole 35d9b7ea2d ArmPkg: Remove RVCT support b55b6d33e4 ArmPlatformPkg: Remove RVCT support e9eeb0ad2b CryptoPkg: Remove RVCT support 48b919cb14 MdePkg: Remove RVCT support 5621d81edf FatPkg: Remove RVCT support cc070e9e0c NetworkPkg: Remove RVCT support a744199470 ArmVirtPkg: Remove RVCT support b7a446f224 EmbeddedPkg: Remove RVCT support 57c84113a1 OvmfPkg: Remove RVCT support 708620d29d BaseTools: Remove RVCT support 2d1138a1a8 .azurepipelines: Fix cspell version to v5.20.0 7b126978e1 .pytool/plugin/SpellCheck: Allow compound words 2189c71026 .pytool/plugin/SpellCheck: Add more common words 0903042b66 MdeModulePkg: Add Variable Flash Info HOB 60b519456c MdeModulePkg/VariableFlashInfoLib: Add initial library 4dbebc2d10 MdeModulePkg/Variable: Consume Variable Flash Info 8db39c60cd MdeModulePkg/FaultTolerantWrite: Consume Variable Flash Info 524a15c1fa ArmVirtPkg/ArmVirt.dsc.inc: Add VariableFlashInfoLib a69eac7578 EmulatorPkg: Add VariableFlashInfoLib a7d3d4e7c4 OvmfPkg: Add VariableFlashInfoLib 1f026ababf UefiPayloadPkg: Add VariableFlashInfoLib a72d552f19 OvmfPkg/OvmfPkgX64: Use different CcProbeLib when SMM is on or off a21a3438f7 OvmfPkg: Make an Ia32/X64 hybrid build work with SEV 9c733f0b90 OvmfPkg: TdxDxe: Fix AsmRelocateApMailBoxLoop 07c0c2eb0a OvmfPkg: fix PcdFSBClock 16779ede2d Removed prefix to match AsmRelocateApMailBoxLoopStart - Removed patches in ovmf-bsc1196879-sev-fix.patch which are merged to mainline: - OvmfPkg/AmdSev: reserve snp pages - de463163d9 edk2-stable202205-rc1~292 - OvmfPkg/ResetVector: cache the SEV status MSR value - 63c50d3ff2 edk2-stable202205-rc1~291 - OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR - f1d1c337e7 edk2-stable202205-rc1~290 - Add the following patches for building edk2-stable202205 with nasm-2.14 on SLE15-SP3/SP4 and Leap 15.3/15.4. Those patches add marco back because nasm-2.14 doesn't support corresponding instructions. (jsc#PED-1410) - ovmf-Revert-MdePkg-Remove-the-macro-definitions-regarding.patch ovmf-Revert-UefiCpuPkg-Replace-Opcode-with-the-correspond.patch ovmf-Revert-SourceLevelDebugPkg-Replace-Opcode-with-the-c.patch ovmf-Revert-MdePkg-Replace-Opcode-with-the-corresponding-.patch ovmf-Revert-MdeModulePkg-Replace-Opcode-with-the-correspo.patch - Then reverted 5 patches in 84338c0d49~..bbaa00dd01 MdeModulePkg: Replace Opcode with the corresponding MdePkg: Replace Opcode with the corresponding SourceLevelDebugPkg: Replace Opcode with the UefiCpuPkg: Replace Opcode with the corresponding MdePkg: Remove the macro definitions regarding Opcode. - Change the size of ovmf-x86_64 to 4MB, otherwise OBS exposes the following error: [ 266s] GenFv: ERROR 3000: Invalid [ 266s] the required fv image size 0x1afed8 exceeds the set fv image size 0x1ac000 - [ovmf-x86_64]="-p OvmfPkg/OvmfPkgX64.dsc -D FD_SIZE_4MB" - Removed patches in ovmf-bsc1196879-sev-fix.patch which are merged to edk2-stable202205: - OvmfPkg/AmdSev: reserve snp pages - de463163d9 edk2-stable202205-rc1~292 - OvmfPkg/ResetVector: cache the SEV status MSR value - 63c50d3ff2 edk2-stable202205-rc1~291 - OvmfPkg/BaseMemEncryptLib: use the SEV_STATUS MSR - f1d1c337e7 edk2-stable202205-rc1~290 - Because 5 revert patches in edk2-stable202205 for nasm-2.14 is against 15-SP4/Leap 15.4 and earlier version. So add suse_version and sle_version checking logic in ovmf.spec when applying revert patches. (jsc#PED-1410) - Modified ovmf.changes log, using PED-1410 instead of PED-1359 for pushing to SLE15-SP5. - Add patches to disable option ROM on sev (bsc#1199156) ovmf-bsc1199156-OvmfPkg-IncompatiblePciDeviceSupportDxe-Ignore-Optio.patch - Update to edk2-stable202208 (jsc#PED-1410) - Features (https://github.com/tianocore/edk2/releases): Add CRC16 and CRC32C to MdePkg IntelFsp2Pkg/ConfigEditor: Support FSP 2.3 header Extend SecureBootVariableLib interfaces UEFI HTTPS Boot Support for HTTP Client Authentication (Basic or Digest) Support 64bit FspResetType for X64 build IntelFsp2Pkg/FspSecCore: Add FSP-I entry for SMM support Add PCI_DEVICE_PPI definition to EDK2 Support to assign the subject name to sign the capsule file - Patches (git log --oneline --reverse edk2-stable202205..edk2-stable202208): 7f0890776e MdeModulePkg/UniversalPayload: Align Identifier value with UPL spec b4be5f05dd UefiPayloadPkg: Align Identifier value with UPL spec dac2fc8146 UefiPayloadPkg: Align SpecRevision value with UPL spec 3ca7326b37 OvmfPkg/VirtioGpuDxe: replace struct copy with CopyMem call fa2b212d61 IntelFsp2Pkg: Add FSP 2.3 header support 11d8abcba2 IntelFsp2Pkg: FSP_TEMP_RAM_INIT call must follow X64 Calling Convention df1c7e91b4 IntelFsp2WrapperPkg: FSP_TEMP_RAM_INIT call for X64 Calling Convention 62044aa99b OvmfPkg/ResetVector: Removing SEV-ES CPUID bit check 54cd0d9b2f OvmfPkg: Fix TDVMCALL error in ApRunLoop.nasm 64706ef761 OvmfPkg: Search EFI_RESOURCE_MEMORY_UNACCEPTED for Fw hoblist 81ab97b7b9 OvmfPkg/AmdSev: remove unused SMM bits from .dsc and .fdf files 0223898f3e OvmfPkg/Microvm: drop CODE and VARS files b57911c84c OvmfPkg/FdtPciHostBridgeLib: io range is not mandatory 47f44097eb OvmfPkg/Platform: unfix PcdPciExpressBaseAddress ad3bafa7d5 OvmfPkg/Microvm/pcie: no vbeshim please bd10d4e201 OvmfPkg/Microvm/pcie: mPhysMemAddressWidth tweak 632574ced1 OvmfPkg/Microvm/pcie: add pcie support 5c9f151e0c OvmfPkg: CloudHv: Fix FW_BASE_ADDRESS 43f3cfce19 OvmfPkg: Check for QemuFwCfg availability before accessing it 3129ed374c OvmfPkg: CloudHv: Rely on QemuFwCfgLibNull implementation bf25f27e00 OvmfPkg: Don't access A20 gate register on Cloud Hypervisor 72c5afd0b4 Security: Add HashLibTdx b1567b2e15 CryptoPkg: Add SecCryptLib dc443e4437 SecurityPkg: Add definition of EFI_CC_EVENT_HOB_GUID a708536dce OvmfPkg: Introduce SecMeasurementLib 4b0a622635 OvmfPkg/IntelTdx: Measure Td HobList and Configuration FV ac03c339de OvmfPkg: Add PCDs for LAML/LASA field in CC EVENTLOG ACPI table f8264e1303 MdePkg: Define CC Measure EventLog ACPI Table 57a6ee3461 OvmfPkg/IntelTdx: Add TdTcg2Dxe 0a4019ec9d OvmfPkg/IntelTdx: Enable RTMR based measurement and measure boot 0b36dea3f8 BaseTools: Fix dependency issue in PcdValueInit 4f89e4b3e8 .pytool: UncrustifyCheck: Set IgnoreFiles path relative to package path 2818fda9bc Security: Add SecTpmMeasurementLibTdx ff0ffe5999 OvmfPkg: Implement MeasureHobList/MeasureFvImage a81a650da1 OvmfPkg: Delete SecMeasurementLibTdx ff36b2550f OvmfPkg/Sec: fix stack switch 21a9b605b8 CpuException: Avoid allocating code pages for DXE instance 34d505123e CpuException: Init global variables in-place 2fbc5ff0a5 CpuException: Avoid allocating page but using global variables 2a09527ebc CpuException: Remove InitializeCpuInterruptHandlers e7abb94d1f CpuException: Add InitializeSeparateExceptionStacks 54aeed7e00 MpInitLib: Allocate code buffer for PEI phase 76323c3145 MpInitLib: remove unneeded global ASM_PFX b4d7b9d2b5 MpInitLib: Put SEV logic in separate file 283ab9437a MpInitLib: Only allocate below 1MB memory for 16bit code ccc269756f MpInitLib: Move the Above1Mb vector allocation to MpInitLibInitialize f0b97e165e Revert "OvmfPkg/Sec: fix stack switch" b09ada6edc MdePkg: Remove "assert" from SmmCpuRendevousLibNull.c 92288f4334 MdePkg/BaseLib: Add CRC16-ANSI and CRC32c implementations e2ae0bed29 ArmPkg/ArmExceptionLib: Follow new CpuExceptionHandlerLib APIs 6676162f64 DxeMain: Fix the bug that StackGuard is not enabled 16d97fa601 OvmfPkg: Use PcdOvmfWorkAreaBase instead of PcdSevEsWorkAreaBase 05e57cc9ce SecurityPkg/HashLibTdx: Return EFI_UNSUPPORTED if it is not Tdx guest 92ab049719 BaseTools: output the intermediate library instance when error occurs cc2db6ebfb UefiPayloadPkg: Increase the PcdMaximumUnicodeStringLength e8034b534a UefiPayloadPkg: Always split page table entry to 4K if it covers stack. cfe165140a UefiPayloadPkg: UniversalPayloadBuild.py to support --pcd feature b97243dea3 MdeModulePkg/XhciDxe: Check return value of XHC_PAGESIZE register 3930d1791a ArmPlatformPkg: Remove overly verbose DEBUG lines in LcdGraphicsBlt aa1bce0e5e OvmfPkg: reduce the number of dsc include files for tpm libs 6c9f218bc0 OvmfPkg/Library: Create base HardwareInfoLib for PCI Host Bridges 2b1a5b8c61 Ovmf/HardwareInfoLib: Create Pei lib to parse directly from fw-cfg a1bd79c514 Ovmf/HardwareInfoLib: Add Dxe lib to dynamically parse heterogenous data 3497fd5c26 Ovmf/PlatformPei: Use host-provided GPA end if available 3f5b1b9132 OvmfPkg/PciHostBridgeUtilityLib: Initialize RootBridges apertures with spec f304308e1c ArmPlatformPkg: Add PCD for serial debug port interrupt 4bfd668e5e UefiCpuPkg: CpuDxe: Set RW and P Attributes on Split Pages 2aee08c0b6 UefiPayloadPkg: Backward support with python 3.6 8f0722434b ArmVirtPkg: Include DxeHardwareInfoLib library class in dsc 15b25045e6 Ovmf: Include HardwareInfoLib library classes for IntelTdx b600f253b3 BaseTools/Ecc: Fix grammar in Ecc error message 7f4eca4cc2 MdeModulePkg/XhciDxe: Add access xHCI Extended Capabilities Pointer 5914128871 BaseTools: Fix the GenMake bug for .cpp source file c13377153f MdePkg/Acpi62: Add type 7 NFIT Platform Capabilities Structure support 21e6ef7522 UefiPayloadPkg: Align Attribute value with UPL spec 8d0564deaf pip-requirements.txt: Update basetools version to 0.1.24 f966093f5b OvmfPkg/PlatformCI: add IntelTdxBuild.py 70586d4e3a MdePkg/Acpi62: Add bit definitions to NFIT Platform Capabilities Structure 7861b24dc9 ArmPkg/Drivers: ArmGicIsInterruptEnabled returns incorrect value e1eef3a8b0 NetworkPkg: Add Wi-Fi Wpa3 support in WifiConnectManager 134fbd552c SecurityPkg: UefiSecureBoot: Definitions of cert and payload structures d6bee54c45 SecurityPkg: PlatformPKProtectionLib: Added PK protection interface 56c717aafa SecurityPkg: SecureBootVariableLib: Updated time based payload creator 6de7c084db SecurityPkg: SecureBootVariableLib: Updated signature list creator 6eb4079475 SecurityPkg: SecureBootVariableLib: Added newly supported interfaces fe73e9cd89 SecurityPkg: SecureBootVariableProvisionLib: Updated implementation d2a0f379d5 SecurityPkg: Secure Boot Drivers: Added common header files 5678ebb42b SecurityPkg: SecureBootConfigDxe: Updated invocation pattern dbc4e3675f SecurityPkg: SecureBootVariableLib: Added unit tests 152e37cc5a OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency f193b945ea EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency 9ab18fec82 StandaloneMmPkg: Fix issue about SpPcpuSharedBufSize field 31d3eeb103 StandaloneMmPkg: Replace DEBUG_INFO with DEBUG_ERROR 5496c763aa StandaloneMmPkg: Fix check buffer address failed issue from TF-A e93bc6309b UefiCpuPkg/SecCore: Add debug messages to illuminate data flow 86a0f84470 ArmVirtPkg: Pipeline: Resolving newly introduced dependency c8e30482fd .gitignore: Ignore build tools build logs f6f3cc7ead UefiPayloadPkg: Add CryptoDxe driver to UefiPayload 12dd064a18 MdePkg/include: Update DMAR definitions to Intel VT-d spec ver4.0 9ab389c01b UefiCpuPkg: Update SEC_IDT_TABLE struct 470206ba7f IntelFsp2Pkg: Update SEC_IDT_TABLE struct 0d23c447d6 DynamicTablesPkg: Add support to specify FADT minor revision 07c8e5e59b UefiPayloadPkg/PlatformBootManagerLib: Evenly space boot prompt 176016387f BaseTools: add '-p' for Linux 'cp' command. 039bdb4d3e BaseTools: Fix DSC LibraryClass precedence rule fc4a132c0e DynamicTables: Fix DT PCI interrupt flags parsing 792ebb6374 DynamicTablesPkg: Fix generated _HID value for SBSA c966204049 IntelFsp2Pkg: Add Definition of EDKII_PEI_VARIABLE_PPI 586b4a104b Maintainers.txt: Add IntelFsp2*Pkg Maintainer e18a5f813c Maintainers.txt: Update Maintainers/reviewers for UefiPayloadPkg e21b203911 UefiPayloadPkg: Add macro to support selective driver in UPL f0064ac3af Maintainers.txt: Update email address 6cda306da1 DynamicTablesPkg: AcpiSsdtPcieLibArm: Correct translation value 9ac155bf0b DynamicTablesPkg: AcpiSsdtPcieLibArm: Support UID > 0xF 19a8768365 DynamicTablesPkg: AcpiSsdtPcieLibArm: Create support library 671b0cea51 NetworkPkg/HttpBootDxe: Add Support for HTTP Boot Basic Authentication 140446cd59 IntelFsp2Pkg: Support 64bit FspResetType for X64 build. 24eac4caf3 IntelFsp2WrapperPkg: Support 64bit FspResetType for X64 build. 4824924377 IntelFsp2Pkg/FspSecCore: Add FSP-I API for SMM support. 3b8cee1781 Maintainers.txt: update Gary's email address 7ef91af84c EmulatorPkg/PosixFileSystem: Add NULL check on memory allocation 494f333aba MdeModulePkg/CoreDxe: Allow DXE Drivers to use untested memory 343f37b5c0 MdeModulePkg/SetupBrowserDxe:Follow spec'd way to reconnect driver c8af26627a ArmPkg/CpuDxe: drop ARM_PROCESSOR_TABLE pseudo-ACPI table 5a3641bfcd IntelFsp2Pkg: Add FSPI_ARCH_UPD. bf1ff540d9 MdePkg/UefiDevicePathLib: Add support for PEIMs 6964b5c48c MdeModulePkg/Include: Long debug string is truncated to 104 char d32a84b5ad BaseTools: INF should use latest Pcd value instead of default value 8ee26529d1 BaseTools/VolInfo: Correct alignment attributes display c0b7679aac BaseTools/VolInfo: Increase define for highest section value fca5de51e1 BaseTools/VolInfo: Correct EFI_SECTION_VERSION display 8a5782d704 UefiCpuPkg: Fix nasm warning "signed byte value exceeds" a47241f133 UefiPayloadPkg: Add macro to support selection of CryptoDxe driver 69f76d0f72 Maintainers.txt: Remove OvmfPkg/XenTimerDxe reference a8c4fe23c4 Maintainers.txt: Add missing github ids 7f1c89f167 Maintainers.txt: Remove reviewer Harry Han b68d566439 BaseTools/Capsule: Support signtool input subject name to sign capsule file e3d468acb9 BaseTools/VolInfo: Show encapsulation sections 2677286307 UefiPayloadPkg: Fix RelaAddress type always mismatch in if condition f26b70cb9f UefiPayloadPkg: Add support for logging to CBMEM console 57783adfb5 OvmfPkg: Change default to disable MptScsi and PvScsi 1774a44ad9 Maintainers.txt: Remove MptScsi and PvScsi reviewers 0e7add1d75 OvmfPkg/XenHypercallLib: Fix naming of AArch64 3eca64f157 IntelFsp2Pkg: FSPI_UPD is not mandatory. 0d0bfcb457 IntelFsp2Pkg: Fix GenCfgOpt bug for FSPI_UPD support. 8a210b9ac0 ShellPkg: Acpiview: Abbreviate field names to preserve alignment 65c4f3f2be DynamicTablesPkg: Handle error when IdMappingToken is NULL f5cea604a6 DynamicTablesPkg: IORT set reference to Id array only if present 238f903e8d DynamicTablesPkg: IORT set reference to interrupt array if present 4c55f6394f MdePkg: IORT header update for IORT Rev E.d spec cd67efa1b2 ShellPkg: Acpiview: IORT parser update for IORT Rev E.d spec de200b7e2c DynamicTablesPkg: Update ArmNameSpaceObjects for IORT Rev E.d e9150618ec DynamicTablesPkg: IORT generator updates for Rev E.d spec 6f4e10d6db SecurityPkg: Add retry mechanism for tpm command 19cbfaa431 OvmfPkg/QemuVideoDxe: Zero out PixelInformation in QueryMode a551de0d93 ArmVirtPkg: Fix KVM Guest Firmware 0dc9b78a46 Maintainers.txt: Add missing Github IDs for OvmfPkg TPM/TGC modules d219119721 UefiPayloadPkg/PlatformBootManagerLib: Correct spacing in boot prompt 79aab22fca UefiPayloadPkg: Add a Macro to enable Boot Logo 444260d45e UefiPayloadPkg: Load Boot Logo into ACPI table 86757f0b47 MdeModulePkg: Add EDKII_PCI_DEVICE_PPI definition a8f59e2eb4 MdeModulePkg/AhciPei: Use PCI_DEVICE_PPI to manage AHCI device 3e599bbc10 DynamicTablesPkg: Fix using RmrNodeCount unitlitialised a0a03b5154 BaseTools/GenSec: Fix typo f5f8c08db9 BaseTools/VolInfo: Show FV section boundaries d241a09afb BaseTools/VolInfo: Parse EFI_SECTION_FREEFORM_SUBTYPE_GUID header cf02322c98 BaseTools/GenSec: Support EFI_SECTION_FREEFORM_SUBTYPE_GUID sections 1ee1622817 Basetools/GenFw: Allow AARCH64 builds to use the --prm flag 9f197e44b1 PrmPkg: Enable external visibility on PRM symbols 21200d9fe6 PrmPkg: Build Prm Samples with GCC for AARCH64 57faeb782a PrmPkg: Support AArch64 builds using GCC 1da2012d93 PrmPkg: Add details on AArch64 build to the Readme. 0f7bccf584 UefiCpuPkg: Simplify InitializeSeparateExceptionStacks 9a24c3546e MdeModulePkg: Move CPU_EXCEPTION_INIT_DATA to UefiCpuPkg f1688ec9da UefiCpuPkg: Simplify the struct definition of CPU_EXCEPTION_INIT_DATA 75e3c2435c UefiCpuPkg: Create CpuPageTableLib for manipulating X86 paging structs f336e30ba1 UefiCpuPkg/CpuPageTableLib: Return error on invalid parameters bf334513b3 CpuPageTableLib: Fix a bug when a bit is 1 in Attribute, 0 in Mask 13a0471bfd CpuPageTableLib: Refactor the logic 9cb8974f06 CpuPageTableLib: Split the page entry when LA is aligned but PA is not c16f02f776 CpuPageTableLib: Avoid treating non-leaf entry as leaf one f4c845e46b CpuPageTableLib: Fix parent attributes are not inherited properly 9f53fd4ba7 CpuPageTableLib: Fix a bug to avoid unnecessary changing to page table 927113c83b CpuPageTableLib: Fix bug that wrongly requires extra size for mapping e9e2ecab2d CpuPageTableLib: define IA32_PAGE_LEVEL enum type internally e76496530c MdePkg/Library/UefiDevicePathLib: Add back StandaloneMm INF file bd06717863 MdeModulePkg: Enhance bus scan for all root bridge instances 74f44d920a ShellPkg/SmbiosView: Display extended memory info in smbiosview -t 17 83d5871184 UefiCpuPkg/PiSmmCpuDxeSmm: Add a new mIsShadowStack flag 7b4754904e UefiCpuPkg/PiSmmCpuDxeSmm: Remove mInternalCr3 in PiSmmCpuDxeSmm 62391b4ce9 MdeModulePkg/DxeIpl: Remove clearing CR0.WP when protecting pagetable 803ed060ee UefiPayloadPkg: Remove clearing CR0.WP when protecting pagetable a2b61de2f6 IntelFsp2Pkg: FSPM_ARCH2_UPD mismatching bug. 809b5a3d2a MdeModulePkg: Update the SMBIOS version by UPL 2812668bfc UefiCpuPkg/CpuPageTableLib/UnitTest: Add host based unit test 30d62f5e31 OvmfPkg/PlatformDxe: Check ExtractConfig and RouteConfig arguments b94836b224 OvmfPkg/VirtioGpuDxe: Check QueryMode arguments 3f282f4510 OvmfPkg/VirtioFsDxe: Check GetDriverName arguments 64a20bea97 MdeModulePkg/DumpDynPcd: Remove unsupported format specifiers 9102518d29 MdePkg: Improved Smbios Type9 table and Smbios spec v3.5.0 Changes 35d167ef3c ShellPkg: Improved Smbios Type 9 table changes in PrintInfo.c 68bf712d4f MdePkg: Added support for SMBIOS spec v3.6.0 to Smbios.h e2ac68a23b BaseTools/Source/C/GenSec: Fix EFI_SECTION_FREEFORM_SUBTYPE_GUID header d5fd86f256 ShellPkg: Adds Local APIC parser to AcpiView 2bb0020675 UefiPayloadPkg: Return PciRootBridges instead of NULL c15c9fa420 UefiPayloadPkg: Add macro to control NvmExpressDxe 938430741f RedfishPkg/RedfishDiscoverDxe: USB Redfish host interface is not supported eebef1b3b7 RedfishPkg: Redfish modules may need to use the functions which are private f2bf043aaa RedfishPkg: Redfish functions for REST requests are not fully spec complied dfdba857a6 UefiPayloadPkg: Fix Coverity report defect 4d83ee04f4 ShellPkg: Add revision check for DSDT Header on Arm 0ede7cad73 Maintainers.txt: Update maintainers list 722e03bc2e Revert "UefiCpuPkg/CpuPageTableLib/UnitTest: Add host based unit test" 166c49c212 Revert "ShellPkg: Adds Local APIC parser to AcpiView" 39ff9769ca Revert "BaseTools: Fix DSC LibraryClass precedence rule" ba0e0e4c6a BaseTools: Fix DevicePath GNUmakefile for macOS - Respin the following patches: ovmf-Revert-UefiCpuPkg-Replace-Opcode-with-the-correspond.patch - Change the size of ovmf-x86_64 back to 2MB, and remove EFI shell to reduce the fv image size. - Originally the reason of changing the size of ovmf-x86_64 to 4MB is for preventing OBS exposes the following error: [ 266s] GenFv: ERROR 3000: Invalid [ 266s] the required fv image size 0x1afed8 exceeds the set fv image size 0x1ac000 The fv image size is too big. But we found that change ovmf-x86_64 to 4MB causes live migration problem on qemu. (bsc#1204220) - So let's change the size of ovmf_x86_64 back to 2MB and remove EFI shell to reduce the fv image size. If user wants to use EFI shell, they should move to ovmf-x86_64-4m image. So we add the "-D EXCLUDE_SHELL" build option to ovmf-x86_64 flavor in ovmf.spec. (bsc#1204220) - Add ovmf-Revert-OvmfPkg-OvmfXen-Set-PcdFSBClock.patch to revert 71cdb91f313380152d7bf38cfeebe76f5b2d39ac patch (bsc#1205613) - 71cdb91f313380152d7bf38cfeebe76f5b2d39ac OvmfPkg/OvmfXen: Set PcdFSBClock - We are waiting better upsteam patch, revert the issue patch first. Then PcdFSBClock will back to fixed variable. - Reference: https://edk2.groups.io/g/devel/topic/94891128#96077 https://bugzilla.tianocore.org/show_bug.cgi?id=4340 - Add ovmf-MdeModulePkg-PiSmmCore-SmmEntryPoint-underflow-CVE-2.patch for MdeModulePkg/PiSmmCore: SmmEntryPoint underflow (CVE-2021-38578) (bsc#1196741) - Add ovmf-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch to check result of GetEfiGlobalVariable2 (CVE-2019-14560, bsc#1174246) - Add ovmf-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount (bsc#1225889, CVE-2024-1298) - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Bugs and CVEs fixes: * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328) * pcie: Introduce pcie_sriov_num_vfs (bsc#1220065, CVE-2024-26328) * virtio-net: correctly copy vnet header when flushing TX (bsc#1218484, CVE-2023-6693) * hw/pvrdma: Protect against buggy or malicious guest driver (bsc#1209554, CVE-2023-1544) * pcie_sriov: Validate NumVFs (bsc#1220062, CVE-2024-26327) * esp: restrict non-DMA transfer length to that of available data (bsc#1220134, CVE-2024-24474) * s390x/ap: Wire up the device request notifier interface (bsc#1205316) * linux-headers: update to v6.5-rc1 (bsc#1205316) * Update linux headers to v6.3rc5 (bsc#1205316) * linux-headers: Update to v6.2-rc8 (bsc#1205316) * linux-headers: Update to v6.1 (bsc#1205316) - Backport of SapphireRapids CPU Models (jsc#PED-8113): * target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE * target/i386: Export MSR_ARCH_CAPABILITIES bits to guests * docs: re-generate x86_64 ABI compatibility CSV * target/i386: Add new CPU model GraniteRapids * target/i386: Add few security fix bits in ARCH_CAPABILITIES into SapphireRapids CPU model * target/i386: Add new bit definitions of MSR_IA32_ARCH_CAPABILITIES * target/i386: Allow MCDT_NO if host supports * target/i386: Add support for MCDT_NO in CPUID enumeration * target/i386: Adjust feature level according to FEAT_7_1_EDX * target/i386: Add support for PREFETCHIT0/1 in CPUID enumeration * target/i386: Add support for AVX-NE-CONVERT in CPUID enumeration * target/i386: Add support for AVX-VNNI-INT8 in CPUID enumeration * target/i386: Add support for AVX-IFMA in CPUID enumeration * target/i386: Add support for AMX-FP16 in CPUID enumeration * target/i386: Add support for CMPCCXADD in CPUID enumeration * target/i386: add support for FB_CLEAR feature * target/i386: add support for FLUSH_L1D feature * i386: Add new CPU model SapphireRapids * target/i386: KVM: allow fast string operations if host supports them * target/i386: add FZRM, FSRS, FSRC * target/i386: add FSRM to TCG - Backport of EPYC-Genoa CPU Model (jsc#PED-7366): * target/i386: Add EPYC-Genoa model to support Zen 4 processor series * target/i386: Add VNMI and automatic IBRS feature bits * target/i386: Add missing feature bits in EPYC-Milan model * target/i386: Add feature bits for CPUID_Fn80000021_EAX * target/i386: Add a couple of feature bits in 8000_0008_EBX * target/i386: Add new EPYC CPU versions with updated cache_info * target/i386: allow versioned CPUs to specify new cache_info - Backports and bugfixes: * net: Update MemReentrancyGuard for NIC (bsc#1213269, CVE-2023-3019) * net: Provide MemReentrancyGuard * to qemu_new_nic() (bsc#1213269, CVE-2023-3019) * ui/clipboard: add asserts for update and request (bsc#1218889, CVE-2023-6683) * ui/clipboard: mark type as not available when there is no data (bsc#1218889, CVE-2023-6683) * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446) * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446) * apic: disable reentrancy detection for apic-msi (bsc#1222843, CVE-2024-3446) * raven: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * bcm2835_property: disable reentrancy detection for iomem (bsc#1222843, CVE-2024-3446) * lsi53c895a: disable reentrancy detection for script RAM (bsc#1222843, CVE-2024-3446) * hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (bsc#1222843, CVE-2024-3446) * checkpatch: add qemu_bh_new/aio_bh_new checks (bsc#1222843, CVE-2024-3446) * async: Add an optional reentrancy guard to the BH API (bsc#1222843, CVE-2024-3446) * memory: prevent dma-reentracy issues (bsc#1222843, CVE-2024-3446) * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447) - Fix bsc#1227322, CVE-2024-4467: * qcow2: Don't open data_file with BDRV_O_NO_IO - Fix bsc#1230140 (and bsc#1229814 & bsc#1230008): * target/ppc: Fix lxv/stxv MSR facility check (bsc#1230140, bsc#1229814, bsc#1230008) - Fix a build issue of ipxe with newer binutils: * [openSUSE] roms/ipxe: Backport patches to fix the build with binutils 2.41 - Misc: * [openSUSE] Update hash of the sgabios submodule - Properly fix bsc#1230140 (patch also submitted upstream): * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1230140) - Fix bsc#1230915, CVE-2024-8612: * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612) * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612) * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612) * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612) - Fix bsc#1229007 (CVE-2024-7409) and bsc#1230834 (CVE-2024-8354): * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007, CVE-2024-7409) * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007, CVE-2024-7409) * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409) * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409) * aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED (bsc#1229007, CVE-2024-7409) * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354) - Fix bsc#1228079 and boo#1231166: * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079) * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166) - Fixes bsc#1204082 * Patches added: block-io_uring-revert-Use-io_uring_regis.patch - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Build fails due to exceeding 10 GB disk limit (10430 MB): raise disk space contraint to 12 GB - Improve dependency handling (e.g., what's recommended vs. what's required. - Add a subpackage (qemu-headless) that brings in all the packages that are needed for creating VMs with tools like virt-install or VirtManager, run either locally or from a remote host. (bsc#1202166) - qtests test are not realiable when run inside OBS builders, so let's disable that part of the testsuite for now. There is work ongoing to run it somewhere else (on dedicated hosts) to avoid loosing coverage. (bsc#1204566) - Enable KVM support on riscv64 - install SeaBIOS documentation - Raise the maximum number of vCPUs a VM can have to 1024 (jsc#PED-2592) * Patches added: pc-q35-Bump-max_cpus-to-1024.patch - install binfmt-misc handlers for systemd (bsc#1206838) - Fixes jsc#PED-1716 * Patches added: configure-Add-Wno-gnu-variable-sized-typ.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch Update-linux-headers-to-v6.0-rc4.patch - Rename submodule patches so that it's clear which ones are backports and which ones are downstream only fixes; - No functional change intended. * Patches dropped: Ignore-spurious-GCC-12-warning.patch roms-sgabios-Fix-csum8-to-be-built-by-ho.patch Makefile-define-endianess-for-cross-buil.patch ipxe-Makefile-fix-issues-of-build-reprod.patch qboot-add-cross.ini-file-to-handle-aarch.patch sgabios-Makefile-fix-issues-of-build-rep.patch Silence-GCC-12-spurious-warnings.patch build-be-explicit-about-mx86-used-note-n.patch enable-cross-compilation-on-ARM.patch stub-out-the-SAN-req-s-in-int13.patch help-compiler-out-by-initializing-array.patch seabios-switch-to-python3-as-needed.patch * Patches added: openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch - Refactor building and installing SeaBIOS docs - Fixed: bsc#1205847 (CVE-2022-4172), bsc#1203788 (CVE-2022-3165), bsc#1205808 (CVE-2022-4144), bsc#1206527, bsc#1208139 - Improved handling of: bsc#1202282 (jsc#PED-2592) * Patches dropped: pc-q35-Bump-max_cpus-to-1024.patch * Patches added: accel-abort-if-we-fail-to-load-the-accel.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch dmg-warn-when-opening-dmg-images-contain.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-support-for-type-8-port-connec.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch ui-vnc-clipboard-fix-integer-underflow-i.patch - Fixes: jsc#PED-1716 Add S390 features from IBM requirements * Patches added: dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch include-elf.h-add-s390x-note-types.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pv-Add-dump-support.patch - Fixes bsc#1197653, CVE-2022-1050 * Patches added: block-Handle-curl-7.55.0-7.85.0-version-.patch hw-pvrdma-Protect-against-buggy-or-malic.patch - Fix build issue with Linux 6.2's headers (bsc#1208657) by dropping linux-user-add-more-compat-ioctl-definit.patch and adding Revert-linux-user-fix-compat-with-glibc-.patch - Patches meson-enforce-a-minimum-Linux-kernel-hea.patch and linux-user-drop-conditionals-for-obsolet.patch were added as downstream patches as they were part of a series, but they never made it upstream, so we don't want them here either * Patches dropped: linux-user-add-more-compat-ioctl-definit.patch linux-user-drop-conditionals-for-obsolet.patch meson-enforce-a-minimum-Linux-kernel-hea.patch * Patches added: Revert-linux-user-fix-compat-with-glibc-.patch - Fix bsc#1209064 * Patches added: s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch - Switch the packaging workflow to git, like the one we have in place already for Factory. * Patches no longer present as patch files, but applied as commits: Disable-some-tests-that-have-problems-in.patch Make-char-muxer-more-robust-wrt-small-FI.patch Make-installed-scripts-explicitly-python.patch Makefile-fix-build-with-binutils-2.38.patch PPC-KVM-Disable-mmu-notifier-check.patch Raise-soft-address-space-limit-to-hard-l.patch Revert-linux-user-fix-compat-with-glibc-.patch Revert-roms-efirom-tests-uefi-test-tools.patch Revert-tests-qtest-enable-more-vhost-use.patch Update-linux-headers-to-v6.0-rc4.patch accel-abort-if-we-fail-to-load-the-accel.patch ath5k-Add-missing-AR5K_EEPROM_READ-in-at.patch bios-tables-test-add-test-for-number-of-.patch bios-tables-test-teach-test-to-use-smbio.patch block-Handle-curl-7.55.0-7.85.0-version-.patch block-io_uring-revert-Use-io_uring_regis.patch configure-Add-Wno-gnu-variable-sized-typ.patch dmg-warn-when-opening-dmg-images-contain.patch dump-Add-architecture-section-and-sectio.patch dump-Refactor-dump_iterate-and-introduce.patch dump-Reintroduce-memory_offset-and-secti.patch dump-Rename-write_elf-_phdr_note-to-prep.patch dump-Rename-write_elf_loads-to-write_elf.patch dump-Reorder-struct-DumpState.patch dump-Replace-opaque-DumpState-pointer-wi.patch dump-Rework-dump_calculate_size-function.patch dump-Rework-filter-area-variables.patch dump-Rework-get_start_block.patch dump-Split-elf-header-functions-into-pre.patch dump-Use-a-buffer-for-ELF-section-data-a.patch dump-Write-ELF-section-headers-right-aft.patch hw-acpi-erst.c-Fix-memory-handling-issue.patch hw-display-qxl-Avoid-buffer-overrun-in-q.patch hw-display-qxl-Document-qxl_phys2virt.patch hw-display-qxl-Have-qxl_log_command-Retu.patch hw-display-qxl-Pass-requested-buffer-siz.patch hw-pvrdma-Protect-against-buggy-or-malic.patch hw-scsi-megasas-check-for-NULL-frame-in-.patch hw-smbios-add-core_count2-to-smbios-tabl.patch hw-smbios-handle-both-file-formats-regar.patch hw-smbios-support-for-type-8-port-connec.patch include-elf.h-add-s390x-note-types.patch increase-x86_64-physical-bits-to-42.patch linux-user-Fake-proc-cpuinfo.patch linux-user-lseek-explicitly-cast-non-set.patch linux-user-remove-conditionals-for-many-.patch linux-user-use-max-as-default-CPU-model-.patch linux-user-use-target_ulong.patch meson-install-ivshmem-client-and-ivshmem.patch meson-remove-pkgversion-from-CONFIG_STAM.patch module-add-Error-arguments-to-module_loa.patch module-removed-unused-function-argument-.patch module-rename-module_load_one-to-module_.patch net-tulip-Restrict-DMA-engine-to-memorie.patch openSUSE-Basetools-Ignore-spurious-GCC-1.patch openSUSE-Makefile-Fix-csum8-to-be-built-.patch openSUSE-Makefile-define-endianess-for-c.patch openSUSE-Makefile-fix-issues-of-build-re.patch openSUSE-add-cross.ini-file-to-handle-aa.patch openSUSE-build-Makefile-fix-issues-of-bu.patch openSUSE-build-Silence-GCC-12-spurious-w.patch openSUSE-build-be-explicit-about-mx86-us.patch openSUSE-build-enable-cross-compilation-.patch openSUSE-pc-q35-Bump-max_cpus-to-1024.patch openSUSE-pcbios-stub-out-the-SAN-req-s-i.patch openSUSE-switch-to-python3-as-needed.patch openSUSE-test-help-compiler-out-by-initi.patch qemu-binfmt-conf-Modify-default-path.patch qemu-bridge-helper-reduce-security-profi.patch roms-Makefile-add-cross-file-to-qboot-me.patch roms-Makefile-pass-a-packaging-timestamp.patch roms-change-cross-compiler-naming-to-be-.patch s390x-Add-KVM-PV-dump-interface.patch s390x-Add-protected-dump-cap.patch s390x-Introduce-PV-query-interface.patch s390x-pci-add-routine-to-get-host-functi.patch s390x-pci-don-t-fence-interpreted-device.patch s390x-pci-enable-adapter-event-notificat.patch s390x-pci-enable-for-load-store-interpre.patch s390x-pci-let-intercept-devices-have-sep.patch s390x-pci-reflect-proper-maxstbl-for-gro.patch s390x-pci-reset-ISM-passthrough-devices-.patch s390x-pci-shrink-DMA-aperture-to-be-boun.patch s390x-pv-Add-dump-support.patch s390x-tod-kvm-don-t-save-restore-the-TOD.patch scsi-generic-check-for-additional-SG_IO-.patch scsi-generic-replace-logical-block-count.patch tests-acpi-allow-changes-for-core_count2.patch tests-acpi-update-tables-for-new-core-co.patch tests-change-error-message-in-test-162.patch tests-qemu-iotests-Triple-timeout-of-i-o.patch ui-vnc-clipboard-fix-integer-underflow-i.patch xen-add-block-resize-support-for-xen-dis.patch xen-ignore-live-parameter-from-xen-save-.patch xen_disk-Add-suse-specific-flush-disable.patch - Fix bsc#bsc#1211697 * Patches added: smbios: sanitize type from external type before checking have_fields_bitmap (bsc#1211697) hw/smbios: fix field corruption in type 4 table (bsc#1211697) linux-user: fill out task state in /proc/self/stat test-vmstate: fix bad GTree usage, use-after-free qemu/osdep: Switch position of "extern" and "G_NORETURN" - Fix bsc#1211000 - Patches added: * Run fstat asynchronously inside coroutines (bsc#1211000) * Allow bdrv_get_allocated_file_size to run in bdrv context (bsc#1211000) * Convert query-named-block-nodes to coroutine (bsc#1211000) * Convert query-block/info_block to coroutine (bsc#1211000) * block: Convert bdrv_get_allocated_file_size() to co_wrapper (bsc#1211000) * block-coroutine-wrapper.py: support also basic return types (bsc#1211000) * [openSUSE][RPM] Backport some spec-file improvements from Factory - Fix bsc#1213414, bsc#1207205, bsc#1212968, bsc#1179993, bsc#1181740, bsc#1213001 * vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present (CVE-2023-3301) * hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) * 9pfs: prevent opening special files (CVE-2023-2861) * hw/ide/piix: properly initialize the BMIBA register * ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255) * [openSUSE][OBS] Refine the OBS workflow for 15-SP5 - Fix bsc#1188609, bsc#1213925, bsc#1212850, bsc#1215311, bsc#1213210: * hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) * virtio-crypto: verify src&dst buffer length for sym request (CVE-2023-3180) * io: remove io watch if TLS channel is closed during handshake (CVE-2023-3354) * [openSUSE] roms/ipxe: Backport 0aa2e4ec9635, in preparation of binutils 2.41 * [openSUSE][RPM] pass -p1 to autosetup in qemu.spec * target/s390x: Fix the "ignored match" case in VSTRS * linux-user/elfload: Enable vxe2 on s390x - Add a modalias Supplements, so the package gets selected automatically on a Raspberry Pi. - Use proper quoting for the modalias Supplements (see also https://github.com/openSUSE/libzypp/issues/216). - Update to b08ce72793b5 (2020-04-02) (bsc#1167761) * Based on v5.6.y * Uses upstream's CMA handling * Introduces GPIO labels * Fixes DMA issues with firmware DT node * Introduces thermal nodes - Remove rpi4-thermal.dts as it's now available in the stock device-tree. - Remove rpi4-gpio-names-overlay.dts as it's now available in the stock device-tree. - Remove rpi4-firmware-dma-ranges-overlay.dts as it's now available in the stock device-tree. - Remove upstream-cma.patch as it's now available in the stock device-tree. - Remove upstream-pcie-dma-ranges.patch as it's now available in the stock device-tree. - Refresh upstream-emmc2bus.patch so it applies on v5.6.y - Update to d7b4d5935198 (2020-05-02) * Adds gpio labels for rpi4 (bsc#1164722) * Get rid of upstream-emmc2bus.patch, not needed anymore - Add vl805-firware-loader-overlay.dts which registers a reset controller that'll take care of triggering vl805's firmware load. - Update to 2dc96ad40979 (2020-10-26): * Introduce firmware-clocks * Introduce firmware-reset * Add reset controller in xHCI node - Get rid of vl805-firmware-loader-overlay.dts, not needed anymore - Introduce upstream-overlay-rpi-poe.patch to adapt the overlay to our driver (jsc#SLE-16543) - Update to f77383ec0ed3 (2020-12-07) (jsc#SLE-16676): * Introduce RPi400 device-tree - Introduce upstream-blconfig-rmem.patch for firmware to be able to define firmware's configuration reserved memory (jsc#SLE-16616) - Update to 02dbfea28f (2021-01-22): * Add reserved memory template to hold firmware configuration - Drop upstream-blconfig-rmem.patch as it's now available upstream. - Introduce disable-v3d-overlay.dts, in order to be able to selectively disable v3d while using vc4 as the display controller (jsc#SLE-15928). - Introduce enable-bt-overlay.dts (bsc#1182759) - Update to 16991af20b (2021-03-15) (bsc#1183238): * overlays: Add pcie-32bit-dma overlay - Add overlay for smbios information (bsc#1183079) * smbios-overlay.dts - Update to 2425833c7ff5 (2021-09-17) * Switch to 5.14 branch * Drop upstream-overlay-rpi-poe.patch Enable RaspberryPi Zero 2 (jsc#SLE-23131). - Update to 14c1845ff9 (2021-11-19): * Add DTS: - bcm2710-rpi-zero-2-w.dts - bcm2710-rpi-zero-2.dts * Add overlays: - adafruit-st7735r-overlay.dts - fbtft-overlay.dts - imx519-overlay.dts - mcp2515-overlay.dts - mlx90640-overlay.dts - With recent Linux kernel gpio-ranges Device Tree property is now required. Add following patches to fix immediate issue described in bsc#1197578. ARM-dts-gpio-ranges-property-is-now-required.patch ARM-dts-Add-GPIO-line-names-for-downstream-RPis.patch We do not update whole package because this will create new issues like the one described in comment#12 in bsc#1193434 and comment#2 in bsc#1196632. Once patches referenced in bsc#1196632 are accepted upstream. _This_ package could be upgraded too. - Switch back to platform driver until upstream gain support for VEC clock in clk-raspberrypi driver. Add following patch to fix immediate issue described in bsc#1198061. Revert-dt-Move-VEC-clock-to-clk-raspberrypi.patch - Use compatible string which is supported by spidev module (bsc#1212791): * ARM-dts-bcm27xx-Use-better-name-for-spidev.patch- - Extend "ARM: dts: bcm27xx: Use better name for spidev" patch coverage. Change compatible "spidev" to "rohm,dh2228fv" in overlay files too. Fixes bsc#1219094. - Add a modalias Supplements, so the package gets selected automatically on a Raspberry Pi. - Use proper quoting for the modalias Supplements (see also https://github.com/openSUSE/libzypp/issues/216). - Update to b08ce72793b5 (2020-04-02) (bsc#1167761) * Based on v5.6.y * Uses upstream's CMA handling * Introduces GPIO labels * Fixes DMA issues with firmware DT node * Introduces thermal nodes - Remove rpi4-thermal.dts as it's now available in the stock device-tree. - Remove rpi4-gpio-names-overlay.dts as it's now available in the stock device-tree. - Remove rpi4-firmware-dma-ranges-overlay.dts as it's now available in the stock device-tree. - Remove upstream-cma.patch as it's now available in the stock device-tree. - Remove upstream-pcie-dma-ranges.patch as it's now available in the stock device-tree. - Refresh upstream-emmc2bus.patch so it applies on v5.6.y - Update to d7b4d5935198 (2020-05-02) * Adds gpio labels for rpi4 (bsc#1164722) * Get rid of upstream-emmc2bus.patch, not needed anymore - Add vl805-firware-loader-overlay.dts which registers a reset controller that'll take care of triggering vl805's firmware load. - Update to 2dc96ad40979 (2020-10-26): * Introduce firmware-clocks * Introduce firmware-reset * Add reset controller in xHCI node - Get rid of vl805-firmware-loader-overlay.dts, not needed anymore - Introduce upstream-overlay-rpi-poe.patch to adapt the overlay to our driver (jsc#SLE-16543) - Update to f77383ec0ed3 (2020-12-07) (jsc#SLE-16676): * Introduce RPi400 device-tree - Introduce upstream-blconfig-rmem.patch for firmware to be able to define firmware's configuration reserved memory (jsc#SLE-16616) - Update to 02dbfea28f (2021-01-22): * Add reserved memory template to hold firmware configuration - Drop upstream-blconfig-rmem.patch as it's now available upstream. - Introduce disable-v3d-overlay.dts, in order to be able to selectively disable v3d while using vc4 as the display controller (jsc#SLE-15928). - Introduce enable-bt-overlay.dts (bsc#1182759) - Update to 16991af20b (2021-03-15) (bsc#1183238): * overlays: Add pcie-32bit-dma overlay - Add overlay for smbios information (bsc#1183079) * smbios-overlay.dts - Update to 2425833c7ff5 (2021-09-17) * Switch to 5.14 branch * Drop upstream-overlay-rpi-poe.patch Enable RaspberryPi Zero 2 (jsc#SLE-23131). - Update to 14c1845ff9 (2021-11-19): * Add DTS: - bcm2710-rpi-zero-2-w.dts - bcm2710-rpi-zero-2.dts * Add overlays: - adafruit-st7735r-overlay.dts - fbtft-overlay.dts - imx519-overlay.dts - mcp2515-overlay.dts - mlx90640-overlay.dts - With recent Linux kernel gpio-ranges Device Tree property is now required. Add following patches to fix immediate issue described in bsc#1197578. ARM-dts-gpio-ranges-property-is-now-required.patch ARM-dts-Add-GPIO-line-names-for-downstream-RPis.patch We do not update whole package because this will create new issues like the one described in comment#12 in bsc#1193434 and comment#2 in bsc#1196632. Once patches referenced in bsc#1196632 are accepted upstream. _This_ package could be upgraded too. - Switch back to platform driver until upstream gain support for VEC clock in clk-raspberrypi driver. Add following patch to fix immediate issue described in bsc#1198061. Revert-dt-Move-VEC-clock-to-clk-raspberrypi.patch - Use compatible string which is supported by spidev module (bsc#1212791): * ARM-dts-bcm27xx-Use-better-name-for-spidev.patch- - Extend "ARM: dts: bcm27xx: Use better name for spidev" patch coverage. Change compatible "spidev" to "rohm,dh2228fv" in overlay files too. Fixes bsc#1219094. - regionServiceClientConfigAzure + update the configuration to match the new command line arguments - Include in SLE 12 (FATE 318302, bnc#911856) - Update to version 0.0.3 + Use the new command for the meta data (azuremetadata) + Fix the package dependencies, requires azuremetadata - Update to version 0.0.4 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 0.0.5 + Don't specify root device name explicitly (bsc#1158698, bsc#1158707) - Update to version 0.0.6 + Report subscriptionId during registration (bsc#1170605, bsc#1170606) - Update to version 1.0.0 (bsc#1171465, bsc#1171465) + Merge region server setup for SLES and SLES For SAP - Update to version 1.0.5 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic + Use latest API to query the metadata server and send additional data - Update to version 2.0.0 (bsc#1199668) + Move the certs to /usr from /var to accomodate ro filesystem of SLE-Micro + Fix source url in spec file - Update to version 2.0.1 (bsc#1217537) + Replacing 104.45.31.195.pem 191.237.254.253.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - regionServiceClientConfigAzure + update the configuration to match the new command line arguments - Include in SLE 12 (FATE 318302, bnc#911856) - Update to version 0.0.3 + Use the new command for the meta data (azuremetadata) + Fix the package dependencies, requires azuremetadata - Update to version 0.0.4 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 0.0.5 + Don't specify root device name explicitly (bsc#1158698, bsc#1158707) - Update to version 0.0.6 + Report subscriptionId during registration (bsc#1170605, bsc#1170606) - Update to version 1.0.0 (bsc#1171465, bsc#1171465) + Merge region server setup for SLES and SLES For SAP - Update to version 1.0.5 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic + Use latest API to query the metadata server and send additional data - Update to version 2.0.0 (bsc#1199668) + Move the certs to /usr from /var to accomodate ro filesystem of SLE-Micro + Fix source url in spec file - Update to version 2.0.1 (bsc#1217537) + Replacing 104.45.31.195.pem 191.237.254.253.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - regionServiceClientConfigAzure + update the configuration to match the new command line arguments - Include in SLE 12 (FATE 318302, bnc#911856) - Update to version 0.0.3 + Use the new command for the meta data (azuremetadata) + Fix the package dependencies, requires azuremetadata - Update to version 0.0.4 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 0.0.5 + Don't specify root device name explicitly (bsc#1158698, bsc#1158707) - Update to version 0.0.6 + Report subscriptionId during registration (bsc#1170605, bsc#1170606) - Update to version 1.0.0 (bsc#1171465, bsc#1171465) + Merge region server setup for SLES and SLES For SAP - Update to version 1.0.5 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic + Use latest API to query the metadata server and send additional data - Update to version 2.0.0 (bsc#1199668) + Move the certs to /usr from /var to accomodate ro filesystem of SLE-Micro + Fix source url in spec file - Update to version 2.0.1 (bsc#1217537) + Replacing 104.45.31.195.pem 191.237.254.253.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Update to version 2.1.0 (bsc#1217537) + Replace certs 23.100.36.229.pem and 40.121.202.140.pem (4096 length): rgnsrv-azure-westus -> 23.100.36.229.pem expires 9 years rgnsrv-azure-eastus -> 40.121.202.140.pem expires 10 years - Update to version 2.2.0 (jsc#PCT-360) + Add IPv6 certs to enable IPv6 access of the update infrastructure + Add noipv6.patch to patch out IPv6 on SLE 12, no IPv6 support in SLE 12 in the Public Cloud - regionServiceClientConfigAzure + update the configuration to match the new command line arguments - Include in SLE 12 (FATE 318302, bnc#911856) - Update to version 0.0.3 + Use the new command for the meta data (azuremetadata) + Fix the package dependencies, requires azuremetadata - Update to version 0.0.4 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 0.0.5 + Don't specify root device name explicitly (bsc#1158698, bsc#1158707) - Update to version 0.0.6 + Report subscriptionId during registration (bsc#1170605, bsc#1170606) - Update to version 1.0.0 (bsc#1171465, bsc#1171465) + Merge region server setup for SLES and SLES For SAP - Update to version 1.0.5 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic + Use latest API to query the metadata server and send additional data - Update to version 2.0.0 (bsc#1199668) + Move the certs to /usr from /var to accomodate ro filesystem of SLE-Micro + Fix source url in spec file - Update to version 2.0.1 (bsc#1217537) + Replacing 104.45.31.195.pem 191.237.254.253.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Update to version 2.1.0 (bsc#1217537) + Replace certs 23.100.36.229.pem and 40.121.202.140.pem (4096 length): rgnsrv-azure-westus -> 23.100.36.229.pem expires 9 years rgnsrv-azure-eastus -> 40.121.202.140.pem expires 10 years - Update to version 2.2.0 (jsc#PCT-360) + Add IPv6 certs to enable IPv6 access of the update infrastructure + Add noipv6.patch to patch out IPv6 on SLE 12, no IPv6 support in SLE 12 in the Public Cloud - regionServiceClientConfigAzure + update the configuration to match the new command line arguments - Include in SLE 12 (FATE 318302, bnc#911856) - Update to version 0.0.3 + Use the new command for the meta data (azuremetadata) + Fix the package dependencies, requires azuremetadata - Update to version 0.0.4 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 0.0.5 + Don't specify root device name explicitly (bsc#1158698, bsc#1158707) - Update to version 0.0.6 + Report subscriptionId during registration (bsc#1170605, bsc#1170606) - Update to version 1.0.0 (bsc#1171465, bsc#1171465) + Merge region server setup for SLES and SLES For SAP - Update to version 1.0.5 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic + Use latest API to query the metadata server and send additional data - Update to version 2.0.0 (bsc#1199668) + Move the certs to /usr from /var to accomodate ro filesystem of SLE-Micro + Fix source url in spec file - Update to version 2.0.1 (bsc#1217537) + Replacing 104.45.31.195.pem 191.237.254.253.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Update to version 2.1.0 (bsc#1217537) + Replace certs 23.100.36.229.pem and 40.121.202.140.pem (4096 length): rgnsrv-azure-westus -> 23.100.36.229.pem expires 9 years rgnsrv-azure-eastus -> 40.121.202.140.pem expires 10 years - Update to version 2.2.0 (jsc#PCT-360) + Add IPv6 certs to enable IPv6 access of the update infrastructure + Add noipv6.patch to patch out IPv6 on SLE 12, no IPv6 support in SLE 12 in the Public Cloud - Update to version 2.2.1 + New 4096 certificate for rgnsrv-azure-southeastasia - Update to version 2.2.2 + Replacing certificate for rgnsrv-azure-southeastasia to get rid of weird chain cert - regionServiceClientConfigAzure + update the configuration to match the new command line arguments - Include in SLE 12 (FATE 318302, bnc#911856) - Update to version 0.0.3 + Use the new command for the meta data (azuremetadata) + Fix the package dependencies, requires azuremetadata - Update to version 0.0.4 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 0.0.5 + Don't specify root device name explicitly (bsc#1158698, bsc#1158707) - Update to version 0.0.6 + Report subscriptionId during registration (bsc#1170605, bsc#1170606) - Update to version 1.0.0 (bsc#1171465, bsc#1171465) + Merge region server setup for SLES and SLES For SAP - Update to version 1.0.5 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic + Use latest API to query the metadata server and send additional data - Update to version 2.0.0 (bsc#1199668) + Move the certs to /usr from /var to accomodate ro filesystem of SLE-Micro + Fix source url in spec file - Update to version 2.0.1 (bsc#1217537) + Replacing 104.45.31.195.pem 191.237.254.253.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Update to version 2.1.0 (bsc#1217537) + Replace certs 23.100.36.229.pem and 40.121.202.140.pem (4096 length): rgnsrv-azure-westus -> 23.100.36.229.pem expires 9 years rgnsrv-azure-eastus -> 40.121.202.140.pem expires 10 years - Update to version 2.2.0 (jsc#PCT-360) + Add IPv6 certs to enable IPv6 access of the update infrastructure + Add noipv6.patch to patch out IPv6 on SLE 12, no IPv6 support in SLE 12 in the Public Cloud - Update to version 2.2.1 + New 4096 certificate for rgnsrv-azure-southeastasia - Update to version 2.2.2 + Replacing certificate for rgnsrv-azure-southeastasia to get rid of weird chain cert - Update to version 1.0.1 + Add region server for China region - Removed /etc/regionserverclnt.cfg~ from tarball - Update to version 2.0.0 (bsc#1025004) + Delete old certificate of server we no longer operate + Add certificate for new server 34.197.223.242 - Fix dependency for SLE 15 (bsc#1071292) - Update to version 2.0.1 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 2.1.0 (bsc#1093189, bsc#1121114) + Drop lost server IP address; realign IPs with certs + Add 34.197.223.242 to configuration - Update to version 2.2.0 (bsc#1171232, bsc#1171233) + Send a region hint using the plugin + Consolidate SLES and SLES For SAP certs - Update to version 2.2.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 3.0.0 (bsc#1176005, bsc#1176007) + Reduce the number of region servers + Require python3-ec2metadata to support IMDSv2 only setups - Update to version 3.1.0 (bsc#1029162) + Add IPv6 addresses to config + Include IPv6 certificates + Requires cloud-regionsrv-client >= v9.3.0 - Update to version 4.0.0 (bsc#1199668) + Move cert location to usr form var to accomodate ro filesystem of SLE-Micro + Fix source location in spec file - Update to version 4.1.0 (bsc#1203215) + New certs for 52.79.82.165 and 54.247.166.75 - Update to version 4.1.1 (bsc#1217536) + Replace 54.247.166.75.pem and 54.253.118.149.pem old soon to expired certs with new generated ones that expire in 8 years and have longer length (4096) - Initial build - Update to version 1.0.0 + use ful path for data collector + fix provides - Update to version 1.0.1 + Add region server for China region - Removed /etc/regionserverclnt.cfg~ from tarball - Update to version 2.0.0 (bsc#1025004) + Delete old certificate of server we no longer operate + Add certificate for new server 34.197.223.242 - Fix dependency for SLE 15 (bsc#1071292) - Update to version 2.0.1 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 2.1.0 (bsc#1093189, bsc#1121114) + Drop lost server IP address; realign IPs with certs + Add 34.197.223.242 to configuration - Update to version 2.2.0 (bsc#1171232, bsc#1171233) + Send a region hint using the plugin + Consolidate SLES and SLES For SAP certs - Update to version 2.2.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 3.0.0 (bsc#1176005, bsc#1176007) + Reduce the number of region servers + Require python3-ec2metadata to support IMDSv2 only setups - Update to version 3.1.0 (bsc#1029162) + Add IPv6 addresses to config + Include IPv6 certificates + Requires cloud-regionsrv-client >= v9.3.0 - Update to version 4.0.0 (bsc#1199668) + Move cert location to usr form var to accomodate ro filesystem of SLE-Micro + Fix source location in spec file - Update to version 4.1.0 (bsc#1203215) + New certs for 52.79.82.165 and 54.247.166.75 - Update to version 4.1.1 (bsc#1217536) + Replace 54.247.166.75.pem and 54.253.118.149.pem old soon to expired certs with new generated ones that expire in 8 years and have longer length (4096) - Update to version 1.0.1 + Add region server for China region - Removed /etc/regionserverclnt.cfg~ from tarball - Update to version 2.0.0 (bsc#1025004) + Delete old certificate of server we no longer operate + Add certificate for new server 34.197.223.242 - Fix dependency for SLE 15 (bsc#1071292) - Update to version 2.0.1 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 2.1.0 (bsc#1093189, bsc#1121114) + Drop lost server IP address; realign IPs with certs + Add 34.197.223.242 to configuration - Update to version 2.2.0 (bsc#1171232, bsc#1171233) + Send a region hint using the plugin + Consolidate SLES and SLES For SAP certs - Update to version 2.2.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 3.0.0 (bsc#1176005, bsc#1176007) + Reduce the number of region servers + Require python3-ec2metadata to support IMDSv2 only setups - Update to version 3.1.0 (bsc#1029162) + Add IPv6 addresses to config + Include IPv6 certificates + Requires cloud-regionsrv-client >= v9.3.0 - Update to version 4.0.0 (bsc#1199668) + Move cert location to usr form var to accomodate ro filesystem of SLE-Micro + Fix source location in spec file - Update to version 4.1.0 (bsc#1203215) + New certs for 52.79.82.165 and 54.247.166.75 - Update to version 4.1.1 (bsc#1217536) + Replace 54.247.166.75.pem and 54.253.118.149.pem old soon to expired certs with new generated ones that expire in 8 years and have longer length (4096) - Version 4.1.1 Add patch no-ipv6.patch to not serve IPv6 addresses on SLES12 Related to bsc#1218656 - Version 4.2.0 Replace certs (length 4096): rgnsrv-ec2-cn-north1 -> 54.223.148.145 expires in 8 years rgnsrv-ec2-us-west2-2 -> 54.245.101.47 expires in 9 years Sidenote: We have one server with a short cert (2048) left; 34.197.223.242 expires in 2027 - Switch the patch syntax away form the deprecated shorthand macro - Update to version 4.3.0 (bsc#1228363) + The IPv6 cert was switched up for the region server running in us-west-2 and as such the SSL handshake was failing. Drop the incorrect cert and add the correct cert. - Initial build - Update to version 1.0.0 + use ful path for data collector + fix provides - Update to version 1.0.1 + Add region server for China region - Removed /etc/regionserverclnt.cfg~ from tarball - Update to version 2.0.0 (bsc#1025004) + Delete old certificate of server we no longer operate + Add certificate for new server 34.197.223.242 - Fix dependency for SLE 15 (bsc#1071292) - Update to version 2.0.1 + Use region hint to get SMT data in pre for IPv6 support (bsc#1029162) - Update to version 2.1.0 (bsc#1093189, bsc#1121114) + Drop lost server IP address; realign IPs with certs + Add 34.197.223.242 to configuration - Update to version 2.2.0 (bsc#1171232, bsc#1171233) + Send a region hint using the plugin + Consolidate SLES and SLES For SAP certs - Update to version 2.2.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 3.0.0 (bsc#1176005, bsc#1176007) + Reduce the number of region servers + Require python3-ec2metadata to support IMDSv2 only setups - Update to version 3.1.0 (bsc#1029162) + Add IPv6 addresses to config + Include IPv6 certificates + Requires cloud-regionsrv-client >= v9.3.0 - Update to version 4.0.0 (bsc#1199668) + Move cert location to usr form var to accomodate ro filesystem of SLE-Micro + Fix source location in spec file - Update to version 4.1.0 (bsc#1203215) + New certs for 52.79.82.165 and 54.247.166.75 - Update to version 4.1.1 (bsc#1217536) + Replace 54.247.166.75.pem and 54.253.118.149.pem old soon to expired certs with new generated ones that expire in 8 years and have longer length (4096) - Version 4.1.1 Add patch no-ipv6.patch to not serve IPv6 addresses on SLES12 Related to bsc#1218656 - Version 4.2.0 Replace certs (length 4096): rgnsrv-ec2-cn-north1 -> 54.223.148.145 expires in 8 years rgnsrv-ec2-us-west2-2 -> 54.245.101.47 expires in 9 years Sidenote: We have one server with a short cert (2048) left; 34.197.223.242 expires in 2027 - Switch the patch syntax away form the deprecated shorthand macro - Update to version 4.3.0 (bsc#1228363) + The IPv6 cert was switched up for the region server running in us-west-2 and as such the SSL handshake was failing. Drop the incorrect cert and add the correct cert. - New certificate for new region servers - Bump to version 2.0.1 + fix spec file file list - Enable use of plugin to send region hints to region server - Bump to version 2.1.1 (bsc#959244) + Point to the proper region servers - Update to version 2.1.2 (bsc#1053695, bsc#1053696) + Configure the client to send license verification data to the SMT server - Fix dependency for SLE 15 (bsc#1071292) - Update to version 3.0.0 (bsc#1171467, bsc#1171469) + Unify the configuration between SLES and SLES For SAP - Update to version 3.0.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 4.0.0 (bsc#1199668) + Move the cert location to /usr for compatibility with ro setup of SLE-Micro + Fix url in spec file to pint to the proper location of the source - Update to version 4.0.1 (bsc#1217538) + Replace 130.211.242.136.pem and 130.211.88.88.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Initial build - Include in SLE 12 (FATE #316168) - Fix license string - Properly handle licensing, use Apache v2 - Fix provides, package also provides the region server certs - Re-add previously removed provide, need all 3 - New certificate for new region servers - Bump to version 2.0.1 + fix spec file file list - Enable use of plugin to send region hints to region server - Bump to version 2.1.1 (bsc#959244) + Point to the proper region servers - Update to version 2.1.2 (bsc#1053695, bsc#1053696) + Configure the client to send license verification data to the SMT server - Fix dependency for SLE 15 (bsc#1071292) - Update to version 3.0.0 (bsc#1171467, bsc#1171469) + Unify the configuration between SLES and SLES For SAP - Update to version 3.0.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 4.0.0 (bsc#1199668) + Move the cert location to /usr for compatibility with ro setup of SLE-Micro + Fix url in spec file to pint to the proper location of the source - Update to version 4.0.1 (bsc#1217538) + Replace 130.211.242.136.pem and 130.211.88.88.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Enable use of plugin to send region hints to region server - Bump to version 2.1.1 (bsc#959244) + Point to the proper region servers - Update to version 2.1.2 (bsc#1053695, bsc#1053696) + Configure the client to send license verification data to the SMT server - Fix dependency for SLE 15 (bsc#1071292) - Update to version 3.0.0 (bsc#1171467, bsc#1171469) + Unify the configuration between SLES and SLES For SAP - Update to version 3.0.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 4.0.0 (bsc#1199668) + Move the cert location to /usr for compatibility with ro setup of SLE-Micro + Fix url in spec file to pint to the proper location of the source - Update to version 4.0.1 (bsc#1217538) + Replace 130.211.242.136.pem and 130.211.88.88.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Update to version 4.1.0 (bsc#1217538) + Replace 162.222.182.90 and 35.187.193.56 (length 4096): rgnsrv-gce-asia-northeast1 -> 162.222.182.90 expires in 9 years rgnsrv-gce-us-central1 -> 35.187.193.56 expires in 10 years - Version 4.2.0 (jsc#PCT-361) + Add IPv6 certs to supprt access of the update infrastructure via IPv6 on GCE instances. - Initial build - Include in SLE 12 (FATE #316168) - Fix license string - Properly handle licensing, use Apache v2 - Fix provides, package also provides the region server certs - Re-add previously removed provide, need all 3 - New certificate for new region servers - Bump to version 2.0.1 + fix spec file file list - Enable use of plugin to send region hints to region server - Bump to version 2.1.1 (bsc#959244) + Point to the proper region servers - Update to version 2.1.2 (bsc#1053695, bsc#1053696) + Configure the client to send license verification data to the SMT server - Fix dependency for SLE 15 (bsc#1071292) - Update to version 3.0.0 (bsc#1171467, bsc#1171469) + Unify the configuration between SLES and SLES For SAP - Update to version 3.0.1 (bsc#1174791, bsc#1174937) + New configuration to switch to https only outgoing traffic - Update to version 4.0.0 (bsc#1199668) + Move the cert location to /usr for compatibility with ro setup of SLE-Micro + Fix url in spec file to pint to the proper location of the source - Update to version 4.0.1 (bsc#1217538) + Replace 130.211.242.136.pem and 130.211.88.88.pem certs expiring in 8 years and new length of 4096 These certs will replace the current certs that expire soon - Update to version 4.1.0 (bsc#1217538) + Replace 162.222.182.90 and 35.187.193.56 (length 4096): rgnsrv-gce-asia-northeast1 -> 162.222.182.90 expires in 9 years rgnsrv-gce-us-central1 -> 35.187.193.56 expires in 10 years - Version 4.2.0 (jsc#PCT-361) + Add IPv6 certs to supprt access of the update infrastructure via IPv6 on GCE instances. - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - accept more signature subpackets marked as critical [bsc#1218686] * new patch: accept-crit-subpkt.diff - backport limit support for the autopatch macro [bsc#1189495] * new patch: autopatch.diff - implement subkey binding signature checking [bsc#1191175] * new patch: verifybindingsig.diff - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - accept more signature subpackets marked as critical [bsc#1218686] * new patch: accept-crit-subpkt.diff - backport limit support for the autopatch macro [bsc#1189495] * new patch: autopatch.diff - implement subkey binding signature checking [bsc#1191175] * new patch: verifybindingsig.diff - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - accept more signature subpackets marked as critical [bsc#1218686] * new patch: accept-crit-subpkt.diff - backport limit support for the autopatch macro [bsc#1189495] * new patch: autopatch.diff - implement subkey binding signature checking [bsc#1191175] * new patch: verifybindingsig.diff - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - turn on imaevm file signature support and move the imaevm code that needs the libimaevm library into a plugin. Put this plugin into a new "rpm-imaevmsign" subpackage. [jsc#PED-7246] * new patch: imaevmsignplugin.diff - backport signature reserved space handling from upstream * new patch: sigreserved.diff - accept more signature subpackets marked as critical [bsc#1218686] * new patch: accept-crit-subpkt.diff - backport limit support for the autopatch macro [bsc#1189495] * new patch: autopatch.diff - implement subkey binding signature checking [bsc#1191175] * new patch: verifybindingsig.diff - Do not map the index database read-write all the time [bnc#1168735] * new patch: ndb_backport2.diff - Add reproducible-debuginfo.patch to generate debuginfo in a reproducible way [bsc#1172173] - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - Do not map the index database read-write all the time [bnc#1168735] * new patch: ndb_backport2.diff - Add reproducible-debuginfo.patch to generate debuginfo in a reproducible way [bsc#1172173] - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - Do not map the index database read-write all the time [bnc#1168735] * new patch: ndb_backport2.diff - Add reproducible-debuginfo.patch to generate debuginfo in a reproducible way [bsc#1172173] - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - Do not map the index database read-write all the time [bnc#1168735] * new patch: ndb_backport2.diff - Add reproducible-debuginfo.patch to generate debuginfo in a reproducible way [bsc#1172173] - Backport support for compressed kernel modules (jsc#SLE-10886) * added patch: compressed-kernel-modules.diff * modified file: find-requires.ksyms * modified file: find-provides.ksyms - Fix obvious bugs in find-provides.ksyms * https://github.com/openSUSE/rpm-config-SUSE/pull/34 - Handle xz compressed kernels in find-provides.ksyms [bsc#1179251] * modified file: find-requires.ksyms - Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428] * new patch: touch_backport.diff - Backport read-only berkeley db support and enable it if we disable berkeley db [jsc#SLE-7272] * new patch: bdb_ro_backport.diff - Finish split of SUSE macros and some helpers into rpm-config-SUSE [jsc#SLE-17074] * new patch: findsupplements.diff * modified patches: fileattrs.diff, brp.diff, macrosin.diff, enable-postin-scripts-error.diff * dropped files: rpm-suse_macros * dropped patches: firmware.diff, initscriptsprov.diff, modalias-encode.diff, modalias.diff, compressed-kernel-modules.diff, findksyms.diff - Increase the maximum size of the signature header so that rpms containing file signatures can be queried [bsc#1181568] * new patch: sigheadersize.diff - Do not require the signature header to be in a contiguous region when signing [bnc#1181805] * new patch: signbadregion.diff - Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279] - update to rpm-4.14.3 [jsc#SLE-17817] * add support for enforcing signature policy and payload verification step to transactions * add :humansi and :hmaniec query formatters for human readable output * add query selectors –-whatobsoletes and –-whatconflicts * add support for sorting caret (‘^’) higher than base version - refreshed patches: * checksepwarn.diff * dbrointerruptable.diff * finddebuginfo.diff * ndb-backport.diff * pythondistdeps.diff * remove-brp-strips.diff * whatrequires-doc.diff - dropped patches: * debugedit-bnc1076819.diff * debugedit-riscv.patch * disttag-macro.diff * hardlinks.diff * reproducible-debuginfo.patch * rpm-4.14.1-initialize-verifyflags.diff * safesymlinks.diff * signbadregion.diff * verifynodup.diff - set default package verification level to 'none' to be compatible to rpm-4.14.1 new patch: verifylevel_none.diff - make illegal obsoletes a warning new patch: badobsoletewarn.diff - backport header check security fixes from upstream [CVE-2021-3421] [CVE-2021-20271] [CVE-2021-20266] [bsc#1183543] [bsc#1183545] new patch: headerchk3.diff - fix potential access of freed mem in ndb's glue code [bnc#1179416] new patch: ndbglue.diff - permit secondary index open to fail for bdb_ro new patch: bdbro_missingidx.diff - backport zstd detection fix [bsc#1187670] new patch: zstddetection.diff - backport ndb rofs support [bsc#1188548] new patch: ndbrofs.diff - backport pgp hardening changes from upstream [bsc#1185299] new patch: pgpharden.diff - fix deadlock when multiple rpm processes try tp acquire the database lock [bsc#1183659] new patch: deadlock.diff - Add explicit requirement on python-rpm-macros to avoid widespread breakage by package mistakenly ignoring their requirement of python-rpm-macros (bsc#1180125, bsc#1193711). - Backport header check changes so that old rpms get no longer rejected [bsc#1190824] updated patch: headerchk3.diff - Revert unwanted /usr/bin/python -> /usr/bin/python2 change we got with the update to 4.14.3 [bsc#1194968] new patch: no-python2.diff - Support Ed25519 signatures [jsc#SLE-24714] * new patch: ed25519.diff - Strip critical bit in signature subpackage parsing * modified patch: pgpharden.diff - Add workaround to make newer dnf versions no longer deadlock after it imported a pubkey [bnc#1202750] * new patch: keyimportdeadlock.diff - add pythondeps-python310.diff and add match-python-version-if-minor.diff: * fix missing python(abi) for 3.XX versions (bsc#1207294) - update pythondeps-python310.diff: replace with minimal fix to support python 3.xx (bsc#1207294) - backport lua support for rpm.execute to ease migrating [bnc#1216752] * new patch: luaexecute.diff - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - remove imaevmsign plugin from rpm-ndb [bsc#1222259] - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - Initial revision - update to rpm-4.14.3 - Try more in supporting all scenarios bsc#1046197#c24 * rsync-both-compressions.patch - Security fix [bsc#1066644, CVE-2017-16548] * Missing trailing '\0' character check could lead to remote DoS * Added rsync-CVE-2017-16548.patch - Fix: Stop file upload after errors [bsc#1062063] - Added patches: * rsync-send_error_to_sender.patch * rsync-avoid-uploading-after-error.patch - Security fix: Ignore --protect-args when already sent by client [bsc#1076503, CVE-2018-5764] * Added patch rsync-3.1.2-CVE-2018-5764.patch - Update to version 3.1.3 [bsc#1076503]: Protocol: 31 (unchanged) - SECURITY FIXES: * Fixed a buffer overrun in the protocol's handling of xattr names and ensure that the received name is null terminated. * Fix an issue with --protect-args where the user could specify the arg in the protected-arg list and short-circuit some of the arg-sanitizing code. - BUG FIXES: * Don't output about a new backup dir without appropriate info verbosity. * Fixed some issues with the sort functions in support/rsyncstats script. * Added a way to specify daemon config lists (e.g. users, groups, etc) * that contain spaces (see "auth users" in the latest rsyncd.conf manpage). * If a backup fails (e.g. full disk) rsync exits with an error. * Fixed a problem with a doubled --fuzzy option combined with --link-dest. * Avoid invalid output in the summary if either the start or end time had an error. * We don't allow a popt alias to affect the --daemon or --server options. * Fix daemon exclude code to disallow attribute changes in addition to disallowing transfers. * Don't force nanoseconds to match if a non-transferred, non-checksummed file only passed the quick-check w/o comparing nanosecods. - ENHANCEMENTS: * Added the ability for rsync to compare nanosecond times in its file-check comparisons, and added support nanosecond times on Mac OS X. * Added a short-option (-@) for --modify-window. * Added the --checksum-choice=NAME[,NAME] option to choose the checksum algorithms. * Added hashing of xattr names (with using -X) to improve the handling of files with large numbers of xattrs. * Added a way to filter xattr names using include/exclude/filter rules (see the --xattrs option in the manpage for details). * Added "daemon chroot|uid|gid" to the daemon config (in addition to the old chroot|uid|gid settings that affect the daemon's transfer process). * Added "syslog tag" to the daemon configuration. * Some manpage improvements. - DEVELOPER RELATED: * Tweak the "make" output when yodl isn't around to create the man pages. * Changed an obsolete autoconf compile macro. * Support newer yodl versions when converting man pages. - Dropped patches fixed upstream: * rsync-CVE-2017-16548.patch * rsync-3.1.2-CVE-2018-5764.patch - Refreshed patches: * rsync-send_error_to_sender.patch - Use %license instead of %doc [bsc#1082318] - Don't require systemd explicit, spec file can handle both cases correct and in containers we don't have systemd [bsc#1100786]. - Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562) - Fixed bug numbers in spec file - Remove SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld (which already provides a rsyncd service). - Updated to version 3.2.2 * Too many changes to list, see included NEWS.md file. - Add BR on pkgconfig(openssl), rsync now uses openssl for MD4/MD5 - Add BR on libzstd-devel and liblz4-devel to enable lz4 and zstd compression support. - Add BR on xxhash-devel to enable xxhash checksum support. - Refresh rsync-add_back_use_slp_directive.patch - Drop rsync-both-compressions.patch, rsync-send_error_to_sender.patch, rsync-avoid-uploading-after-error.patch, rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch: Fixed upstream. - Change BR on xxhash-devel to pkgconfig(libxxhash) and depend on xxhash >= 0.8.0 since this is needed for XXH3 - Use xxhash only on suse_version >= 1550 since xxhash 0.8.0 is not available elsewhere. - Add BR on c++_compiler needed for SIMD support - Add --enable-simd configure option on x86_64 - Updated to version 3.2.3 * Fixes a memory usage regression introduced in 3.2.2 * Too many changes to list, see included NEWS.md file. - acls.diff, time-limit.diff and xattrs.diff are now upstream. - Drop rsync-add_back_use_slp_directive.patch, included in upstream slp.diff - Security fix: [bsc#1176160, CVE-2020-14387] * rsync-ssl: Verify the hostname in the certificate when using openssl. - Add rsync-CVE-2020-14387.patch - Update to 3.2.3 in SLE-15-SP4 [jsc#SLE-21252] * Rebase rsync-no-libattr.patch - Security fix: [bsc#1201840, CVE-2022-29154] * arbitrary file write vulnerability via do_server_recv function * Added patch rsync-rsync-CVE-2022-29154.patch - Add support for --trust-sender parameter (patch by Jie Gong in bsc#1202970). (related to CVE-2022-29154, bsc#1201840) * Added patch rsync-CVE-2022-29154-trust-sender-1.patch * Added patch rsync-CVE-2022-29154-trust-sender-2.patch - Fix --delay-updates never updates after interruption [bsc#1204538] * Added patch rsync-fix-delay-updates-never-updates-after-interruption.patch - Security update, fix multiple vulnerabilities: * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links * CVE-2024-12088, bsc#1234104 - --safe-links Bypass * Added rsync-CVE-2024-12085.patch * Added rsync-CVE-2024-12086_01.patch * Added rsync-CVE-2024-12086_02.patch * Added rsync-CVE-2024-12086_03.patch * Added rsync-CVE-2024-12086_04.patch * Added rsync-CVE-2024-12087_01.patch * Added rsync-CVE-2024-12087_02.patch * Added rsync-CVE-2024-12088.patch * Added rsync-fix-compile-missing-my_alloc_ref.patch - Try more in supporting all scenarios bsc#1046197#c24 * rsync-both-compressions.patch - Security fix [bsc#1066644, CVE-2017-16548] * Missing trailing '\0' character check could lead to remote DoS * Added rsync-CVE-2017-16548.patch - Fix: Stop file upload after errors [bsc#1062063] - Added patches: * rsync-send_error_to_sender.patch * rsync-avoid-uploading-after-error.patch - Security fix: Ignore --protect-args when already sent by client [bsc#1076503, CVE-2018-5764] * Added patch rsync-3.1.2-CVE-2018-5764.patch - Update to version 3.1.3 [bsc#1076503]: Protocol: 31 (unchanged) - SECURITY FIXES: * Fixed a buffer overrun in the protocol's handling of xattr names and ensure that the received name is null terminated. * Fix an issue with --protect-args where the user could specify the arg in the protected-arg list and short-circuit some of the arg-sanitizing code. - BUG FIXES: * Don't output about a new backup dir without appropriate info verbosity. * Fixed some issues with the sort functions in support/rsyncstats script. * Added a way to specify daemon config lists (e.g. users, groups, etc) * that contain spaces (see "auth users" in the latest rsyncd.conf manpage). * If a backup fails (e.g. full disk) rsync exits with an error. * Fixed a problem with a doubled --fuzzy option combined with --link-dest. * Avoid invalid output in the summary if either the start or end time had an error. * We don't allow a popt alias to affect the --daemon or --server options. * Fix daemon exclude code to disallow attribute changes in addition to disallowing transfers. * Don't force nanoseconds to match if a non-transferred, non-checksummed file only passed the quick-check w/o comparing nanosecods. - ENHANCEMENTS: * Added the ability for rsync to compare nanosecond times in its file-check comparisons, and added support nanosecond times on Mac OS X. * Added a short-option (-@) for --modify-window. * Added the --checksum-choice=NAME[,NAME] option to choose the checksum algorithms. * Added hashing of xattr names (with using -X) to improve the handling of files with large numbers of xattrs. * Added a way to filter xattr names using include/exclude/filter rules (see the --xattrs option in the manpage for details). * Added "daemon chroot|uid|gid" to the daemon config (in addition to the old chroot|uid|gid settings that affect the daemon's transfer process). * Added "syslog tag" to the daemon configuration. * Some manpage improvements. - DEVELOPER RELATED: * Tweak the "make" output when yodl isn't around to create the man pages. * Changed an obsolete autoconf compile macro. * Support newer yodl versions when converting man pages. - Dropped patches fixed upstream: * rsync-CVE-2017-16548.patch * rsync-3.1.2-CVE-2018-5764.patch - Refreshed patches: * rsync-send_error_to_sender.patch - Use %license instead of %doc [bsc#1082318] - Don't require systemd explicit, spec file can handle both cases correct and in containers we don't have systemd [bsc#1100786]. - Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562) - Fixed bug numbers in spec file - Remove SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld (which already provides a rsyncd service). - Updated to version 3.2.2 * Too many changes to list, see included NEWS.md file. - Add BR on pkgconfig(openssl), rsync now uses openssl for MD4/MD5 - Add BR on libzstd-devel and liblz4-devel to enable lz4 and zstd compression support. - Add BR on xxhash-devel to enable xxhash checksum support. - Refresh rsync-add_back_use_slp_directive.patch - Drop rsync-both-compressions.patch, rsync-send_error_to_sender.patch, rsync-avoid-uploading-after-error.patch, rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch: Fixed upstream. - Change BR on xxhash-devel to pkgconfig(libxxhash) and depend on xxhash >= 0.8.0 since this is needed for XXH3 - Use xxhash only on suse_version >= 1550 since xxhash 0.8.0 is not available elsewhere. - Add BR on c++_compiler needed for SIMD support - Add --enable-simd configure option on x86_64 - Updated to version 3.2.3 * Fixes a memory usage regression introduced in 3.2.2 * Too many changes to list, see included NEWS.md file. - acls.diff, time-limit.diff and xattrs.diff are now upstream. - Drop rsync-add_back_use_slp_directive.patch, included in upstream slp.diff - Security fix: [bsc#1176160, CVE-2020-14387] * rsync-ssl: Verify the hostname in the certificate when using openssl. - Add rsync-CVE-2020-14387.patch - Update to 3.2.3 in SLE-15-SP4 [jsc#SLE-21252] * Rebase rsync-no-libattr.patch - Security fix: [bsc#1201840, CVE-2022-29154] * arbitrary file write vulnerability via do_server_recv function * Added patch rsync-rsync-CVE-2022-29154.patch - Add support for --trust-sender parameter (patch by Jie Gong in bsc#1202970). (related to CVE-2022-29154, bsc#1201840) * Added patch rsync-CVE-2022-29154-trust-sender-1.patch * Added patch rsync-CVE-2022-29154-trust-sender-2.patch - Fix --delay-updates never updates after interruption [bsc#1204538] * Added patch rsync-fix-delay-updates-never-updates-after-interruption.patch - Security update, fix multiple vulnerabilities: * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links * CVE-2024-12088, bsc#1234104 - --safe-links Bypass * Added rsync-CVE-2024-12085.patch * Added rsync-CVE-2024-12086_01.patch * Added rsync-CVE-2024-12086_02.patch * Added rsync-CVE-2024-12086_03.patch * Added rsync-CVE-2024-12086_04.patch * Added rsync-CVE-2024-12087_01.patch * Added rsync-CVE-2024-12087_02.patch * Added rsync-CVE-2024-12088.patch * Added rsync-fix-compile-missing-my_alloc_ref.patch - Try more in supporting all scenarios bsc#1046197#c24 * rsync-both-compressions.patch - Security fix [bsc#1066644, CVE-2017-16548] * Missing trailing '\0' character check could lead to remote DoS * Added rsync-CVE-2017-16548.patch - Fix: Stop file upload after errors [bsc#1062063] - Added patches: * rsync-send_error_to_sender.patch * rsync-avoid-uploading-after-error.patch - Security fix: Ignore --protect-args when already sent by client [bsc#1076503, CVE-2018-5764] * Added patch rsync-3.1.2-CVE-2018-5764.patch - Update to version 3.1.3 [bsc#1076503]: Protocol: 31 (unchanged) - SECURITY FIXES: * Fixed a buffer overrun in the protocol's handling of xattr names and ensure that the received name is null terminated. * Fix an issue with --protect-args where the user could specify the arg in the protected-arg list and short-circuit some of the arg-sanitizing code. - BUG FIXES: * Don't output about a new backup dir without appropriate info verbosity. * Fixed some issues with the sort functions in support/rsyncstats script. * Added a way to specify daemon config lists (e.g. users, groups, etc) * that contain spaces (see "auth users" in the latest rsyncd.conf manpage). * If a backup fails (e.g. full disk) rsync exits with an error. * Fixed a problem with a doubled --fuzzy option combined with --link-dest. * Avoid invalid output in the summary if either the start or end time had an error. * We don't allow a popt alias to affect the --daemon or --server options. * Fix daemon exclude code to disallow attribute changes in addition to disallowing transfers. * Don't force nanoseconds to match if a non-transferred, non-checksummed file only passed the quick-check w/o comparing nanosecods. - ENHANCEMENTS: * Added the ability for rsync to compare nanosecond times in its file-check comparisons, and added support nanosecond times on Mac OS X. * Added a short-option (-@) for --modify-window. * Added the --checksum-choice=NAME[,NAME] option to choose the checksum algorithms. * Added hashing of xattr names (with using -X) to improve the handling of files with large numbers of xattrs. * Added a way to filter xattr names using include/exclude/filter rules (see the --xattrs option in the manpage for details). * Added "daemon chroot|uid|gid" to the daemon config (in addition to the old chroot|uid|gid settings that affect the daemon's transfer process). * Added "syslog tag" to the daemon configuration. * Some manpage improvements. - DEVELOPER RELATED: * Tweak the "make" output when yodl isn't around to create the man pages. * Changed an obsolete autoconf compile macro. * Support newer yodl versions when converting man pages. - Dropped patches fixed upstream: * rsync-CVE-2017-16548.patch * rsync-3.1.2-CVE-2018-5764.patch - Refreshed patches: * rsync-send_error_to_sender.patch - Use %license instead of %doc [bsc#1082318] - Don't require systemd explicit, spec file can handle both cases correct and in containers we don't have systemd [bsc#1100786]. - Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562) - Fixed bug numbers in spec file - Remove SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld (which already provides a rsyncd service). - Updated to version 3.2.2 * Too many changes to list, see included NEWS.md file. - Add BR on pkgconfig(openssl), rsync now uses openssl for MD4/MD5 - Add BR on libzstd-devel and liblz4-devel to enable lz4 and zstd compression support. - Add BR on xxhash-devel to enable xxhash checksum support. - Refresh rsync-add_back_use_slp_directive.patch - Drop rsync-both-compressions.patch, rsync-send_error_to_sender.patch, rsync-avoid-uploading-after-error.patch, rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch: Fixed upstream. - Change BR on xxhash-devel to pkgconfig(libxxhash) and depend on xxhash >= 0.8.0 since this is needed for XXH3 - Use xxhash only on suse_version >= 1550 since xxhash 0.8.0 is not available elsewhere. - Add BR on c++_compiler needed for SIMD support - Add --enable-simd configure option on x86_64 - Updated to version 3.2.3 * Fixes a memory usage regression introduced in 3.2.2 * Too many changes to list, see included NEWS.md file. - acls.diff, time-limit.diff and xattrs.diff are now upstream. - Drop rsync-add_back_use_slp_directive.patch, included in upstream slp.diff - Security fix: [bsc#1176160, CVE-2020-14387] * rsync-ssl: Verify the hostname in the certificate when using openssl. - Add rsync-CVE-2020-14387.patch - Update to 3.2.3 in SLE-15-SP4 [jsc#SLE-21252] * Rebase rsync-no-libattr.patch - Security fix: [bsc#1201840, CVE-2022-29154] * arbitrary file write vulnerability via do_server_recv function * Added patch rsync-rsync-CVE-2022-29154.patch - Add support for --trust-sender parameter (patch by Jie Gong in bsc#1202970). (related to CVE-2022-29154, bsc#1201840) * Added patch rsync-CVE-2022-29154-trust-sender-1.patch * Added patch rsync-CVE-2022-29154-trust-sender-2.patch - Fix --delay-updates never updates after interruption [bsc#1204538] * Added patch rsync-fix-delay-updates-never-updates-after-interruption.patch - Security update, fix multiple vulnerabilities: * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links * CVE-2024-12088, bsc#1234104 - --safe-links Bypass * Added rsync-CVE-2024-12085.patch * Added rsync-CVE-2024-12086_01.patch * Added rsync-CVE-2024-12086_02.patch * Added rsync-CVE-2024-12086_03.patch * Added rsync-CVE-2024-12086_04.patch * Added rsync-CVE-2024-12087_01.patch * Added rsync-CVE-2024-12087_02.patch * Added rsync-CVE-2024-12088.patch * Added rsync-fix-compile-missing-my_alloc_ref.patch - Try more in supporting all scenarios bsc#1046197#c24 * rsync-both-compressions.patch - Security fix [bsc#1066644, CVE-2017-16548] * Missing trailing '\0' character check could lead to remote DoS * Added rsync-CVE-2017-16548.patch - Fix: Stop file upload after errors [bsc#1062063] - Added patches: * rsync-send_error_to_sender.patch * rsync-avoid-uploading-after-error.patch - Security fix: Ignore --protect-args when already sent by client [bsc#1076503, CVE-2018-5764] * Added patch rsync-3.1.2-CVE-2018-5764.patch - Update to version 3.1.3 [bsc#1076503]: Protocol: 31 (unchanged) - SECURITY FIXES: * Fixed a buffer overrun in the protocol's handling of xattr names and ensure that the received name is null terminated. * Fix an issue with --protect-args where the user could specify the arg in the protected-arg list and short-circuit some of the arg-sanitizing code. - BUG FIXES: * Don't output about a new backup dir without appropriate info verbosity. * Fixed some issues with the sort functions in support/rsyncstats script. * Added a way to specify daemon config lists (e.g. users, groups, etc) * that contain spaces (see "auth users" in the latest rsyncd.conf manpage). * If a backup fails (e.g. full disk) rsync exits with an error. * Fixed a problem with a doubled --fuzzy option combined with --link-dest. * Avoid invalid output in the summary if either the start or end time had an error. * We don't allow a popt alias to affect the --daemon or --server options. * Fix daemon exclude code to disallow attribute changes in addition to disallowing transfers. * Don't force nanoseconds to match if a non-transferred, non-checksummed file only passed the quick-check w/o comparing nanosecods. - ENHANCEMENTS: * Added the ability for rsync to compare nanosecond times in its file-check comparisons, and added support nanosecond times on Mac OS X. * Added a short-option (-@) for --modify-window. * Added the --checksum-choice=NAME[,NAME] option to choose the checksum algorithms. * Added hashing of xattr names (with using -X) to improve the handling of files with large numbers of xattrs. * Added a way to filter xattr names using include/exclude/filter rules (see the --xattrs option in the manpage for details). * Added "daemon chroot|uid|gid" to the daemon config (in addition to the old chroot|uid|gid settings that affect the daemon's transfer process). * Added "syslog tag" to the daemon configuration. * Some manpage improvements. - DEVELOPER RELATED: * Tweak the "make" output when yodl isn't around to create the man pages. * Changed an obsolete autoconf compile macro. * Support newer yodl versions when converting man pages. - Dropped patches fixed upstream: * rsync-CVE-2017-16548.patch * rsync-3.1.2-CVE-2018-5764.patch - Refreshed patches: * rsync-send_error_to_sender.patch - Use %license instead of %doc [bsc#1082318] - Don't require systemd explicit, spec file can handle both cases correct and in containers we don't have systemd [bsc#1100786]. - Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562) - Fixed bug numbers in spec file - Remove SuSEfirewall2 service since SuSEfirewall2 has been replaced by firewalld (which already provides a rsyncd service). - Updated to version 3.2.2 * Too many changes to list, see included NEWS.md file. - Add BR on pkgconfig(openssl), rsync now uses openssl for MD4/MD5 - Add BR on libzstd-devel and liblz4-devel to enable lz4 and zstd compression support. - Add BR on xxhash-devel to enable xxhash checksum support. - Refresh rsync-add_back_use_slp_directive.patch - Drop rsync-both-compressions.patch, rsync-send_error_to_sender.patch, rsync-avoid-uploading-after-error.patch, rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch: Fixed upstream. - Change BR on xxhash-devel to pkgconfig(libxxhash) and depend on xxhash >= 0.8.0 since this is needed for XXH3 - Use xxhash only on suse_version >= 1550 since xxhash 0.8.0 is not available elsewhere. - Add BR on c++_compiler needed for SIMD support - Add --enable-simd configure option on x86_64 - Updated to version 3.2.3 * Fixes a memory usage regression introduced in 3.2.2 * Too many changes to list, see included NEWS.md file. - acls.diff, time-limit.diff and xattrs.diff are now upstream. - Drop rsync-add_back_use_slp_directive.patch, included in upstream slp.diff - Security fix: [bsc#1176160, CVE-2020-14387] * rsync-ssl: Verify the hostname in the certificate when using openssl. - Add rsync-CVE-2020-14387.patch - Update to 3.2.3 in SLE-15-SP4 [jsc#SLE-21252] * Rebase rsync-no-libattr.patch - Security fix: [bsc#1201840, CVE-2022-29154] * arbitrary file write vulnerability via do_server_recv function * Added patch rsync-rsync-CVE-2022-29154.patch - Add support for --trust-sender parameter (patch by Jie Gong in bsc#1202970). (related to CVE-2022-29154, bsc#1201840) * Added patch rsync-CVE-2022-29154-trust-sender-1.patch * Added patch rsync-CVE-2022-29154-trust-sender-2.patch - Fix --delay-updates never updates after interruption [bsc#1204538] * Added patch rsync-fix-delay-updates-never-updates-after-interruption.patch - Security update, fix multiple vulnerabilities: * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links * CVE-2024-12088, bsc#1234104 - --safe-links Bypass * Added rsync-CVE-2024-12085.patch * Added rsync-CVE-2024-12086_01.patch * Added rsync-CVE-2024-12086_02.patch * Added rsync-CVE-2024-12086_03.patch * Added rsync-CVE-2024-12086_04.patch * Added rsync-CVE-2024-12087_01.patch * Added rsync-CVE-2024-12087_02.patch * Added rsync-CVE-2024-12088.patch * Added rsync-fix-compile-missing-my_alloc_ref.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by system getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by system getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by system getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by system getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.13>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by systemd getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.14. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.14>. Includes the patch for CVE-2024-45310. bsc#1230092 - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.13>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by systemd getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.14. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.14>. Includes the patch for CVE-2024-45310. bsc#1230092 - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.13>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by systemd getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.14. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.14>. Includes the patch for CVE-2024-45310. bsc#1230092 - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.1.10. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.10>. - Update to runc v1.1.11. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.11>. [ This was only ever released for SLES. ] - Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894 <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> + CVE-2024-21626.patch - Update to runc v1.1.12. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894 * This release fixes a container breakout vulnerability (CVE-2024-21626). For more details, see the upstream security advisory: <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv> * Remove upstreamed patches: - CVE-2024-21626.patch * Update runc.keyring to match upstream changes. - Add upstream patch <https://github.com/opencontainers/runc/pull/4219> to properly fix -ENOSYS stub on ppc64le. bsc#1192051 bsc#1221050 + 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch + 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch + 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.13. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.13>. - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a performance issue when running lots of containers, caused by systemd getting too many mount notifications. bsc#1214960 + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch [ This was only ever released for SLES and Leap. ] - Update to runc v1.1.14. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.14>. Includes the patch for CVE-2024-45310. bsc#1230092 - Rebase patches: * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch - Backport patch to fix build on SLE-12 ppc64le. + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Backport patch to fix build on SLE-12 ppc64le. + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Backport patch to fix build on SLE-12 ppc64le. + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Backport patch to fix build on SLE-12 ppc64le. + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Update to runc v1.0.0~rc94. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94 Breaking Changes: * cgroupv1: kernel memory limits are now always ignored, as kmemcg has been effectively deprecated by the kernel. Users should make use of regular memory cgroup controls. Regression Fixes: * seccomp: fix 32-bit compilation errors * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code * runc start: fix "chdir to cwd: permission denied" for some setups - Remove upstreamed patches: - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch - Update to runc v1.0.0~rc95. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95 This release of runc contains a fix for CVE-2021-30465, and users are strongly recommended to update (especially if you are providing semi-limited access to spawn containers to untrusted users). bsc#1185405 - Update to runc v1.0.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.0 ! The usage of relative paths for mountpoints will now produce a warning (such configurations are outside of the spec, and in future runc will produce an error when given such configurations). * cgroupv2: devices: rework the filter generation to produce consistent results with cgroupv1, and always clobber any existing eBPF program(s) to fix runc update and avoid leaking eBPF programs (resulting in errors when managing containers). * cgroupv2: correctly convert "number of IOs" statistics in a cgroupv1-compatible way. * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures. * cgroupv2: wait for freeze to finish before returning from the freezing code, optimize the method for checking whether a cgroup is frozen. * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94 * cgroups/systemd: fixed returning "unit already exists" error from a systemd cgroup manager (regression in rc94) + cgroupv2: support SkipDevices with systemd driver + cgroup/systemd: return, not ignore, stop unit error from Destroy + Make "runc --version" output sane even when built with go get or otherwise outside of our build scripts. + cgroups: set SkipDevices during runc update (so we don't modify cgroups at all during runc update). + cgroup1: blkio: support BFQ weights. + cgroupv2: set per-device io weights if BFQ IO scheduler is available. - Backport <https://github.com/opencontainers/runc/pull/3055> to fix issues with runc under openSUSE MicroOS's SELinux policy. boo#1187704 + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.1 * Fixed occasional runc exec/run failure ("interrupted system call") on an Azure volume. * Fixed "unable to find groups ... token too long" error with /etc/group containing lines longer than 64K characters. * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is frozen. This is a regression in 1.0.0, not affecting runc itself but some of libcontainer users (e.g Kubernetes). * cgroupv2: bpf: Ignore inaccessible existing programs in case of permission error when handling replacement of existing bpf cgroup programs. This fixes a regression in 1.0.0, where some SELinux policies would block runc from being able to run entirely. * cgroup/systemd/v2: don't freeze cgroup on Set. * cgroup/systemd/v1: avoid unnecessary freeze on Set. - Remove upstreamed patches: + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch - Update to runc v1.0.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.2 * Fixed a failure to set CPU quota period in some cases on cgroup v1. * Fixed the inability to start a container with the "adding seccomp filter rule for syscall ..." error, caused by redundant seccomp rules (i.e. those that has action equal to the default one). Such redundant rules are now skipped. * Made release builds reproducible from now on. * Fixed a rare debug log race in runc init, which can result in occasional harmful "failed to decode ..." errors from runc run or exec. * Fixed the check in cgroup v1 systemd manager if a container needs to be frozen before Set, and add a setting to skip such freeze unconditionally. The previous fix for that issue, done in runc 1.0.1, was not working. - Update to runc v1.0.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784 bsc#1193436 * A potential vulnerability was discovered in runc (related to an internal usage of netlink), however upon further investigation we discovered that while this bug was exploitable on the master branch of runc, no released version of runc could be exploited using this bug. The exploit required being able to create a netlink attribute with a length that would overflow a uint16 but this was not possible in any released version of runc. For more information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784. Due to an abundance of caution we decided to do an emergency release with this fix, but to reiterate we do not believe this vulnerability was possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for discovering and reporting this vulnerability so quickly. * Fixed inability to start a container with read-write bind mount of a read-only fuse host mount. * Fixed inability to start when read-only /dev in set in spec. * Fixed not removing sub-cgroups upon container delete, when rootless cgroup v2 is used with older systemd. * Fixed returning error from GetStats when hugetlb is unsupported (which causes excessive logging for kubernetes). - Update to runc v1.1.0~rc1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1. + Add support for RDMA cgroup added in Linux 4.11. * runc exec now produces exit code of 255 when the exec failed. This may help in distinguishing between runc exec failures (such as invalid options, non-running container or non-existent binary etc.) and failures of the command being executed. + runc run: new --keep option to skip removal exited containers artefacts. This might be useful to check the state (e.g. of cgroup controllers) after the container hasexited. + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD (the latter is just an alias for SCMP_ACT_KILL). + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows users to create sophisticated seccomp filters where syscalls can be efficiently emulated by privileged processes on the host. + checkpoint/restore: add an option (--lsm-mount-context) to set a different LSM mount context on restore. + intelrdt: support ClosID parameter. + runc exec --cgroup: an option to specify a (non-top) in-container cgroup to use for the process being executed. + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1 machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc run/exec now adds the container to the appropriate cgroup under it). + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s behaviour. + mounts: add support for bind-mounts which are inaccessible after switching the user namespace. Note that this does not permit the container any additional access to the host filesystem, it simply allows containers to have bind-mounts configured for paths the user can access but have restrictive access control settings for other users. + Add support for recursive mount attributes using mount_setattr(2). These have the same names as the proposed mount(8) options -- just prepend r to the option name (such as rro). + Add runc features subcommand to allow runc users to detect what features runc has been built with. This includes critical information such as supported mount flags, hook names, and so on. Note that the output of this command is subject to change and will not be considered stable until runc 1.2 at the earliest. The runtime-spec specification for this feature is being developed in opencontainers/runtime-spec#1130. * system: improve performance of /proc/$pid/stat parsing. * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change the ownership of certain cgroup control files (as per /sys/kernel/cgroup/delegate) to allow for proper deferral to the container process. * runc checkpoint/restore: fixed for containers with an external bind mount which destination is a symlink. * cgroup: improve openat2 handling for cgroup directory handle hardening. runc delete -f now succeeds (rather than timing out) on a paused container. * runc run/start/exec now refuses a frozen cgroup (paused container in case of exec). Users can disable this using --ignore-paused. - Update version data embedded in binary to correctly include the git commit of the release. - Drop runc-rpmlintrc because we don't have runc-test anymore. - Update to runc v1.1.0. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0. - libcontainer will now refuse to build without the nsenter package being correctly compiled (specifically this requires CGO to be enabled). This should avoid folks accidentally creating broken runc binaries (and incorrectly importing our internal libraries into their projects). (#3331) - Update to runc v1.1.1. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1. * runc run/start can now run a container with read-only /dev in OCI spec, rather than error out. (#3355) * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403) libcontainer systemd v2 manager no longer errors out if one of the files listed in /sys/kernel/cgroup/delegate do not exist in container's cgroup. (#3387, #3404) * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported" error. (#3406) * libcontainer/cgroups no longer panics in cgroup v1 managers if stat of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435) - Update to runc v1.1.2. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2. CVE-2022-29162 bsc#1199460 * A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and CVE-2022-29162. bsc#1199460 * `runc spec` no longer sets any inheritable capabilities in the created example OCI spec (`config.json`) file. - Add ExcludeArch for s390 (not s390x) since we've never supported it. - Backport <https://github.com/opencontainers/runc/pull/3474> to fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565 + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.3. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3. (Includes a fix for bsc#1200088.) * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on s390 and s390x. This solves the issue where syscalls the host kernel did not support would return `-EPERM` despite the existence of the `-ENOSYS` stub code (this was due to how s390x does syscall multiplexing). * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as intended; this fix does not affect runc binary itself but is important for libcontainer users such as Kubernetes. * Inability to compile with recent clang due to an issue with duplicate constants in libseccomp-golang. * When using systemd cgroup driver, skip adding device paths that don't exist, to stop systemd from emitting warnings about those paths. * Socket activation was failing when more than 3 sockets were used. * Various CI fixes. * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container. * runc static binaries are now linked against libseccomp v2.5.4. - Remove upstreamed patches: - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch - Update to runc v1.1.4. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.4. bsc#1202021 * Fix mounting via wrong proc fd. When the user and mount namespaces are used, and the bind mount is followed by the cgroup mount in the spec, the cgroup was mounted using the bind mount's mount fd. * Switch kill() in libcontainer/nsenter to sane_kill(). * Fix "permission denied" error from runc run on noexec fs. * Fix failed exec after systemctl daemon-reload. Due to a regression in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded. (boo#1202821) - Update to runc v1.1.5. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.5>. Includes fixes for the following CVEs: - CVE-2023-25809 bsc#1209884 - CVE-2023-27561 bsc#1208962 - CVE-2023-28642 bsc#1209888 * Fix the inability to use `/dev/null` when inside a container. bsc#1168481 * Fix changing the ownership of host's `/dev/null` caused by fd redirection (a regression in 1.1.1). bsc#1207004 * Fix rare runc exec/enter unshare error on older kernels. * nsexec: Check for errors in `write_log()`. - Drop version-specific Go requirement. - Update to runc v1.1.6. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.6>. - Update to runc v1.1.7. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.7>. - Update runc.keyring to upstream version. - Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. - Update to runc v1.1.9. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.9>. - Updated read_values.c for z16 machine type (bsc#1206832) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Updated read_values.c for z16 machine type (bsc#1206832) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Updated read_values.c for z16 machine type (bsc#1206832) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Updated read_values.c for z16 machine type (bsc#1206832) * Added the IBM LinuxONE Emperor 4 machine type * Updated the z16 machine type to IBM z16 A01 - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Added patch (bsc#1207947) * s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied a patch (bsc#1231003) * ziomon/ziorep_config: fix warning when multipath device is not there * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-warning-when-multipath-devi.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied a patch (bsc#1231003) * ziomon/ziorep_config: fix warning when multipath device is not there * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-warning-when-multipath-devi.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied a patch (bsc#1231003) * ziomon/ziorep_config: fix warning when multipath device is not there * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-warning-when-multipath-devi.patch - Implemented read_values -u. The result of -u is a unique identifier composed of: * Machine Serial Number. * LPAR Name. * VM Name (can be optional). - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied the following patches (bsc#1208527, bsc#1206173) * s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch * s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch * s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch * s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch * s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch * s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch * s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch * s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch * s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch * s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch * s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch * s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch * s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch * s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Updated cputype (bsc#1208983) * Changed the script to avoid "/usr/bin/cputype: line xx: nnnn: command not found", when machine type was found more than once in the /proc/cpuinfo. - Applied a patch (bsc#1209196) * s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch - Allow activation of devices at boot via kernel command line for live installation media (jsc#PED-2975) * Added a Source dracut-zdev-live-20230321.tar * Updated the .spec file for the new Source - Amended read_value.c - Tailored the .spec, added a patch * s390-tools-ALP-zdev-live.patch - Applies a fix, splitting of rd.zdev-parameters, in * s390-tools-ALP-zdev-live.patch - Applied patches for ziomon: fix for SCSI devices of type disk without block dev (bsc#1211008) * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch * s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch - Applies patches (bsc#1213377, bsc#1213852, bsc#1214114) * s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch * s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch - Applied a patch (jsc#PED-6539, jsc#PED-6373) * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated read_values.c (bsc#1214466, bsc#1214534) * Update read_values.c to support the new IBM z Processors - Updated SUSE's tools and their corresponding man pages (bsc#1216257) * ctc_configure * dasd_configure.opensuse * dasd_configure.8 * dasd_configure.suse * mkdump.pl.opensuse * mkdump.pl.suse * qeth_configure * qeth_configure.8 * zfcp_disk_configure * zfcp_disk_configure.8 * zfcp_host_configure.8 * zfcp_host_configure - Updated cputype script * Amended cputype to support the new IBM z Processors * Upgrade 390-tools from version 2.25.0 to version v2.29.0 (Latest) * * * * - General: - s390-tools now supports tools written in Rust. - Add compdb Makefile target to create 'compile_commands.json' to support LSP - backends in IDEs and editors - Add new tools / libraries: * rust/pv: Library for pv tools written in rust * rust/pvsecret: Tool to manage UV-secrets * Changes of existing tools: - dbginfo.sh: Global IFS variable - genprotimg: Add support for add-secret requests - genprotimg: Build debuginfo files for bootloader - hyptop: Add real SMT utilization field - hyptop: Allow users to set speedup factor - pvattest: Add yaml-output for verify command - zipl: Build debuginfo files for bootloader * Bug Fixes: - dump2tar: Fix truncated paths - zdev/dracut: fix kdump build to integrate with site support * * * * * v2.28.0 - Changes of existing tools: - chzcrypt: Support for SE AP pass-through support - genprotimg: Add support for non-s390x architectures - lszcrypt: Support for SE AP pass-through support - zdev: Add support for autoquiesce related sysfs attributes * Bug Fixes: - ap_tools/ap-check: Handle missing 'matrix' and 'control_domains' attrs - ap_tools/ap-check: Hold ap config file lock over get attributes - s390-tools: Fix build for ppc64le - zdev: Add missing label in the udev-rules - zdev: Add proper value input for the ZDEV_SITE_ID key - zdev: Use rename-file to avoid any symlinks created - zipl/dump: fix ngdump dracut helper script * * * * * v2.27.0 * Changes of existing tools: - s390-tools cross-compile and non-s390x support: - pkg-config is now mandatory for the build process - Add PKG_CONFIG Makefile variable to select pkg-config program; - default pkg-config or $(CROSS_COMPILE)pkg-config if - CROSS_COMPILE is set - Rename Makefile variable ARCH to HOST_ARCH. HOST_ARCH is the architecture that will run the produced (executable) objects - Add the Makefile variable BUILD_ARCH. BUILD_ARCH is the architecture of the build system. For each Makefile variable like CC, LINK, CPP, ... there is a suffixed version of it - e.g. CC_FOR_BUILD. This is useful for cross compiling, and this naming convention is very similar to the Meson convention (see https://mesonbuild.com/Reference-tables.html#environment-variables-per-machine). - Limit build targets for non-s390x architectures (pvattest) - dasdfmt: Fall back to full format if space release fails - dbginfo.sh: Add nstat for network and SNMP stats - dbginfo.sh: Rework crypto data collection - hyptop: Show thread util by default - zipl: Add support for list-directed IPL dump from ECKD DASD * Bug Fixes: - lszcrypt: Fix argument parsing - zdev/dracut: Fix out-of-memory (OOM) situations in the kdump crashkernel environment - ziomon/ziorep_config: Fix for SCSI devices of type disk without block dev - pvextract-hdr: Fix parsing issues on little-endian systems * * * * * v2.26.0 * Remove tools / libraries: - Remove vmconvert and libvmdump in favor of vmdump file support in zdump * Changes of existing tools: - ipl_tools: Add support for list-directed IPL from ECKD DASD - lszcrypt: Display hardware filtering support capability - vmur: Remove option -c for dump file conversion (See zdump changes) - zdev: Add zfcp ber_stop parameter handling - zdump: Add vmdump dfi for vmdump format to elf format - zkey: Support EP11 host library version * Bug Fixes: - zipl: Move dump parmline processing and verification - zipl/genprotimg: Various build improvements * * * * * Removed obsolete IBM patches - s390-tools-sles15sp5-zipl-boot-disable-Warray-bounds-for-now.patch - s390-tools-sles15sp5-zkey-Support-EP11-host-library-version-4.patch * Removed obsolete patches for bug 1208527, and bug 1206173 - s390-tools-sles15sp5-01-zipl-boot-discard-.eh_frame-and-.interp-input-sectio.patch - s390-tools-sles15sp5-02-zipl-boot-declare-that-no-executable-stack-is-requir.patch - s390-tools-sles15sp5-03-zipl-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-04-zipl-boot-disable-build-id.patch - s390-tools-sles15sp5-05-zipl-boot-simplify-objcopy-commands.patch - s390-tools-sles15sp5-06-zipl-move-STAGE2_MAX_SIZE-and-STAGE1B_LOAD_ADDR-to-l.patch - s390-tools-sles15sp5-07-zipl-boot-use-linker-scripts-for-all-bootloaders.patch - s390-tools-sles15sp5-08-genprotimg-boot-declare-that-no-executable-stack-is-.patch - s390-tools-sles15sp5-09-genprotimg-boot-use-no-warn-rwx-segments-linker-flag.patch - s390-tools-sles15sp5-10-genprotimg-boot-disable-build-id.patch - s390-tools-sles15sp5-11-genprotimg-boot-Makefile-simplify-objcopy-command.patch - s390-tools-sles15sp5-12-genprotimg-boot-improve-linker-scripts.patch - s390-tools-sles15sp5-13-genprotimg-boot-stage3b-add-size-check-to-the-linker.patch - s390-tools-sles15sp5-14-genprotimg-boot-stage3b_reloc.bin-add-linker-script.patch - s390-tools-sles15sp5-15-zipl-Embed-loader-data-directly-into-boot-object.patch * Removed obsolete patch for bug 1209196 - s390-tools-sles15sp5-lszcrypt-use-separate-index-for-inner-sub-device-loo.patch * Removed obsolete patches for bug 1211008 - s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-missing-SG-major-minor-for-.patch - s390-tools-sles15sp5-02-ziomon-ziorep_config-fix-for-SCSI-devices-of-type-di.patch * Removed obsolete patch for bug 1213377 - s390-tools-sles15sp5-01-zdev-add-missing-label-in-the-udev-rules.patch * Removed obsolete patches for bug 1213852 - s390-tools-sles15sp5-01-zdev-add-proper-value-input-for-the-ZDEV_SITE_ID-key.patch - s390-tools-sles15sp5-02-zdev-use-rename-file-to-avoid-any-symlinks-created.patch * Removed obsolete patch for bug 1214114 - s390-tools-sles15sp5-dasdfmt-Fall-back-to-full-format-if-space-release-fa.patch * Removed obsolete patch - s390-tools-sles15sp5-fix-chown-commands-syntax.patch - Fixed a logic error in read_values.c - Provide s390-tools on x86_64 to enable Secure Execution in the Cloud (jsc#PED-578, jsc#PED-7136, and jsc#PED-7138) * Selected tools from the s390-tools package need to be made available on x86_64. This will enable the integration of IBM Z machines running Secure Execution in a cloud environment where users don't necessarily need to have an s390x environment. - genprotimg - (for building secure images) - pvsecret - - pvattest - (for external attestation) - pvextract-hdr - - Upgrade s390-tools to version 2.30 (jsc#PED-5783, jsc#PED-6785, jsc#PED-7136, jsc#PED-6539, jsc#PED-4604, jsc#PED-6649, jsc#PED-7138 ) - Add new tools / libraries: * lspai: Tool to display PAI counter sets * s390-tools: Provide a ShellCheck configuration - Changes of existing tools / libraries: * cpumf/pai: Add command line option for realtime scheduling * dbginfo.sh: enhance ethtool collection for ROCE * libutil/util_lockfile: add routine to return owning pid of file lock * lszcrypt: Improve lszcrypt output on SE guests * rust: Use a single workspace for all rust tools * zdev: limit the derivation of ZDEV_SITE_ID * zdump/df_s390: Update 'zgetdump -i' output with zlib info * zdump/dfi_s390: Support reading compressed s390_ext dumps * zipl/boot: Integrate zlib compression to single volume DASD dumper * zipl/boot: compile the bootloaders only if HOST_ARCH is s390x * zipl: Add --no-compress option to zipl command * zkey: Also check for deconfigured and check-stopped cards - Bug Fixes: * ap_tools/ap-check: handle get-attributes between pre and post event * libutil: fix util_file_read_*() using wrong format specifiers * rust/pv: fix Invalid write of size - Amended the SUSE patches for version 2.30 - Revendored vendor.tar.gz - Removed an obsolete patch * s390-tools-sles15sp6-zkey-Support-EP11-AES-keys-with-prepended-header-to-.patch - Updated the .spec file to use gcc13 (bsc#1217838) - Amended read_values for '-S' option (bsc#1217923) - Updated the .spec file * Explicitly specified 'ExclusiveArch: s390x x86_64' - Updated read_values.c (bsc#1219227) - Applied patches to implement new IBM host-key subject locality (bsc#1222414) * s390-tools-sles15sp5-01-genprotimg-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-02-libpv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-03-pvattest-Fix-root-ca-parsing.patch - Amended read_values.c (bsc#1226609) * Added print for 'qc_type_name', amended the layers - Upgrade s390-tools to version 2.31 (jsc#PED-7139) - General: * common.mak: Set default C/C++ standard to gnu11/gnu++11 - Add new tools / libraries: * pvapconfig: Tool to automatically configure APQNs in SE KVM guests * s390-tools: Provide pre-commit configuration - Changes of existing tools: * cpuplugd: Adjust to CPU 0 being no longer hotpluggable * dbginfo.sh: Check for Dynamic Partition Mode * dbginfo.sh: Update man page and copyright * rust/pv: Add user-data signing and verifying * rust/pvsecret: Add user defined signatures and verifications * zdev/dracut: Consolidate device configuration - Bug Fixes: * dbginfo.sh: Fix relative path on script copy * libkmipclient: Fix build with libxml2-2.12.0 * pvsecret: Fix panic if empty file is used as host key document * rust/pv: Fix 'elided_lifetimes_in_associated_constant' warning - Provide groups as required by RPM 4.19 - Amended the .spec file for x86_64 - Updated the .spec file to enable Secure Execution in the Cloud (bsc#1222675) - BuildRequires: qclib-devel-static >= 2.4.1 (bsc#1227365) - Applied additional patches * s390-tools-sles15sp5-01-rust-pv-support-Armonk-in-IBM-signing-key-subject.patch * s390-tools-sles15sp5-genprotimg-makefile.patch * s390-tools-sles15sp5-kdump-initrd-59-zfcp-compat-rules.patch - Applied an updated patch * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied patches to fix zdump (bsc#1229944, bsc#1229945) * s390-tools-sles15sp5-01-zdump-Fix-zgetdump-i-ioctl-error-on-s390-formatted-d.patch * s390-tools-sles15sp5-02-zdump-dfi_s390-Adjust-device-type-check-for-s390_ext.patch * s390-tools-sles15sp5-03-zdump-dfi_s390-Get-rid-of-device-type-check-for-s390.patch - Removed unnecessary patch, it is only needed for SLFO (for now) * s390-tools-sles15sp5-01-parse-ipl-device-for-activation.patch - Applied a patch (bsc#1231003) * ziomon/ziorep_config: fix warning when multipath device is not there * s390-tools-sles15sp5-01-ziomon-ziorep_config-fix-warning-when-multipath-devi.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Fix regression preventing bootstrapping new clients caused by redundant dependency on psutil (bsc#1197533) - Prevent data pollution between actions proceesed at the same time (bsc#1197637) - Added: * fix-regression-with-depending-client.ssh-on-psutil-b.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch - Fixes for Python 3.10 - Added: * fixes-for-python-3.10-502.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Make sure SaltCacheLoader use correct fileclient (bsc#1199149) - Added: * make-sure-saltcacheloader-use-correct-fileclient-519.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) - Added: * fix-for-cve-2022-22967-bsc-1200566.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja >= and <= 3.1.0 (bsc#1198744) - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Make Salt 3004 compatible with pyzmq >= 23.0.0 (bsc#1201082) - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Fix ownership of salt thin directory when using the Salt Bundle - Set default target for pip from VENV_PIP_TARGET environment variable - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Save log to logfile with docker.build - Use Salt Bundle in dockermod - Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288) - Added: * fix-ownership-of-salt-thin-directory-when-using-the-.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * save-log-to-logfile-with-docker.build.patch * add-support-for-gpgautoimport-539.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * normalize-package-names-once-with-pkg.installed-remo.patch * use-salt-bundle-in-dockermod.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Handle non-UTF-8 bytes in core grains generation (bsc#1202165) - Fix Syndic authentication errors (bsc#1199562) - Add Amazon EC2 detection for virtual grains (bsc#1195624) - Fix the regression in schedule module releasded in 3004 (bsc#1202631) - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Fix test_ipc unit test - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * fix-test_ipc-unit-tests.patch * backport-syndic-auth-fixes.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Pass the context to pillar ext modules - Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685) - Detect module run syntax version - Implement automated patches alignment for the Salt Bundle - Ignore extend declarations from excluded SLS files (bsc#1203886) - Clarify pkg.installed pkg_verify documentation - Enhance capture of error messages for Zypper calls in zypperpkg module - Make pass renderer configurable and fix detected issues - Workaround fopen line buffering for binary mode (bsc#1203834) - Added: * detect-module.run-syntax.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * make-pass-renderer-configurable-other-fixes-532.patch * clarify-pkg.installed-pkg_verify-documentation.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * pass-the-context-to-pillar-ext-modules.patch * ignore-extend-declarations-from-excluded-sls-files.patch * include-stdout-in-error-message-for-zypperpkg-559.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Control the collection of lvm grains via config (bsc#1204939) - Added: * control-the-collection-of-lvm-grains-via-config.patch - Update to Salt release version 3005.1 (jsc#PED-3042) - See release notes: https://docs.saltstack.com/en/latest/topics/releases/3005.1.html - Allow entrypoint compatibility for "importlib-metadata>=5.0.0" (bsc#1207071) - Add missing patch after rebase to fix collections Mapping issues - Prevent deadlocks in salt-ssh executions - Create new salt-tests subpackage containing Salt tests - Added: * allow-entrypoint-compatibility-for-importlib-metadat.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch - Modified: * activate-all-beacons-sources-config-pillar-grains.patch * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * clarify-pkg.installed-pkg_verify-documentation.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * detect-module.run-syntax.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fixes-for-python-3.10-502.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-aliases-in-the-fqdns-grains.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * 3003.3-do-not-consider-skipped-targets-as-failed-for.patch * 3003.3-postgresql-json-support-in-pillar-423.patch * add-missing-ansible-module-functions-to-whitelist-in.patch * add-rpm_vercmp-python-library-for-version-comparison.patch * adds-explicit-type-cast-for-port.patch * backport-syndic-auth-fixes.patch * batch.py-avoid-exception-when-minion-does-not-respon.patch * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch * enhance-logging-when-inotify-beacon-is-missing-pyino.patch * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch * fix-crash-when-calling-manage.not_alive-runners.patch * fixes-56144-to-enable-hotadd-profile-support.patch * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch * fix-for-cve-2022-22967-bsc-1200566.patch * fix-inspector-module-export-function-bsc-1097531-481.patch * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch * fix-issues-with-salt-ssh-s-extra-filerefs.patch * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch * fix-multiple-security-issues-bsc-1197417.patch * fix-salt-call-event.send-call-with-grains-and-pillar.patch * fix-the-regression-in-schedule-module-releasded-in-3.patch * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch * force-zyppnotify-to-prefer-packages.db-than-packages.patch * implementation-of-held-unheld-functions-for-state-pk.patch * implementation-of-suse_ip-execution-module-bsc-10999.patch * improvements-on-ansiblegate-module-354.patch * mock-ip_addrs-in-utils-minions.py-unit-test-443.patch * notify-beacon-for-debian-ubuntu-systems-347.patch * refactor-and-improvements-for-transactional-updates-.patch * support-transactional-systems-microos.patch * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch - Require python3-jmespath runtime dependency (bsc#1209233) - Fix problem with detecting PTF packages (bsc#1208691) - Fixes pkg.version_cmp on openEuler systems and a few other OS flavors - Make pkg.remove function from zypperpkg module to handle also PTF packages - Added: * 3005.1-implement-zypper-removeptf-573.patch * skip-package-names-without-colon-bsc-1208691-578.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch - Avoid conflicts with Salt dependencies versions (bsc#1211612) - Added: * avoid-conflicts-with-dependencies-versions-bsc-12116.patch - Avoid failures due transactional_update module not available in Salt 3006.0 (bsc#1211754) - Added: * define-__virtualname__-for-transactional_update-modu.patch - Make master_tops compatible with Salt 3000 and older minions (bsc#1212516) (bsc#1212517) - Added: * make-master_tops-compatible-with-salt-3000-and-older.patch - Prevent _pygit2.GitError: error loading known_hosts when $HOME is not set (bsc#1210994) - Fix ModuleNotFoundError and other issues raised by salt-support module (bsc#1211591) - tornado: Fix an open redirect in StaticFileHandler (CVE-2023-28370, bsc#1211741) - Added: * 3006.0-prevent-_pygit2.giterror-error-loading-known_.patch * fix-some-issues-detected-in-salt-support-cli-module-.patch * tornado-fix-an-open-redirect-in-staticfilehandler-cv.patch - Make sure configured user is properly set by Salt (bsc#1210994) - Do not fail on bad message pack message (bsc#1213441, CVE-2023-20897) - Fix broken tests to make them running in the testsuite - Prevent possible exceptions on salt.utils.user.get_group_dict (bsc#1212794) - Create minion_id with reproducible mtime - Fix detection of Salt codename by "salt_version" execution module - Fix regression: multiple values for keyword argument 'saltenv' (bsc#1212844) - Fix the regression of user.present state when group is unset (bsc#1212855) - Fix zypper repositories always being reconfigured - Fix utf8 handling in 'pass' renderer and make it more robust - Added: * make-sure-configured-user-is-properly-set-by-salt-bs.patch * prevent-possible-exceptions-on-salt.utils.user.get_g.patch * mark-salt-3006-as-released-586.patch * fix-the-regression-of-user.present-state-when-group-.patch * fix-tests-to-make-them-running-with-salt-testsuite.patch * fix-utf8-handling-in-pass-renderer-and-make-it-more-.patch * do-not-fail-on-bad-message-pack-message-bsc-1213441-.patch * zypper-pkgrepo-alreadyconfigured-585.patch * fix-regression-multiple-values-for-keyword-argument-.patch - Revert usage of long running REQ channel to prevent possible missing responses on requests and dublicated responses (bsc#1213960, bsc#1213630, bsc#1213257) - Fix gitfs cachedir basename to avoid hash collisions (bsc#1193948, bsc#1214797, CVE-2023-20898) - Added: * fixed-gitfs-cachedir_basename-to-avoid-hash-collisio.patch * revert-usage-of-long-running-req-channel-bsc-1213960.patch - Fix inconsistency in reported version by egg-info metadata (bsc#1215489) - Added: * write-salt-version-before-building-when-using-with-s.patch - Fix optimization_order opt to prevent testsuite fails - Improve salt.utils.json.find_json to avoid fails (bsc#1213293) - Use salt-call from salt bundle with transactional_update - Only call native_str on curl_debug message in tornado when needed - Implement the calling for batch async from the salt CLI - Fix calculation of SLS context vars when trailing dots on targetted sls/state (bsc#1213518) - Rename salt-tests to python3-salt-testsuite - Added: * fix-optimization_order-opt-to-prevent-test-fails.patch * fix-calculation-of-sls-context-vars-when-trailing-do.patch * implement-the-calling-for-batch-async-from-the-salt-.patch * improve-salt.utils.json.find_json-bsc-1213293.patch * use-salt-call-from-salt-bundle-with-transactional_up.patch * only-call-native_str-on-curl_debug-message-in-tornad.patch - Randomize pre_flight_script path (CVE-2023-34049 bsc#1215157) - Allow all primitive grain types for autosign_grains (bsc#1214477) - Added: * fix-cve-2023-34049-bsc-1215157.patch * allow-all-primitive-grain-types-for-autosign_grains-.patch - Ensure that pillar refresh loads beacons from pillar without restart - Fix the aptpkg.py unit test failure - Prefer unittest.mock to python-mock in test suite - Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) - Revert changes to set Salt configured user early in the stack (bsc#1216284) - Align behavior of some modules when using salt-call via symlink (bsc#1215963) - Fix gitfs "__env__" and improve cache cleaning (bsc#1193948) - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Added: * enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch * update-__pillar__-during-pillar_refresh.patch * fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch * dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch * prefer-unittest.mock-for-python-versions-that-are-su.patch * fix-the-aptpkg.py-unit-test-failure.patch * revert-make-sure-configured-user-is-properly-set-by-.patch - Prevent directory traversal when creating syndic cache directory on the master (CVE-2024-22231, bsc#1219430) - Prevent directory traversal attacks in the master's serve_file method (CVE-2024-22232, bsc#1219431) - Added: * fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch - Convert oscap output to UTF-8 - Make Salt compatible with Python 3.11 - Ignore non-ascii chars in oscap output (bsc#1219001) - Fix detected issues in Salt tests when running on VMs - Make importing seco.range thread safe (bsc#1211649) - Fix problematic tests and allow smooth tests executions on containers - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Provide user(salt)/group(salt) capabilities for RPM 4.19 - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Prevent exceptions with fileserver.update when called via state (bsc#1218482) - Improve pip target override condition with VENV_PIP_TARGET environment variable (bsc#1216850) - Fixed KeyError in logs when running a state that fails - Added: * make-importing-seco.range-thread-safe-bsc-1211649.patch * fixed-keyerror-in-logs-when-running-a-state-that-fai.patch * allow-kwargs-for-fileserver-roots-update-bsc-1218482.patch * decode-oscap-byte-stream-to-string-bsc-1219001.patch * fix-problematic-tests-and-allow-smooth-tests-executi.patch * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch * fix-salt-warnings-and-testuite-for-python-3.11-635.patch * switch-oscap-encoding-to-utf-8-639.patch * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch * improve-pip-target-override-condition-with-venv_pip_.patch - Make "man" a recommended package instead of required - Speed up salt.matcher.confirm_top by using __context__ - Do not call the async wrapper calls with the separate thread - Prevent OOM with high amount of batch async calls (bsc#1216063) - Add missing contextvars dependency in salt.version - Skip tests for unsupported algorithm on old OpenSSL version - Remove redundant `_file_find` call to the master - Prevent possible exception in tornado.concurrent.Future._set_done - Make reactor engine less blocking the EventPublisher - Make salt-master self recoverable on killing EventPublisher - Improve broken events catching and reporting - Make logging calls lighter - Remove unused import causing delays on starting salt-master - Mark python3-CherryPy as recommended package for the testsuite - Added: * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch * make-reactor-engine-less-blocking-the-eventpublisher.patch * remove-unused-import-causing-delays-on-starting-salt.patch * make-logging-calls-lighter.patch * remove-redundant-_file_find-call-to-the-master.patch * prevent-possible-exception-in-tornado.concurrent.fut.patch * do-not-call-the-async-wrapper-calls-with-the-separat.patch * add-missing-contextvars-dependency-in-salt.version.patch * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch * speed-up-salt.matcher.confirm_top-by-using-__context.patch * improve-broken-events-catching-and-reporting.patch * make-salt-master-self-recoverable-on-killing-eventpu.patch - Fix rich rule comparison in firewalld module (bsc#1222684) - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL - Make auth.pam more robust with Salt Bundle and fix tests - Fix performance of user.list_groups with many remote groups - Fix "status.diskusage" function and exclude some tests for Salt Bundle - Skip certain tests if necessary for some OSes and set flaky ones - Add a timer to delete old env post update for venv-minion - Several fixes for tests to avoid errors and failures in some OSes - Added: * firewalld-normalize-new-rich-rules-before-comparing-.patch * several-fixes-for-tests-to-avoid-errors-and-failures.patch * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch * some-more-small-tests-fixes-enhancements-661.patch * provide-systemd-timer-unit.patch * fix-user.list_groups-omits-remote-groups.patch - Fix failing x509 tests with OpenSSL < 1.1 - Avoid explicit reading of /etc/salt/minion (bsc#1220357) - Allow NamedLoaderContexts to be returned from loader - Revert the change making reactor less blocking (bsc#1230322) - Use --cachedir for extension_modules in salt-call (bsc#1226141) - Prevent using SyncWrapper with no reason - Fix the SELinux context for Salt Minion service (bsc#1219041) - Set contextvars as a build requirement for package - Increase warn_until_date date for code we still support - The test_debian test now uses port 80 for ubuntu keyserver - Fix too frequent systemd service restart in test_system test - Avoid crash on wrong output of systemctl version (bsc#1229539) - Improve error handling with different OpenSSL versions - Remove redundant run_func from salt.master.MWorker._handle_aes - Fix cloud minion configuration for multiple masters (bsc#1229109) - Use Pygit2 id instead of deprecated oid in gitfs - Fix few failing tests to work with both Salt and Salt bundle - Skip testing unsupported OpenSSL crypto algorithms - Added: * revert-the-change-making-reactor-less-blocking-bsc-1.patch * fix-x509-test-fails-on-old-openssl-systems-682.patch * prevent-using-syncwrapper-with-no-reason.patch * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch * allow-namedloadercontexts-to-be-returned-from-loader.patch * fix-deprecated-code-677.patch * fix-test_debian-to-work-in-our-infrastructure-676.patch * fix-the-selinux-context-for-salt-minion-service-bsc-.patch * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch * fix-test_system-flaky-setup_teardown-fn.patch * join-masters-if-it-is-a-list-671.patch * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch * remove-redundant-run_func-from-salt.master.mworker._.patch * make-tests-compatible-with-venv-bundle.patch * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch * skip-more-tests-related-to-old-openssl-algorithms.patch * improve-error-handling-with-different-openssl-versio.patch - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Reduce winbind error msg to debug for a PDC/NT4 domain (bsc#1221168). - use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE; (bsc#1223345); (bso#15423). - Regression DFS not working with widelinks = true, updated to fix DFS link enumeration; (bso#15435); (bsc#1213607); - Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699); (bsc#1229684). - Adjust spec to split out rpcd_* binaries into a separate sub package; (bsc#1231414). - Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including <sys/mount.h> in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493). - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Reduce winbind error msg to debug for a PDC/NT4 domain (bsc#1221168). - use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE; (bsc#1223345); (bso#15423). - Regression DFS not working with widelinks = true, updated to fix DFS link enumeration; (bso#15435); (bsc#1213607); - Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699); (bsc#1229684). - Adjust spec to split out rpcd_* binaries into a separate sub package; (bsc#1231414). - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Reduce winbind error msg to debug for a PDC/NT4 domain (bsc#1221168). - use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE; (bsc#1223345); (bso#15423). - Regression DFS not working with widelinks = true, updated to fix DFS link enumeration; (bso#15435); (bsc#1213607); - Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699); (bsc#1229684). - Adjust spec to split out rpcd_* binaries into a separate sub package; (bsc#1231414). - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to samba 4.17.12 * Weird filename can cause assert to fail in openat_pathref_fsp_nosymlink(); (bso#15419); * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432); * Improve GetNChanges to address some (but not all "Azure AD Connect") syncronisation tool looping during the initial user sync phase; (bso#15401); * Samba replication logs show (null) DN; (bso#15407); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * macOS mdfind returns only 50 results; (bso#15463); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453); * net ads lookup (with unspecified realm) fails; (bso#15384); (bsc#1213826); * Regression DFS not working with widelinks = true; (bso#15435); (bsc#1213607); * ctdb_killtcp fails to work with --enable-pcap and libpcap 1.9.1; (bso#15451); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); - Fix crossing automounter mount points; (bsc#1215212); - Add "net offlinejoin composeodj" command; (bsc#1214076); - Add new idmap_nss option 'use_upn' for those NSS modules able to handle UPNs or DOMAIN/user name format; (bsc#1215369); - Avoid unnecessary locking in idmap parent setup; (bsc#1215369); - Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431). - fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527); (bsc#1219937). - Reduce winbind error msg to debug for a PDC/NT4 domain (bsc#1221168). - use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE; (bsc#1223345); (bso#15423). - Regression DFS not working with widelinks = true, updated to fix DFS link enumeration; (bso#15435); (bsc#1213607); - Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699); (bsc#1229684). - Adjust spec to split out rpcd_* binaries into a separate sub package; (bsc#1231414). - Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including <sys/mount.h> in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493). - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including <sys/mount.h> in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493). - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including <sys/mount.h> in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493). - Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254) - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847); - Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists - Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122). - Clean up logic for PAM migration settings in spec file. - libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally. - Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414). - Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck. - Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281). - Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403). - CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). - secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826); - Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940); - Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435); - CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424). - GNU screen 4.3.0: * Introduce Xx string escape showing the executed command of a window * Implement dead/zombie window polling, allowing for auto reconnecting * Allow setting hardstatus on first line * 'sort' command sorting windows by title * 'bumpleft', 'bumpright' - manually move windows on window list * 'collapse' removing numbering 'gaps' between windows, by renumbering * 'windows' command now accepts arguments for use with querying - packaging changes: * move screen-poll-zombies.patch to savannah git * move screen-4.0.3-ipv6.patch to savannah git * move sort_command.patch to savannah git * move xX_string_escape.patch to savannah git * move screen_enhance_windows_list.patch to savannah git - GNU screen 4.3.1 * This is a bug fix release. * Visible content get messed up after window resize - Add license file as documentation - enable pam support, so screenlocking uses the password of the current user. - GNU screen 4.4.0: * Support up to 24 function keys * 'logfile' command, starts logging into new file upon changing * Fix runtime issues - Remove %postun - it tried to delete "screen.info.gz" file second time. - GNU Screen 4.5.0: * It's possible to specify logfile's name via command line parameter '-L'. Fixes: * broken handling of "bind u digraph U+" * crash with long $TERM * crash when bumping blank window * build for AIX * %x improperly separating arguments * install with custom DESTDIR - Add fix_enable_logfile.patch * fix loging screen API (bnc#1020870) * fix privilege escalation - GNU Screen 4.5.1: * logfile permissions problem (CVE-2017-5618) bsc#1021743 This issues does not affect the SUSE package as setuid/setid is not used. - drop upstreamed fix_enable_logfile.patch - add 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - Ensure /usr/share/terminfo/s/screen is present when screen is [boo#812067]. - GNU Screen 4.6.0: * Update Unicode wide tables to 9.0 * Support more serial speeds * Improved namespaces support * Migrate from fifos to sockets * Start viewing scrollback at first line of output - drop upstreamed 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - GNU Screen 4.6.1: bugfix release * problems with starting session in some cases * parallel make install * segfault when querying info on nonUTF locale - spec file: adding PreReq for permissions - adding %set_permissions and %verify_permissions macros for /run/uscreens/ - adding %tmpfiles_create macro for /usr/lib/tmpfiles.d/screen.conf - GNU Screen 4.6.2: * revert changes to cursor position restore behavour * set freed pointer to NULL * documentation fixes * fix windowlist crashes - install pam file to make screen locking work again [bnc#1056192] new file: screen.pam - Use %license instead of %doc [bsc#1082318] - Fix double width combining char handling that could lead to a segfault [bnc#1182092] [CVE-2021-26937] new patch: combchar.diff - GNU screen 4.3.0: * Introduce Xx string escape showing the executed command of a window * Implement dead/zombie window polling, allowing for auto reconnecting * Allow setting hardstatus on first line * 'sort' command sorting windows by title * 'bumpleft', 'bumpright' - manually move windows on window list * 'collapse' removing numbering 'gaps' between windows, by renumbering * 'windows' command now accepts arguments for use with querying - packaging changes: * move screen-poll-zombies.patch to savannah git * move screen-4.0.3-ipv6.patch to savannah git * move sort_command.patch to savannah git * move xX_string_escape.patch to savannah git * move screen_enhance_windows_list.patch to savannah git - GNU screen 4.3.1 * This is a bug fix release. * Visible content get messed up after window resize - Add license file as documentation - enable pam support, so screenlocking uses the password of the current user. - GNU screen 4.4.0: * Support up to 24 function keys * 'logfile' command, starts logging into new file upon changing * Fix runtime issues - Remove %postun - it tried to delete "screen.info.gz" file second time. - GNU Screen 4.5.0: * It's possible to specify logfile's name via command line parameter '-L'. Fixes: * broken handling of "bind u digraph U+" * crash with long $TERM * crash when bumping blank window * build for AIX * %x improperly separating arguments * install with custom DESTDIR - Add fix_enable_logfile.patch * fix loging screen API (bnc#1020870) * fix privilege escalation - GNU Screen 4.5.1: * logfile permissions problem (CVE-2017-5618) bsc#1021743 This issues does not affect the SUSE package as setuid/setid is not used. - drop upstreamed fix_enable_logfile.patch - add 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - Ensure /usr/share/terminfo/s/screen is present when screen is [boo#812067]. - GNU Screen 4.6.0: * Update Unicode wide tables to 9.0 * Support more serial speeds * Improved namespaces support * Migrate from fifos to sockets * Start viewing scrollback at first line of output - drop upstreamed 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - GNU Screen 4.6.1: bugfix release * problems with starting session in some cases * parallel make install * segfault when querying info on nonUTF locale - spec file: adding PreReq for permissions - adding %set_permissions and %verify_permissions macros for /run/uscreens/ - adding %tmpfiles_create macro for /usr/lib/tmpfiles.d/screen.conf - GNU Screen 4.6.2: * revert changes to cursor position restore behavour * set freed pointer to NULL * documentation fixes * fix windowlist crashes - install pam file to make screen locking work again [bnc#1056192] new file: screen.pam - Use %license instead of %doc [bsc#1082318] - Fix double width combining char handling that could lead to a segfault [bnc#1182092] [CVE-2021-26937] new patch: combchar.diff - GNU screen 4.3.0: * Introduce Xx string escape showing the executed command of a window * Implement dead/zombie window polling, allowing for auto reconnecting * Allow setting hardstatus on first line * 'sort' command sorting windows by title * 'bumpleft', 'bumpright' - manually move windows on window list * 'collapse' removing numbering 'gaps' between windows, by renumbering * 'windows' command now accepts arguments for use with querying - packaging changes: * move screen-poll-zombies.patch to savannah git * move screen-4.0.3-ipv6.patch to savannah git * move sort_command.patch to savannah git * move xX_string_escape.patch to savannah git * move screen_enhance_windows_list.patch to savannah git - GNU screen 4.3.1 * This is a bug fix release. * Visible content get messed up after window resize - Add license file as documentation - enable pam support, so screenlocking uses the password of the current user. - GNU screen 4.4.0: * Support up to 24 function keys * 'logfile' command, starts logging into new file upon changing * Fix runtime issues - Remove %postun - it tried to delete "screen.info.gz" file second time. - GNU Screen 4.5.0: * It's possible to specify logfile's name via command line parameter '-L'. Fixes: * broken handling of "bind u digraph U+" * crash with long $TERM * crash when bumping blank window * build for AIX * %x improperly separating arguments * install with custom DESTDIR - Add fix_enable_logfile.patch * fix loging screen API (bnc#1020870) * fix privilege escalation - GNU Screen 4.5.1: * logfile permissions problem (CVE-2017-5618) bsc#1021743 This issues does not affect the SUSE package as setuid/setid is not used. - drop upstreamed fix_enable_logfile.patch - add 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - Ensure /usr/share/terminfo/s/screen is present when screen is [boo#812067]. - GNU Screen 4.6.0: * Update Unicode wide tables to 9.0 * Support more serial speeds * Improved namespaces support * Migrate from fifos to sockets * Start viewing scrollback at first line of output - drop upstreamed 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - GNU Screen 4.6.1: bugfix release * problems with starting session in some cases * parallel make install * segfault when querying info on nonUTF locale - spec file: adding PreReq for permissions - adding %set_permissions and %verify_permissions macros for /run/uscreens/ - adding %tmpfiles_create macro for /usr/lib/tmpfiles.d/screen.conf - GNU Screen 4.6.2: * revert changes to cursor position restore behavour * set freed pointer to NULL * documentation fixes * fix windowlist crashes - install pam file to make screen locking work again [bnc#1056192] new file: screen.pam - Use %license instead of %doc [bsc#1082318] - Fix double width combining char handling that could lead to a segfault [bnc#1182092] [CVE-2021-26937] new patch: combchar.diff - Update to 4.2.0 as released on screen-devel@gnu.org yesterday. Thank you Amadeusz! * keep libtinfo.diff (from coolo 2011, why exactly?) * keep global_screenrc.patch (renamed from screen-4.0.2.dif) * keep screen-man-loginshell.diff (to be upstreamed) * dropped screen-__P.diff (not needed) * keep term_too_long.diff (savannah#30880, to be upstreamed) * keep use_locale.diff (from lnt-sysadmin@lists.lrz.de 2012, check?) * keep screen-4.0.3-ipv6.patch (builtin telnet, to be upstreamed) * keep screen_enhance_windows_list.patch (to be upstreamed) * keep screen-poll-zombies.patch (to be upstreamed) * keep xX_string_escape.patch (renamed from show_all_active.patch, to be upstreamed) * keep sort_command.patch (from trenn 2011, to be upstreamed) * added msg_version_3.patch (ouch, incompatible protocol, to be upstreamed) - added %rundir with /var/run for 1310 and before; but /run afterwards. aj advocates /run for Factory; for 1310 it was banned by suse-filelist-forbidden-fhs23 - GNU screen 4.2.1: * allow for terminal with long $TERM (up to 32 characters) (already patched in this package previously) * allow to use long logins * documentation fixes * runtime fixes - packaging changes: * use source URLs * verify source signatures * drop screen-man-loginshell.diff, equivalent change upstream * drop term_too_long.diff, equivalent change upstream * drop use_locale.diff, applied upstream * drop msg_version_3.patch, obsolete after upstream changes - GNU screen 4.3.0: * Introduce Xx string escape showing the executed command of a window * Implement dead/zombie window polling, allowing for auto reconnecting * Allow setting hardstatus on first line * 'sort' command sorting windows by title * 'bumpleft', 'bumpright' - manually move windows on window list * 'collapse' removing numbering 'gaps' between windows, by renumbering * 'windows' command now accepts arguments for use with querying - packaging changes: * move screen-poll-zombies.patch to savannah git * move screen-4.0.3-ipv6.patch to savannah git * move sort_command.patch to savannah git * move xX_string_escape.patch to savannah git * move screen_enhance_windows_list.patch to savannah git - GNU screen 4.3.1 * This is a bug fix release. * Visible content get messed up after window resize - Add license file as documentation - enable pam support, so screenlocking uses the password of the current user. - GNU screen 4.4.0: * Support up to 24 function keys * 'logfile' command, starts logging into new file upon changing * Fix runtime issues - Remove %postun - it tried to delete "screen.info.gz" file second time. - GNU Screen 4.5.0: * It's possible to specify logfile's name via command line parameter '-L'. Fixes: * broken handling of "bind u digraph U+" * crash with long $TERM * crash when bumping blank window * build for AIX * %x improperly separating arguments * install with custom DESTDIR - Add fix_enable_logfile.patch * fix loging screen API (bnc#1020870) * fix privilege escalation - GNU Screen 4.5.1: * logfile permissions problem (CVE-2017-5618) bsc#1021743 This issues does not affect the SUSE package as setuid/setid is not used. - drop upstreamed fix_enable_logfile.patch - add 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - Ensure /usr/share/terminfo/s/screen is present when screen is [boo#812067]. - GNU Screen 4.6.0: * Update Unicode wide tables to 9.0 * Support more serial speeds * Improved namespaces support * Migrate from fifos to sockets * Start viewing scrollback at first line of output - drop upstreamed 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - GNU Screen 4.6.1: bugfix release * problems with starting session in some cases * parallel make install * segfault when querying info on nonUTF locale - spec file: adding PreReq for permissions - adding %set_permissions and %verify_permissions macros for /run/uscreens/ - adding %tmpfiles_create macro for /usr/lib/tmpfiles.d/screen.conf - GNU Screen 4.6.2: * revert changes to cursor position restore behavour * set freed pointer to NULL * documentation fixes * fix windowlist crashes - install pam file to make screen locking work again [bnc#1056192] new file: screen.pam - Use %license instead of %doc [bsc#1082318] - Fix double width combining char handling that could lead to a segfault [bnc#1182092] [CVE-2021-26937] new patch: combchar.diff - GNU screen 4.3.0: * Introduce Xx string escape showing the executed command of a window * Implement dead/zombie window polling, allowing for auto reconnecting * Allow setting hardstatus on first line * 'sort' command sorting windows by title * 'bumpleft', 'bumpright' - manually move windows on window list * 'collapse' removing numbering 'gaps' between windows, by renumbering * 'windows' command now accepts arguments for use with querying - packaging changes: * move screen-poll-zombies.patch to savannah git * move screen-4.0.3-ipv6.patch to savannah git * move sort_command.patch to savannah git * move xX_string_escape.patch to savannah git * move screen_enhance_windows_list.patch to savannah git - GNU screen 4.3.1 * This is a bug fix release. * Visible content get messed up after window resize - Add license file as documentation - enable pam support, so screenlocking uses the password of the current user. - GNU screen 4.4.0: * Support up to 24 function keys * 'logfile' command, starts logging into new file upon changing * Fix runtime issues - Remove %postun - it tried to delete "screen.info.gz" file second time. - GNU Screen 4.5.0: * It's possible to specify logfile's name via command line parameter '-L'. Fixes: * broken handling of "bind u digraph U+" * crash with long $TERM * crash when bumping blank window * build for AIX * %x improperly separating arguments * install with custom DESTDIR - Add fix_enable_logfile.patch * fix loging screen API (bnc#1020870) * fix privilege escalation - GNU Screen 4.5.1: * logfile permissions problem (CVE-2017-5618) bsc#1021743 This issues does not affect the SUSE package as setuid/setid is not used. - drop upstreamed fix_enable_logfile.patch - add 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - Ensure /usr/share/terminfo/s/screen is present when screen is [boo#812067]. - GNU Screen 4.6.0: * Update Unicode wide tables to 9.0 * Support more serial speeds * Improved namespaces support * Migrate from fifos to sockets * Start viewing scrollback at first line of output - drop upstreamed 0001-Follow-up-to-bc5ea98-fix-texinfo-syntax-errors.patch - GNU Screen 4.6.1: bugfix release * problems with starting session in some cases * parallel make install * segfault when querying info on nonUTF locale - spec file: adding PreReq for permissions - adding %set_permissions and %verify_permissions macros for /run/uscreens/ - adding %tmpfiles_create macro for /usr/lib/tmpfiles.d/screen.conf - GNU Screen 4.6.2: * revert changes to cursor position restore behavour * set freed pointer to NULL * documentation fixes * fix windowlist crashes - install pam file to make screen locking work again [bnc#1056192] new file: screen.pam - Use %license instead of %doc [bsc#1082318] - Fix double width combining char handling that could lead to a segfault [bnc#1182092] [CVE-2021-26937] new patch: combchar.diff - Add Source URL, see https://en.opensuse.org/SourceUrls - sed-dont_close_twice.patch (bnc#880817) when closing fails, file is attempted to be closed again patch based of Neil Brown's recommendation - build with PIE - Cherry picking of the most important fixes from the upstream sed GIT (not backporting testsuite, as it was completely refactored): * Fix y command in the RHS of a y/LHS/RHS/ transliteration (sed-y-NUL-RHS.patch). * Fix mishandling of overlapping address ranges (sed-fix-overlapping-address-ranges.patch). * Fix fail to remove a temporary file (sed-temp-delete.patch). * Fix behavior of --follow-symlinks when reading from stdin (bnc#933029, gnu#20795, sed-follow-symlinks-stdin.patch). * Make "sed --follow-symlinks -" consistent with "sed -" again, and process stdin instead of ./- (bnc#933029#c6, gnu#20796, sed-follow-symlinks-hyphen.patch). - Build with ACL/SELinux support for in-place editing - Update to version 4.3: * sed's regular expression matching is now typically 10x faster * sed now uses unlocked-io where available, resulting in faster I/O operations. * lots of bugfixes (for detailed list see NEWS) - Drop patches (all upstreamed): * sed-fix-overlapping-address-ranges.patch * sed-follow-symlinks-hyphen.patch * sed-follow-symlinks-stdin.patch * sed-temp-delete.patch * sed-y-NUL-RHS.patch - Spec file cleanups * run spec-cleaner * use macro for configure * execute tests with produced binary as well * use url for signature as well * use https for download links * use xs compressed tarballl * make building verbose - Update to version 4.4: * sed could segfault when invoked with specific combination of newlines in the input and regex pattern. - Use %license (boo#1082318) - Build fix for the new glibc-2.31 (bsc#1183797, sed-tests-build-fix.patch). - 0001-sed-set-correct-umask-on-temporary-files.patch Fix for bsc#1221218 - Add Source URL, see https://en.opensuse.org/SourceUrls - sed-dont_close_twice.patch (bnc#880817) when closing fails, file is attempted to be closed again patch based of Neil Brown's recommendation - build with PIE - Cherry picking of the most important fixes from the upstream sed GIT (not backporting testsuite, as it was completely refactored): * Fix y command in the RHS of a y/LHS/RHS/ transliteration (sed-y-NUL-RHS.patch). * Fix mishandling of overlapping address ranges (sed-fix-overlapping-address-ranges.patch). * Fix fail to remove a temporary file (sed-temp-delete.patch). * Fix behavior of --follow-symlinks when reading from stdin (bnc#933029, gnu#20795, sed-follow-symlinks-stdin.patch). * Make "sed --follow-symlinks -" consistent with "sed -" again, and process stdin instead of ./- (bnc#933029#c6, gnu#20796, sed-follow-symlinks-hyphen.patch). - Build with ACL/SELinux support for in-place editing - Update to version 4.3: * sed's regular expression matching is now typically 10x faster * sed now uses unlocked-io where available, resulting in faster I/O operations. * lots of bugfixes (for detailed list see NEWS) - Drop patches (all upstreamed): * sed-fix-overlapping-address-ranges.patch * sed-follow-symlinks-hyphen.patch * sed-follow-symlinks-stdin.patch * sed-temp-delete.patch * sed-y-NUL-RHS.patch - Spec file cleanups * run spec-cleaner * use macro for configure * execute tests with produced binary as well * use url for signature as well * use https for download links * use xs compressed tarballl * make building verbose - Update to version 4.4: * sed could segfault when invoked with specific combination of newlines in the input and regex pattern. - Use %license (boo#1082318) - Build fix for the new glibc-2.31 (bsc#1183797, sed-tests-build-fix.patch). - 0001-sed-set-correct-umask-on-temporary-files.patch Fix for bsc#1221218 - Updated to version 4.1.5: Fix parsing of a negative character class not including a closed bracket, like [^]] or [^]a-z]. Fix parsing of [ inside an y command, like y/[/A/. Output the result of commands a, r, R when a q command is found. - off-by-one.diff: obsolete (fixed in the source). - configure needs --enable-html to build sed.html (default=no) and it is installed into usr/share/doc/sed-4.1.5/ - add --follow-symlinks option [#200082] - fix 'used uninitialized' warnings [#248721] - use %find_lang - fix rpmlint warnings - enable parallel building - use %_smp_mflags - Update to version 4.2.1: + fix parsing of s/[[[[[[[[[]// + security contexts are preserved by -i too under SELinux + temporary files for sed -i are not made group/world-readable until they are complete - Changes from version 4.2: + now released under GPLv3 + added a new extension `z` to clear pattern space even in the presence of invalid multibyte sequences + a preexisting GNU gettext installation is needed in order to compile GNU sed with NLS support + new option --follow-symlinks, available when editing a file in-place. + hold-space is reset between different files in -i and -s modes. + multibyte processing fixed + fixed bug in 'i\' giving a segmentation violation if given alone. + much improved portability + much faster in UTF-8 locales + will correctly replace ACLs when using -i + will now accept NUL bytes for `.' - Drop upstream included [atches: + sed-follow_symlinks.patch + sed-4.1.5-fix_warnings.patch - Remove --enable-html from configure: the option is no longer supported and sed.html no longer created. - add automake as buildrequire to avoid implicit dependency - license update: GPL-3.0+ There are no "GPL-3.0 only" licenses in sed - keep binary in /usr tree (UsrMerge project) - Update to version 4.2.2: * don't truncate input for lines of length 2^31 and longer * fix endless loop on incomplete multibyte sequences (bnc#743689) * -u also does unbuffered input * New command `F' to print current input file name * sed -i, s///w, and the `w' and `W' commands also obey the - -binary option * --posix fails for scripts that end in a backslash. * New option -z (--null-data) to separate lines by ASCII NUL. * \x26 (and similar escaped sequences) produces a literal & in the replacement argument of the s/// command. - Split lang package. - Option to verify GPG signature. - Add Source URL, see https://en.opensuse.org/SourceUrls - sed-dont_close_twice.patch (bnc#880817) when closing fails, file is attempted to be closed again patch based of Neil Brown's recommendation - build with PIE - Cherry picking of the most important fixes from the upstream sed GIT (not backporting testsuite, as it was completely refactored): * Fix y command in the RHS of a y/LHS/RHS/ transliteration (sed-y-NUL-RHS.patch). * Fix mishandling of overlapping address ranges (sed-fix-overlapping-address-ranges.patch). * Fix fail to remove a temporary file (sed-temp-delete.patch). * Fix behavior of --follow-symlinks when reading from stdin (bnc#933029, gnu#20795, sed-follow-symlinks-stdin.patch). * Make "sed --follow-symlinks -" consistent with "sed -" again, and process stdin instead of ./- (bnc#933029#c6, gnu#20796, sed-follow-symlinks-hyphen.patch). - Build with ACL/SELinux support for in-place editing - Update to version 4.3: * sed's regular expression matching is now typically 10x faster * sed now uses unlocked-io where available, resulting in faster I/O operations. * lots of bugfixes (for detailed list see NEWS) - Drop patches (all upstreamed): * sed-fix-overlapping-address-ranges.patch * sed-follow-symlinks-hyphen.patch * sed-follow-symlinks-stdin.patch * sed-temp-delete.patch * sed-y-NUL-RHS.patch - Spec file cleanups * run spec-cleaner * use macro for configure * execute tests with produced binary as well * use url for signature as well * use https for download links * use xs compressed tarballl * make building verbose - Update to version 4.4: * sed could segfault when invoked with specific combination of newlines in the input and regex pattern. - Use %license (boo#1082318) - Build fix for the new glibc-2.31 (bsc#1183797, sed-tests-build-fix.patch). - 0001-sed-set-correct-umask-on-temporary-files.patch Fix for bsc#1221218 - Add Source URL, see https://en.opensuse.org/SourceUrls - sed-dont_close_twice.patch (bnc#880817) when closing fails, file is attempted to be closed again patch based of Neil Brown's recommendation - build with PIE - Cherry picking of the most important fixes from the upstream sed GIT (not backporting testsuite, as it was completely refactored): * Fix y command in the RHS of a y/LHS/RHS/ transliteration (sed-y-NUL-RHS.patch). * Fix mishandling of overlapping address ranges (sed-fix-overlapping-address-ranges.patch). * Fix fail to remove a temporary file (sed-temp-delete.patch). * Fix behavior of --follow-symlinks when reading from stdin (bnc#933029, gnu#20795, sed-follow-symlinks-stdin.patch). * Make "sed --follow-symlinks -" consistent with "sed -" again, and process stdin instead of ./- (bnc#933029#c6, gnu#20796, sed-follow-symlinks-hyphen.patch). - Build with ACL/SELinux support for in-place editing - Update to version 4.3: * sed's regular expression matching is now typically 10x faster * sed now uses unlocked-io where available, resulting in faster I/O operations. * lots of bugfixes (for detailed list see NEWS) - Drop patches (all upstreamed): * sed-fix-overlapping-address-ranges.patch * sed-follow-symlinks-hyphen.patch * sed-follow-symlinks-stdin.patch * sed-temp-delete.patch * sed-y-NUL-RHS.patch - Spec file cleanups * run spec-cleaner * use macro for configure * execute tests with produced binary as well * use url for signature as well * use https for download links * use xs compressed tarballl * make building verbose - Update to version 4.4: * sed could segfault when invoked with specific combination of newlines in the input and regex pattern. - Use %license (boo#1082318) - Build fix for the new glibc-2.31 (bsc#1183797, sed-tests-build-fix.patch). - 0001-sed-set-correct-umask-on-temporary-files.patch Fix for bsc#1221218 - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - Update to version 20230511+git21.861b7a02: * Allow sssd_t watch permission to net_conf_t dirs (bsc#1216052, bsc#1233789) - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - Update to version 20230511+git21.861b7a02: * Allow sssd_t watch permission to net_conf_t dirs (bsc#1216052, bsc#1233789) - fix_networkmanager.patch: Allow NetworkManager_dispatcher_tlp_t and NetworkManager_dispatcher_custom_t to access nscd socket (bsc#1201741) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - fix_networkmanager.patch: Allow NetworkManager_dispatcher_tlp_t and NetworkManager_dispatcher_custom_t to access nscd socket (bsc#1201741) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - Update to version 20230511+git21.861b7a02: * Allow sssd_t watch permission to net_conf_t dirs (bsc#1216052, bsc#1233789) - fix_networkmanager.patch: Allow NetworkManager_dispatcher_tlp_t and NetworkManager_dispatcher_custom_t to access nscd socket (bsc#1201741) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to version 20230511+git13.edb03d70: * allow rebootmgr to read the system state (bsc#1205931) * Allow keepalived_t read+write kernel_t pipes (bsc#1216060) - Update to version 20230511+git15.bdc96df2: * Dontaudit getty and plymouth the checkpoint_restore capability (bsc#1220361) - Update to version 20230511+git17.e258ac27: * Fix mkhomedir_helper label to match on sbin (bsc#1229701) - Update to version 20230511+git19.a02f4bde: * Allow systemd-journal list cgroup directories (bsc#1233198) - Update to version 20230511+git21.861b7a02: * Allow sssd_t watch permission to net_conf_t dirs (bsc#1216052, bsc#1233789) - fix_networkmanager.patch: Allow NetworkManager_dispatcher_tlp_t and NetworkManager_dispatcher_custom_t to access nscd socket (bsc#1201741) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Move SUSE directory from manual page section to html docu - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Revamped rtorrent module - Update fix_xserver.patch to add greetd support (bsc#1198559) - Update fix_networkmanager.patch to ensure NetworkManager chrony dispatcher is properly labled and update fix_chronyd.patch to ensure chrony helper script has proper label to be used by NetworkManager. Also allow NetworkManager_dispatcher_custom_t to query systemd status (bsc#1203824) - Updated quilt couldn't unpack tarball. This will cause ongoing issues so drop the sed statement in the %prep section and add distro_suse_to_distro_redhat.patch to add the necessary changes via a patch - Update to version 20221019. Refreshed: * distro_suse_to_distro_redhat.patch * fix_apache.patch * fix_chronyd.patch * fix_cron.patch * fix_init.patch * fix_kernel_sysctl.patch * fix_networkmanager.patch * fix_rpm.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_xserver.patch - Dropped fix_cockpit.patch as this is now packaged with cockpit itself - Remove the ipa module, freeip ships their own module - Added fix_alsa.patch to allow reading of config files in home directories - Extended fix_networkmanager.patch and fix_postfix.patch to account for SUSE systems - Added dontaudit_interface_kmod_tmpfs.patch to prevent AVCs when startproc queries the running processes - Updated fix_snapper.patch to allow snapper to talk to rpm via dbus - fix_sysnetwork.patch: firewalld uses /etc/sysconfig/network/ for network interface definition instead of /etc/sysconfig/network-scripts/, modified sysnetwork.fc to reflect that (bsc#1205580). - Drop fix_irqbalance.patch: superseded by upstream - Add fix_irqbalance.patch: support netlink socket operations (bsc#1205434) - Updated fix_networkmanager.patch to allow NetworkManager to watch net_conf_t (bsc#1206109) - Updated fix_networkmanager.patch to fixe labeling of nm-dispatcher and nm-priv-helper until the packaging is adjusted (bsc#1206355) - Update fix_chronyd.patch to allow sendto towards NetworkManager_dispatcher_custom_t. Added new interface networkmanager_dispatcher_custom_dgram_send for this (bsc#1206357) - Update fix_dbus.patch to allow dbus to watch lib directories (bsc#1205895) - Added fix_filesystem.patch to prevent labeling of overlayfs mountpoint - Packaging rework. Move policy to git repository Please use `osc service manualrun` to update this OBS package to the newest git version. * Added README.Update describing how to update this package * Added _service file that pulls from selinux-policy and tar it * Updated selinux-policy.spec to build selinux-policy with container-selinux * Updated update.sh * Removed suse specific modules as they are now covered by git commits * packagekit.te packagekit.if packagekit.fc * rebootmgr.te rebootmgr.if rebootmgr.fc * rtorrent.te rtorrent.if rtorrent.fc * wicked.te wicked.if wicked.fc * Removed *.patch as they are now covered by git commits: * distro_suse_to_distro_redhat.patch * dontaudit_interface_kmod_tmpfs.patch * fix_accountsd.patch * fix_alsa.patch * fix_apache.patch * fix_auditd.patch * fix_authlogin.patch * fix_automount.patch * fix_bitlbee.patch * fix_chronyd.patch * fix_cloudform.patch * fix_colord.patch * fix_corecommand.patch * fix_cron.patch * fix_dbus.patch * fix_djbdns.patch * fix_dnsmasq.patch * fix_dovecot.patch * fix_firewalld.patch * fix_filesystem.patch * fix_fwupd.patch * fix_geoclue.patch * fix_hypervkvp.patch * fix_init.patch * fix_iptables.patch * fix_irqbalance.patch * fix_java.patch * fix_kernel_sysctl.patch * fix_libraries.patch * fix_locallogin.patch * fix_logging.patch * fix_logrotate.patch * fix_mcelog.patch * fix_miscfiles.patch * fix_nagios.patch * fix_networkmanager.patch * fix_nis.patch * fix_nscd.patch * fix_ntp.patch * fix_openvpn.patch * fix_postfix.patch * fix_rpm.patch * fix_screen.patch * fix_selinuxutil.patch * fix_smartmon.patch * fix_snapper.patch * fix_sslh.patch * fix_sysnetwork.patch * fix_systemd.patch * fix_systemd_watch.patch * fix_thunderbird.patch * fix_unconfined.patch * fix_unconfineduser.patch * fix_unprivuser.patch * fix_userdomain.patch * fix_usermanage.patch * fix_wine.patch * fix_xserver.patch * sedoctool.patch * systemd_domain_dyntrans_type.patch * fedora-policy-20221019.tar.bz2 - Update to version 20230511+git3.b78f5aff: * fix entropy daemon (bsc#1211045) - Update to version 20230511+git4.8c35010e: * allow haveged to manage tmpfs directories (bsc#1213594) - Use /var/adm/update-scripts in macros.selinux-policy. The rpm state directory doesn't exist on SUSE systems (bsc#1213593) - Create path in macros.selinux-policy since is might not exist on transactional systems - Update to version 20230511+git5.ad830265b: * Allow sysadm_t run kernel bpf programs * allow init to run bpf programs. We do this during early startup (bsc#1215423) * Modified update.sh to require first parameter "full" to also update container-selinux - Update to version 20230511+git9.1b35a6ab: * Allow keepalived to manage its tmp files (bsc#1216060) - Extend module list for targeted policy * timedatex * rrdcached * stratisd * ica (bsc#1215405) * fedoratp * stalld * rhcd * wireguard - Trigger rebuild of the policy when pcre2 gets updated to avoid regex version mismatch errors (bsc#1216747). - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - Update to svn r730: * Move testing utilities to 'testing' directory * sg_opcode: check resid and trim response * sg_rep_zones: expand --help option * sg_mode: Add Out-of-band management control page * sg_ses: filer join output on dpage element presence * documentation cleanup - rescan-scsi-bus.sh: Add '--ignore-rev' option - Supplement SCSI modaliases (bsc#1065212) - sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431) - rescan-scsi-bus.sh: new option for ignore rev change - rescan-scsi-bus.sh: Remove white space - Add 'coreutils' to Requires (bsc#1072744) - Add 'posttrans' to rpm spec (bsc#1071972) - sg_inq: check VPD page 0x0 before reading serial number (bsc#1067839) - sg_inq: add option '-o/--only' to skip reading VPD pages (bsc#1067839) - Revert 'postun' rpm spec changes after review - Update to svn r744: * sg_write_x: new command for normal/atomic/orwrite etc SCSI WRITE variants * sg_ses: add NVMe support * sg_inq: decode NVMe controller / NSIDs - rescan_scsi_bus.sh: Fix manpage for --forcerescan - 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873) - 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873) - Merge local patch with git repository * Delete sgut-libversioning.diff - Update to svn r751: * NVMe bugfixes * sg_seek: new utility * sg_stream_ctl: new utility program - 54-before-scsi-sg3_id.rules: compability rule for systemd (bsc#1079873) - Add dracut.conf to install new rule with dracut - dracut.conf: add whitespace at end of line (bsc#1080562) - Update to svn r763: * More NVMe bugfixes * sg_vpd: add device constituents vpd * sg_raw: add --raw option * sg_turs: add --low option * sg_ses: decoding dpage fixes; add --quiet option - rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008) - rescan-scsi-bus.sh: Fixes from shellcheck - Spec file: * add fc_wwpn_id (bsc#1005063) * add lun masking service (bsc#954600) * drop BuildRequires on udev * replace unversioned "Provides: scsi" with versioned - Update to version sg3_utils-1.45~803+31.564be3d: * New versioning scheme for upstream pre-release: 1.45 - upstream release target, 803 - upstream svn id, +31: SUSE commits on top of svn, 564be3d - git hash * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) * Add scsi-enable-target-scan.sh (bsc#954600) - Update to svn r803: * sg_opcodes: expand MLU (18-102r0) * sg_format: add --dcrt used twice (FOV=1 DCRT=0) * rescan-scsi-bus: widen LUN 0 only scanning (bsc#1069384) - Earlier SUSE fixes included in 1.45: * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384) [svn: r795] * sg_ses: fixup page decoding (bsc#1077787) [svn: r795] * sg_ses: allow to decode raw data instead of reading from a device (bsc#1050943) [svn: r795] - Update to sg3_utils-1.44 [20180912] [svn: r791] * rescan-scsi-bus.sh: harden code - bump version to 20180615 - add --ignore-rev to ignore revision change * introduce SG3_UTILS_DSENSE environment variable * sginfo: don't open /dev/snapshot * sg_timestamp: add '--no-timestamp' option - add --elapsed and --hex options * sg_wr_mode: add --rtd option for RTD bi * sg_unmap: add --all=ST,RN[,LA] option * sgm_dd, sg_dd: add --dry-run and --verbose options * sg_inq+sg_vpd: update Extended inquiry data vpd page * sg_ses: add 'hw_reset' and 'sw_reset' to enclosure services controller electronics element type (18-047r1) * sg_decode sense: add --cdb and --err=ES options * sg_format: add --dry-run option - extend --wait timeout for > 4TB disks * sg_sanitize: add --dry-run option - Earlier SUSE fixes included in 1.44: * sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1065448, bsc#1070431) [svn: r742] * sg_inq: export all NAA values (bsc#1050767) [svn: r715] * Add fc_wwpn_id to generate by-path links for fibrechannel (bsc#1005063) (svn@715) * sg_vpd: struct opts_t misaligment (bsc#1050943) [svn: r707] - Replace old $RPM_* shell vars. - Update to version 1.45~815+5.6aa67ed: * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418) - Update to svn r815: * sg_opcodes: expand MLU (spc5r20) * sg_inq: update version descriptors to spc5r21 * sg_vpd: 3pc VPD page add copy group descriptor * sg_xcopy: add --fco (fast copy only) (spc5r20) and --app=1 * add nanosecond durations with SG3_UTILS_LINUX_NANO - Earlier SUSE fixes now included upstream: * 58-scsi-sg3_symlink.rules: don't skip multipath members (bsc#1085212) [r815] * rescan-scsi-bus.sh: terminate scanning if last lun got removed (bsc#1087008) [r815] * Add scsi-enable-target-scan.sh (bsc#954600) [r814] * shellcheck cleanups for rescan-scsi-bus.sh [r814] - Update to version 1.46: * sg_rep_pip: new utility: report provisioning initialization pattern command * sg_turs: estimated time-to-ready [spc6r03] - add --delay=MS option * sg_requests: substantial cleanup * sg_vpd: add Format presets and Concurrent positioning ranges - add hot-pluggable field in standard Inquiry [spc6r05] - fix vendor struct opts_t alignment * sg_inq: add hot-pluggable field in standard Inquiry * sg_dd: --verify : separate category for miscompare errors - --verify : oflag=coe continue on miscompares, counts them - add cdl= operand for command duration limit indexes - add oflag=nocreat and conv=nocreat : OFILE must exist - add iflag=00, ff, random flags - setup conditional auto rule for getrandom() - add command timeout after comma in time= operand * sg_get_elem_status: add ralwd bit sbc4r20a * sg_write_x: add dld bits to write(32) [sbc4r19a] * sg_rep_zones: print invalid write pointer LBA as -1 rather than 16 "f"s * sg_opcodes: improve handling of RWCDLP field * sg_ses: use fan speed factor field for calculation [ses4r04] - add --all (-a) option, same action as --join * sg_compare_and_write: add examples section to its manpage * sg_modes: document '-s' option (same as '-6') * sg_sanitize + sg_format: when --verbose given once report probable success; without --verbose 'no news is good news' * sg_zone: add Remove element and modify zones command * sg_raw: increase maximum data-in and data-out buffer size from 64 KB to 1 MB - fix --cmdfile= handling - add --nvm option to send commands from the NVM command set - add --cmdset option to bypass cdb heuristic - add --scan= first_opcode,last_opcode * sg_pt_freebsd: allow device names without leading /dev/ thus fix for regression introduced in rev 731 (ver: 1.43) * sg_pt_solaris+sg_pt_osf1: fix problem with clear_scsi_pt_obj() which needs to remember is_nvme and dev_fd values * sg_lib: add ZBC (2020) feature set entries * sg_lib: restore elements and rebuild command added * sg_lib,sg_pt: add partial_clear_scsi_pt_obj(), get_scsi_pt_cdb_len() and get_scsi_pt_cdb_buf() - add do_nvm_pt() for the NVM (sub-)command set - tweak transport error handling in Linux * sg_lib: Linux NVMe SNTL: add read, write and verify; synchronize cache and write same translations - add dummy start stop unit and test unit ready commands - wire cache mpage's WCE to nvme 'volatile write cache' - fix crash in sg_f2hex_arr() when fname not found * sg_lib: reprint cdb with illegal request sense key - asc/ascq match asc-num.txt @t10 20200708 [spc6r02] * gcc-10: suppress warnings * autoconf: upgrade version 2.69 to 2.70 * remove space from end of source lines for git-svn * testing/sg_mrq_testing: new, for blocking mrq usage * testing/sgs_dd: add evfd flags and eventfd processing * testing: remove master-slave terminology for sgv4 * examples: add nvme_read_ctl.hex and nvme_write_ctl.hex - Earlier SUSE fixes included in 1.46: * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY (bsc#840054, bsc#1131482) - Update to version 1.47: * sg_rep_zones: add support for REPORT ZONE DOMAINS and REPORT REALMS in this utility * sg_raw: fix prints of NVMe NVM command names * sg_logs: additions to Volume statistics lpage [ssc5r05c] - additions to Command duration limits statistics log page [spc6r06] * sg_vpd: fix do_hex type on some recent pages - zoned block dev char vpd: add zone alignment mode and zone starting LBA granularity [zbc2r11] * sg_read_buffer: fix --length= problem * sg_dd, sgm_dd, sgp_dd: don't close negative file descriptors * sg_dd: srand48_r() and mrand48_r() are GNU libc specific, put conditional in so non-reentrant version used otherwise - 'iflag=00,ff' places the 32 bit block address (big endian) into each block * sgp_dd: major rework, fix issue with error being ignored - new: --chkaddr which checks for block address in each block - add check for stdatomic.h presence in configure.ac * sg_xcopy: tweak CSCD identification descriptor * sg_get_elem_status: fix issue with '--maxlen=' option - add 2 depopulation revocation health attributes [sbc5r01] * transport error handling improved. To fix report of a BAD_TARGET transport error but the utility still continued. - introduce SG_LIB_TRANSPORT_ERROR [35] exit status * several utilities: override '--maxlen=LEN' when LEN is < 16 (or 4), take default (or 4) instead * scripts: 55-scsi-sg3_id.rules remove outdated rule (bsc#1189297) * sg_lib: add sg_scsi_status_is_good(), sg_scsi_status_is_bad() and sg_get_zone_type_str() * pt_linux: fix verify(BytChk=0) which Linux SNTL translated to write, other SNTL cleanups * pt_linux_nvme: fix fua setting * pt: check_pt_file_handle() add return value of 5 for - _service updates: * re-enable service, hadn't been used for 1.46 release * use upstream author's git repository, simplify versioning scheme * use obscpio format - Update to version 1.47+2.388b767: * rescan-scsi-bus.sh: apply fix for '-r' (boo#1194293) * _service: use openSUSE github repo again (with cherry-picks from upstream) * spec file: suppress commit ID in library version - Update to version 1.47+3.adb7276: * rescan-scsi-bus.sh: fix garbled output (bsc#1195621) - Update to version 1.47+4.82fb156: * rescan_scsi_bus.sh: restore numeric ordering of hosts (bsc#1196244) - Update to version 1.47+5.d13bc56: * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248) - Update to version 1.47+13.75d23ac: * rescan-scsi-bus: speed large multipath scans (bsc#1207706) * rescan-scsi-bus.sh speed testonline() * rescan-scsi-bus.sh: add option --no-lip-scan * rescan-scsi-bus: sgdevice26: do not traverse sg class if scsi_device isnot added * rescan-scsi-bus.sh: fix handling of '-I <secs>' option - Update to version 1.47+15.b6898b8: * rescan-scsi-bus.sh: remove /tmp/rescan-scsi-mpath-info.txt (gh#doug-gilbert/sg3_utils#44) * rescan_scsi_bus.sh: fix multipath issue when called with -s and without -u (bsc#1215720, bsc#1216355) - Make sure initrd is rebuilt when sg3_utils is updated (bsc#1215772) - bsc#1160729: Make valid shell check only a warning * Add shadow-4.8-shell-check.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#1160729: Make valid shell check only a warning * Add shadow-4.8-shell-check.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#1160729: Make valid shell check only a warning * Add shadow-4.8-shell-check.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#1160729: Make valid shell check only a warning * Add shadow-4.8-shell-check.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - Set 0755 for chpasswd, groupadd, groupdel, groupmod, newusers, useradd, userdel, usermod explicitly. - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - bsc#1228770: Fix not copying of skel files Update shadow-CVE-2013-4235.patch - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - bsc#1228770: Fix not copying of skel files Update shadow-CVE-2013-4235.patch - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - bsc#1228770: Fix not copying of skel files Update shadow-CVE-2013-4235.patch - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed - Use pure #!/bin/sh in: * useradd.local * userdel-post.local * userdel-pre.local - login.defs: Add support for new util-linux-2.36 login variable MOTD_FIRSTONLY (shadow-util-linux.patch). - shadow-login_defs-comments.patch: Remove duplicated LASTLOG_UID_MAX. - shadow-login_defs-check.sh: Update for new build system. - shadow-util-linux.patch: Restore lost chunk: SYSLOG_SU_ENAB is not used in SUSE Linux. - Refresh shadow-login_defs-suse.patch and shadow-login_defs-comments.patch. - shadow-login_defs-check.sh: Fix the regexp to get a real variable list (boo#1164274). - Add support for /usr/etc/skel to useradd.local script (boo#1173321) - Change again useradd.local script to let it work even for system accounts and work together with SELinux (bsc#1178296) - Change patch useradd-script.patch to support the four arguments used by the useradd.local script (bsc#1178296) - Add patch useradd-userkeleton.patch to extend original C code of useradd to handle /usr/etc/skel (boo#1173321) - Remove /usr/etc/skel support in useradd.local script - Amend patches/useradd-userkeleton.patch to also write into existing directories and prefer files from /etc - Split login.defs configuration file into own sub-package, which allows to install util-linux or pam on small embedded/edge systems or container without the need to pull in the full shadow suite. - Do not require libeconf-devel on products without /usr/etc. - shadow-util-linux.patch: * Add support for LOGIN_KEEP_USERNAME from util-linux >= 2.37. - Refresh shadow-login_defs-suse.patch. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - Added patch: * shadow-4.8.1-AUDIT_NO_ID.patch + fix bsc#1205502: useradd audit event user id field cannot be interpreted - bsc#1210507 (CVE-2023-29383): Check for control characters - Add shadow-CVE-2023-29383.patch - bsc#1206627: Add --prefix support to passwd, chpasswd and chage Needed for YaST - Add shadow-4.8.1-add-prefix-passwd-chpasswd-chage.patch - bsc#1213189: Change lock mechanism to file locking to prevent lock files after power interruptions - Add shadow-4.8.1-lock-mechanism.patch - bsc#1214806 (CVE-2023-4641): Fix potential password leak - Add shadow-CVE-2023-4641.patch - bsc#1176006: Fix chage date miscalculation Add shadow-bsc1176006-chage-date.patch - bsc#1188307: Fix passwd segfault Add shadow-bsc1188307-passwd-segfault.patch - bsc#1203823: Remove pam_keyinit from PAM config files Remove pam_keyinit from PAM configuration. This was introduced for bsc#1144060. - bsc#916845 (CVE-2013-4235): Fix TOCTOU race condition Add shadow-CVE-2013-4235.patch - bsc#1228770: Fix not copying of skel files Update shadow-CVE-2013-4235.patch - Update to 15.7 (bsc#1198458)(jsc#PED-127) - Patches (git log --oneline --reverse 15.6..15.7) 0eb07e1 Make SBAT variable payload introspectable 092c2b2 Reference MokListRT instead of MokList 8b59b69 Add a link to the test plan in the readme. 4fd484e Enable TDX measurement to RTMR register 14d6339 Discard load-options that start with a NUL 5c537b3 shim: Flush the memory region from i-cache before execution 2d4ebb5 load_cert_file: Fix stack issue ea4911c load_cert_file: Use EFI RT memory function 0cf43ac Add -malign-double to IA32 compiler flags 17f0233 pe: Fix image section entry-point validation 5169769 make-archive: Build reproducible tarball aa1b289 mok: remove MokListTrusted from PCR 7 53509ea CryptoPkg/BaseCryptLib: fix NULL dereference 616c566 More coverity modeling ea0d0a5 Update shim's .sbat to sbat,3 dd8be98 Bump grub's sbat requirement to grub,3 1149161 (HEAD -> main, tag: 15.7, origin/main, origin/HEAD) Update version to 15.7 - 15.7 release note https://github.com/rhboot/shim/releases Make SBAT variable payload introspectable by @chrisccoulson in #483 Reference MokListRT instead of MokList by @esnowberg in #488 Add a link to the test plan in the readme. by @vathpela in #494 [V3] Enable TDX measurement to RTMR register by @kenplusplus in #485 Discard load-options that start with a NUL by @frozencemetery in #505 load_cert_file bugs by @esnowberg in #523 Add -malign-double to IA32 compiler flags by @nicholasbishop in #516 pe: Fix image section entry-point validation by @iokomin in #518 make-archive: Build reproducible tarball by @julian-klode in #527 mok: remove MokListTrusted from PCR 7 by @baloo in #519 - Drop upstreamed patch: - shim-bsc1177789-fix-null-pointer-deref-AuthenticodeVerify.patch - Cryptlib/CryptAuthenticode: fix NULL pointer dereference in AuthenticodeVerify() - 53509eaf22 15.7 - shim-jscPED-127-upgrade-shim-in-SLE15-SP5.patch - For backporting the following patches between 15.6 with aa1b289a1a (jsc#PED-127) - The following patches are merged to 15.7 aa1b289a1a mok: remove MokListTrusted from PCR 7 0cf43ac6d7 Add -malign-double to IA32 compiler flags ea4911c2f3 load_cert_file: Use EFI RT memory function 2d4ebb5a79 load_cert_file: Fix stack issue 5c537b3d0c shim: Flush the memory region from i-cache before execution 14d6339829 Discard load-options that start with a NUL 092c2b2bbe Reference MokListRT instead of MokList 0eb07e11b2 Make SBAT variable payload introspectable - Drop upstreamed patch: - shim-Enable-TDX-measurement-to-RTMR-register.patch - Enable TDX measurement to RTMR register (jsc#PED-1273) - 4fd484e4c2 15.7 - Add shim-Enable-the-NX-compatibility-flag-by-default.patch to enable the NX compatibility flag by default. (jsc#PED-127) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Kernel can boot with the NX compatibility flag since 82e0d6d76a2a7 be merged to v5.19. On the other hand, upstream is working on improve compressed kernel stage for NX: [PATCH v3 00/24] x86_64: Improvements at compressed kernel stage https://www.spinics.net/lists/kernel/msg4599636.html - Modified shim-install, add the following Olaf Kirch's patches to support full disk encryption: (jsc#PED-922) a5c57340740c Introduce --no-grub-install option 5c2c3addc51f Handle different cases of controlling cryptomount volumes during first stage boot 26c6bd5df7ae Have grub take a snapshot of "relevant" TPM PCRs - Removed shim-bsc1198101-opensuse-cert-prompt.patch (bsc#1198101) - Detail discussion is in bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1198101 - The shim community review and challenge this prompt. No other distro shows prompt (Have checked Fedora 37, CentOS 9 and Ubuntu 22.10). Currently, it blocked the review process of openSUSE shim. - Other distros lock-down kernel when secure boot is enabled. Some of them used different key for signing kernel binary with In-tree kernel module. And their build service does not provide signed Out-off-tree module. - Updated shim signature after shim 15.7 of SLE be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458, CVE-2022-28737) - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588) - Upgrade shim-install for bsc#1210382 After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated. The 86b73d1 patch added the logic that using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated. - https://github.com/SUSE/shim-resources (git log --oneline) 86b73d1 Fix that bootx64.efi is not updated on Leap f2e8143 Use the long name to specify the grub2 key protector 7283012 cryptodisk: support TPM authorized policies 49e7a0d Do not use tpm_record_pcrs unless the command is in command.lst 26c6bd5 Have grub take a snapshot of "relevant" TPM PCRs 5c2c3ad Handle different cases of controlling cryptomount volumes during first stage boot a5c5734 Introduce --no-grub-install option - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Update shim-install to amend full disk encryption support b540061e041b Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector f2e8143ce831 Use the long name to specify the grub2 key protector 72830120e5ea cryptodisk: support TPM authorized policies 49e7a0d307f3 Do not use tpm_record_pcrs unless the command is in command.lst - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) 226c94ca5cfca Use hint in looking for root if possible - Don't require grub so shim can still be used with systemd-boot - Generate dbx during build so we don't include binary files in sources -- Update to version 15.8 - Various CVE fixes are already merged into this version mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) - remove shim-Enable-the-NX-compatibility-flag-by-default.patch The codes in this patch are already existing in shim-15.8 The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Patches (git log --oneline --reverse 15.7..15.8) 657b248 Make sbat_var.S parse right with buggy gcc/binutils 7c76425 Enable the NX compatibility flag by default. 89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper c7b3051 pe: Align section size up to page size for mem attrs e4f40ae pe: Add IS_PAGE_ALIGNED macro f23883c Don't loop forever in load_certs() with buggy firmware 1f38cb3 Optionally allow to keep shim protocol installed 102a658 Drop invalid calls to `CRYPTO_set_mem_functions` aae3df0 test-sbat: Fix exit code cca3933 Block Debian grub binaries with SBAT < 4 cf59f34 Further improve load_certs() for non-compliant drivers/firmwares 0601f44 SBAT-related documents formatting and spelling 0640e13 Add a security contact email address in README.md 0bfc397 Work around malformed path delimiters in file paths from DHCP a8b0b60 pe: only process RelocDir->Size of reloc section f7a4338 Skip testing msleep() 549d346 Rename 'msecs' to 'usecs' to avoid potential confusion 908c388 Change type of fallback_verbose_wait from int to unsigned long 05eae92 Add SbatLevel_Variable.txt to document the various revocations 243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL 89d25a1 Add a make rule for compile_commands.json 118ff87 Add gnu-stack notes f132655 test: Make our fake dprintf be a statement. be00279 Remove CentOS 7 test builds. 9964960 Split pe.c up even more. 569270d Test (and fix) ImageAddress() 61e9894 Verify signature before verifying sbat levels 1578b55 Add libFuzzer support for csv.c a0673e3 Fix a 1-byte memory leak in .sbat parsing. e246812 Add libFuzzer support to the .sbat parser. fd43eda Work around ImageAddress() usage mistake 1e985a3 Correctly free memory allocated in handle_image() dbbe3c8 mok: Avoid underflow in maximum variable size calculation 04111d4 Make some of the static analysis tools a little easier to run 7ba7440 compile_commands.json: remove stuff clang doesn't like 66e6579 CVE-2023-40546 mok: fix LogError() invocation f271826 Add primitives for overflow-checked arithmetic operations. 8372147 pe-relocate: Add a fuzzer for read_header() 5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries e912071 pe-relocate: make read_header() use checked arithmetic operations. 93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550 afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds. 96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system dae82f6 Further mitigations against CVE-2023-40546 as a class ea0f9df Allow SbatLevel data from external binary b078ef2 Always clear SbatLevel when Secure Boot is disabled 7dfb687 BS Variables for bootmgr revocations a967c0e shim should not self revoke 577cedd Print message when refusing to apply SbatLevel e801b0d sbat revocations: check the full section name 0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers 6f0c8d2 Print errors when setting/clearing memory attrs 57c0eed Updated Revocations for January 2024 CVEs 49c6d95 Fix some minor ia32 build issues. be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all. 13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5 c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist 30a4f37 Rename "previous" revocations to "automatic" 6f395c2 Build time selectable automatic SBATLevel revocations a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER 993a345 Try to load revocations.efi even if directory read fails 1770a03 gitmodules: use shim-15.8 for gnu-efi branch 5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8 - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) 92d0f4305df73 Set the SRK algorithm for the TPM2 protector - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Sync the changelog between openSUSE:Factory/shim with SLE-15-SP3/shim - Add CVE-2022-28737 number to "Mon Mar 27 09:26:02 UTC 2023" record - Add "Thu Apr 13 05:28:10 UTC 2023" record for updating shim-install for bsc#1210382. - Add "Thu Apr 13 09:13:22 UTC 2023" record for changing the logic of checking shim signature. - update public keys of shim-15.8 after it has been signed back from Microsoft. - Update to 15.7 (bsc#1198458)(jsc#PED-127) - Patches (git log --oneline --reverse 15.6..15.7) 0eb07e1 Make SBAT variable payload introspectable 092c2b2 Reference MokListRT instead of MokList 8b59b69 Add a link to the test plan in the readme. 4fd484e Enable TDX measurement to RTMR register 14d6339 Discard load-options that start with a NUL 5c537b3 shim: Flush the memory region from i-cache before execution 2d4ebb5 load_cert_file: Fix stack issue ea4911c load_cert_file: Use EFI RT memory function 0cf43ac Add -malign-double to IA32 compiler flags 17f0233 pe: Fix image section entry-point validation 5169769 make-archive: Build reproducible tarball aa1b289 mok: remove MokListTrusted from PCR 7 53509ea CryptoPkg/BaseCryptLib: fix NULL dereference 616c566 More coverity modeling ea0d0a5 Update shim's .sbat to sbat,3 dd8be98 Bump grub's sbat requirement to grub,3 1149161 (HEAD -> main, tag: 15.7, origin/main, origin/HEAD) Update version to 15.7 - 15.7 release note https://github.com/rhboot/shim/releases Make SBAT variable payload introspectable by @chrisccoulson in #483 Reference MokListRT instead of MokList by @esnowberg in #488 Add a link to the test plan in the readme. by @vathpela in #494 [V3] Enable TDX measurement to RTMR register by @kenplusplus in #485 Discard load-options that start with a NUL by @frozencemetery in #505 load_cert_file bugs by @esnowberg in #523 Add -malign-double to IA32 compiler flags by @nicholasbishop in #516 pe: Fix image section entry-point validation by @iokomin in #518 make-archive: Build reproducible tarball by @julian-klode in #527 mok: remove MokListTrusted from PCR 7 by @baloo in #519 - Drop upstreamed patch: - shim-bsc1177789-fix-null-pointer-deref-AuthenticodeVerify.patch - Cryptlib/CryptAuthenticode: fix NULL pointer dereference in AuthenticodeVerify() - 53509eaf22 15.7 - shim-jscPED-127-upgrade-shim-in-SLE15-SP5.patch - For backporting the following patches between 15.6 with aa1b289a1a (jsc#PED-127) - The following patches are merged to 15.7 aa1b289a1a mok: remove MokListTrusted from PCR 7 0cf43ac6d7 Add -malign-double to IA32 compiler flags ea4911c2f3 load_cert_file: Use EFI RT memory function 2d4ebb5a79 load_cert_file: Fix stack issue 5c537b3d0c shim: Flush the memory region from i-cache before execution 14d6339829 Discard load-options that start with a NUL 092c2b2bbe Reference MokListRT instead of MokList 0eb07e11b2 Make SBAT variable payload introspectable - Drop upstreamed patch: - shim-Enable-TDX-measurement-to-RTMR-register.patch - Enable TDX measurement to RTMR register (jsc#PED-1273) - 4fd484e4c2 15.7 - Add shim-Enable-the-NX-compatibility-flag-by-default.patch to enable the NX compatibility flag by default. (jsc#PED-127) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Kernel can boot with the NX compatibility flag since 82e0d6d76a2a7 be merged to v5.19. On the other hand, upstream is working on improve compressed kernel stage for NX: [PATCH v3 00/24] x86_64: Improvements at compressed kernel stage https://www.spinics.net/lists/kernel/msg4599636.html - Modified shim-install, add the following Olaf Kirch's patches to support full disk encryption: (jsc#PED-922) a5c57340740c Introduce --no-grub-install option 5c2c3addc51f Handle different cases of controlling cryptomount volumes during first stage boot 26c6bd5df7ae Have grub take a snapshot of "relevant" TPM PCRs - Removed shim-bsc1198101-opensuse-cert-prompt.patch (bsc#1198101) - Detail discussion is in bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1198101 - The shim community review and challenge this prompt. No other distro shows prompt (Have checked Fedora 37, CentOS 9 and Ubuntu 22.10). Currently, it blocked the review process of openSUSE shim. - Other distros lock-down kernel when secure boot is enabled. Some of them used different key for signing kernel binary with In-tree kernel module. And their build service does not provide signed Out-off-tree module. - Updated shim signature after shim 15.7 of SLE be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458, CVE-2022-28737) - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588) - Upgrade shim-install for bsc#1210382 After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated. The 86b73d1 patch added the logic that using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated. - https://github.com/SUSE/shim-resources (git log --oneline) 86b73d1 Fix that bootx64.efi is not updated on Leap f2e8143 Use the long name to specify the grub2 key protector 7283012 cryptodisk: support TPM authorized policies 49e7a0d Do not use tpm_record_pcrs unless the command is in command.lst 26c6bd5 Have grub take a snapshot of "relevant" TPM PCRs 5c2c3ad Handle different cases of controlling cryptomount volumes during first stage boot a5c5734 Introduce --no-grub-install option - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Update shim-install to amend full disk encryption support b540061e041b Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector f2e8143ce831 Use the long name to specify the grub2 key protector 72830120e5ea cryptodisk: support TPM authorized policies 49e7a0d307f3 Do not use tpm_record_pcrs unless the command is in command.lst - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) 226c94ca5cfca Use hint in looking for root if possible - Don't require grub so shim can still be used with systemd-boot - Generate dbx during build so we don't include binary files in sources -- Update to version 15.8 - Various CVE fixes are already merged into this version mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) - remove shim-Enable-the-NX-compatibility-flag-by-default.patch The codes in this patch are already existing in shim-15.8 The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Patches (git log --oneline --reverse 15.7..15.8) 657b248 Make sbat_var.S parse right with buggy gcc/binutils 7c76425 Enable the NX compatibility flag by default. 89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper c7b3051 pe: Align section size up to page size for mem attrs e4f40ae pe: Add IS_PAGE_ALIGNED macro f23883c Don't loop forever in load_certs() with buggy firmware 1f38cb3 Optionally allow to keep shim protocol installed 102a658 Drop invalid calls to `CRYPTO_set_mem_functions` aae3df0 test-sbat: Fix exit code cca3933 Block Debian grub binaries with SBAT < 4 cf59f34 Further improve load_certs() for non-compliant drivers/firmwares 0601f44 SBAT-related documents formatting and spelling 0640e13 Add a security contact email address in README.md 0bfc397 Work around malformed path delimiters in file paths from DHCP a8b0b60 pe: only process RelocDir->Size of reloc section f7a4338 Skip testing msleep() 549d346 Rename 'msecs' to 'usecs' to avoid potential confusion 908c388 Change type of fallback_verbose_wait from int to unsigned long 05eae92 Add SbatLevel_Variable.txt to document the various revocations 243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL 89d25a1 Add a make rule for compile_commands.json 118ff87 Add gnu-stack notes f132655 test: Make our fake dprintf be a statement. be00279 Remove CentOS 7 test builds. 9964960 Split pe.c up even more. 569270d Test (and fix) ImageAddress() 61e9894 Verify signature before verifying sbat levels 1578b55 Add libFuzzer support for csv.c a0673e3 Fix a 1-byte memory leak in .sbat parsing. e246812 Add libFuzzer support to the .sbat parser. fd43eda Work around ImageAddress() usage mistake 1e985a3 Correctly free memory allocated in handle_image() dbbe3c8 mok: Avoid underflow in maximum variable size calculation 04111d4 Make some of the static analysis tools a little easier to run 7ba7440 compile_commands.json: remove stuff clang doesn't like 66e6579 CVE-2023-40546 mok: fix LogError() invocation f271826 Add primitives for overflow-checked arithmetic operations. 8372147 pe-relocate: Add a fuzzer for read_header() 5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries e912071 pe-relocate: make read_header() use checked arithmetic operations. 93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550 afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds. 96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system dae82f6 Further mitigations against CVE-2023-40546 as a class ea0f9df Allow SbatLevel data from external binary b078ef2 Always clear SbatLevel when Secure Boot is disabled 7dfb687 BS Variables for bootmgr revocations a967c0e shim should not self revoke 577cedd Print message when refusing to apply SbatLevel e801b0d sbat revocations: check the full section name 0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers 6f0c8d2 Print errors when setting/clearing memory attrs 57c0eed Updated Revocations for January 2024 CVEs 49c6d95 Fix some minor ia32 build issues. be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all. 13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5 c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist 30a4f37 Rename "previous" revocations to "automatic" 6f395c2 Build time selectable automatic SBATLevel revocations a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER 993a345 Try to load revocations.efi even if directory read fails 1770a03 gitmodules: use shim-15.8 for gnu-efi branch 5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8 - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) 92d0f4305df73 Set the SRK algorithm for the TPM2 protector - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Sync the changelog between openSUSE:Factory/shim with SLE-15-SP3/shim - Add CVE-2022-28737 number to "Mon Mar 27 09:26:02 UTC 2023" record - Add "Thu Apr 13 05:28:10 UTC 2023" record for updating shim-install for bsc#1210382. - Add "Thu Apr 13 09:13:22 UTC 2023" record for changing the logic of checking shim signature. - update public keys of shim-15.8 after it has been signed back from Microsoft. - Update to 15.7 (bsc#1198458)(jsc#PED-127) - Patches (git log --oneline --reverse 15.6..15.7) 0eb07e1 Make SBAT variable payload introspectable 092c2b2 Reference MokListRT instead of MokList 8b59b69 Add a link to the test plan in the readme. 4fd484e Enable TDX measurement to RTMR register 14d6339 Discard load-options that start with a NUL 5c537b3 shim: Flush the memory region from i-cache before execution 2d4ebb5 load_cert_file: Fix stack issue ea4911c load_cert_file: Use EFI RT memory function 0cf43ac Add -malign-double to IA32 compiler flags 17f0233 pe: Fix image section entry-point validation 5169769 make-archive: Build reproducible tarball aa1b289 mok: remove MokListTrusted from PCR 7 53509ea CryptoPkg/BaseCryptLib: fix NULL dereference 616c566 More coverity modeling ea0d0a5 Update shim's .sbat to sbat,3 dd8be98 Bump grub's sbat requirement to grub,3 1149161 (HEAD -> main, tag: 15.7, origin/main, origin/HEAD) Update version to 15.7 - 15.7 release note https://github.com/rhboot/shim/releases Make SBAT variable payload introspectable by @chrisccoulson in #483 Reference MokListRT instead of MokList by @esnowberg in #488 Add a link to the test plan in the readme. by @vathpela in #494 [V3] Enable TDX measurement to RTMR register by @kenplusplus in #485 Discard load-options that start with a NUL by @frozencemetery in #505 load_cert_file bugs by @esnowberg in #523 Add -malign-double to IA32 compiler flags by @nicholasbishop in #516 pe: Fix image section entry-point validation by @iokomin in #518 make-archive: Build reproducible tarball by @julian-klode in #527 mok: remove MokListTrusted from PCR 7 by @baloo in #519 - Drop upstreamed patch: - shim-bsc1177789-fix-null-pointer-deref-AuthenticodeVerify.patch - Cryptlib/CryptAuthenticode: fix NULL pointer dereference in AuthenticodeVerify() - 53509eaf22 15.7 - shim-jscPED-127-upgrade-shim-in-SLE15-SP5.patch - For backporting the following patches between 15.6 with aa1b289a1a (jsc#PED-127) - The following patches are merged to 15.7 aa1b289a1a mok: remove MokListTrusted from PCR 7 0cf43ac6d7 Add -malign-double to IA32 compiler flags ea4911c2f3 load_cert_file: Use EFI RT memory function 2d4ebb5a79 load_cert_file: Fix stack issue 5c537b3d0c shim: Flush the memory region from i-cache before execution 14d6339829 Discard load-options that start with a NUL 092c2b2bbe Reference MokListRT instead of MokList 0eb07e11b2 Make SBAT variable payload introspectable - Drop upstreamed patch: - shim-Enable-TDX-measurement-to-RTMR-register.patch - Enable TDX measurement to RTMR register (jsc#PED-1273) - 4fd484e4c2 15.7 - Add shim-Enable-the-NX-compatibility-flag-by-default.patch to enable the NX compatibility flag by default. (jsc#PED-127) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Kernel can boot with the NX compatibility flag since 82e0d6d76a2a7 be merged to v5.19. On the other hand, upstream is working on improve compressed kernel stage for NX: [PATCH v3 00/24] x86_64: Improvements at compressed kernel stage https://www.spinics.net/lists/kernel/msg4599636.html - Modified shim-install, add the following Olaf Kirch's patches to support full disk encryption: (jsc#PED-922) a5c57340740c Introduce --no-grub-install option 5c2c3addc51f Handle different cases of controlling cryptomount volumes during first stage boot 26c6bd5df7ae Have grub take a snapshot of "relevant" TPM PCRs - Removed shim-bsc1198101-opensuse-cert-prompt.patch (bsc#1198101) - Detail discussion is in bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1198101 - The shim community review and challenge this prompt. No other distro shows prompt (Have checked Fedora 37, CentOS 9 and Ubuntu 22.10). Currently, it blocked the review process of openSUSE shim. - Other distros lock-down kernel when secure boot is enabled. Some of them used different key for signing kernel binary with In-tree kernel module. And their build service does not provide signed Out-off-tree module. - Updated shim signature after shim 15.7 of SLE be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458, CVE-2022-28737) - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588) - Upgrade shim-install for bsc#1210382 After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated. The 86b73d1 patch added the logic that using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated. - https://github.com/SUSE/shim-resources (git log --oneline) 86b73d1 Fix that bootx64.efi is not updated on Leap f2e8143 Use the long name to specify the grub2 key protector 7283012 cryptodisk: support TPM authorized policies 49e7a0d Do not use tpm_record_pcrs unless the command is in command.lst 26c6bd5 Have grub take a snapshot of "relevant" TPM PCRs 5c2c3ad Handle different cases of controlling cryptomount volumes during first stage boot a5c5734 Introduce --no-grub-install option - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Update shim-install to amend full disk encryption support b540061e041b Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector f2e8143ce831 Use the long name to specify the grub2 key protector 72830120e5ea cryptodisk: support TPM authorized policies 49e7a0d307f3 Do not use tpm_record_pcrs unless the command is in command.lst - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) 226c94ca5cfca Use hint in looking for root if possible - Don't require grub so shim can still be used with systemd-boot - Generate dbx during build so we don't include binary files in sources -- Update to version 15.8 - Various CVE fixes are already merged into this version mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) - remove shim-Enable-the-NX-compatibility-flag-by-default.patch The codes in this patch are already existing in shim-15.8 The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Patches (git log --oneline --reverse 15.7..15.8) 657b248 Make sbat_var.S parse right with buggy gcc/binutils 7c76425 Enable the NX compatibility flag by default. 89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper c7b3051 pe: Align section size up to page size for mem attrs e4f40ae pe: Add IS_PAGE_ALIGNED macro f23883c Don't loop forever in load_certs() with buggy firmware 1f38cb3 Optionally allow to keep shim protocol installed 102a658 Drop invalid calls to `CRYPTO_set_mem_functions` aae3df0 test-sbat: Fix exit code cca3933 Block Debian grub binaries with SBAT < 4 cf59f34 Further improve load_certs() for non-compliant drivers/firmwares 0601f44 SBAT-related documents formatting and spelling 0640e13 Add a security contact email address in README.md 0bfc397 Work around malformed path delimiters in file paths from DHCP a8b0b60 pe: only process RelocDir->Size of reloc section f7a4338 Skip testing msleep() 549d346 Rename 'msecs' to 'usecs' to avoid potential confusion 908c388 Change type of fallback_verbose_wait from int to unsigned long 05eae92 Add SbatLevel_Variable.txt to document the various revocations 243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL 89d25a1 Add a make rule for compile_commands.json 118ff87 Add gnu-stack notes f132655 test: Make our fake dprintf be a statement. be00279 Remove CentOS 7 test builds. 9964960 Split pe.c up even more. 569270d Test (and fix) ImageAddress() 61e9894 Verify signature before verifying sbat levels 1578b55 Add libFuzzer support for csv.c a0673e3 Fix a 1-byte memory leak in .sbat parsing. e246812 Add libFuzzer support to the .sbat parser. fd43eda Work around ImageAddress() usage mistake 1e985a3 Correctly free memory allocated in handle_image() dbbe3c8 mok: Avoid underflow in maximum variable size calculation 04111d4 Make some of the static analysis tools a little easier to run 7ba7440 compile_commands.json: remove stuff clang doesn't like 66e6579 CVE-2023-40546 mok: fix LogError() invocation f271826 Add primitives for overflow-checked arithmetic operations. 8372147 pe-relocate: Add a fuzzer for read_header() 5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries e912071 pe-relocate: make read_header() use checked arithmetic operations. 93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550 afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds. 96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system dae82f6 Further mitigations against CVE-2023-40546 as a class ea0f9df Allow SbatLevel data from external binary b078ef2 Always clear SbatLevel when Secure Boot is disabled 7dfb687 BS Variables for bootmgr revocations a967c0e shim should not self revoke 577cedd Print message when refusing to apply SbatLevel e801b0d sbat revocations: check the full section name 0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers 6f0c8d2 Print errors when setting/clearing memory attrs 57c0eed Updated Revocations for January 2024 CVEs 49c6d95 Fix some minor ia32 build issues. be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all. 13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5 c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist 30a4f37 Rename "previous" revocations to "automatic" 6f395c2 Build time selectable automatic SBATLevel revocations a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER 993a345 Try to load revocations.efi even if directory read fails 1770a03 gitmodules: use shim-15.8 for gnu-efi branch 5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8 - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) 92d0f4305df73 Set the SRK algorithm for the TPM2 protector - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Sync the changelog between openSUSE:Factory/shim with SLE-15-SP3/shim - Add CVE-2022-28737 number to "Mon Mar 27 09:26:02 UTC 2023" record - Add "Thu Apr 13 05:28:10 UTC 2023" record for updating shim-install for bsc#1210382. - Add "Thu Apr 13 09:13:22 UTC 2023" record for changing the logic of checking shim signature. - update public keys of shim-15.8 after it has been signed back from Microsoft. - Drop upstreamed patch: - shim-Enable-TDX-measurement-to-RTMR-register.patch - Enable TDX measurement to RTMR register (jsc#PED-1273) - 4fd484e4c2 15.7 - Add shim-Enable-the-NX-compatibility-flag-by-default.patch to enable the NX compatibility flag by default. (jsc#PED-127) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Kernel can boot with the NX compatibility flag since 82e0d6d76a2a7 be merged to v5.19. On the other hand, upstream is working on improve compressed kernel stage for NX: [PATCH v3 00/24] x86_64: Improvements at compressed kernel stage https://www.spinics.net/lists/kernel/msg4599636.html - Modified shim-install, add the following Olaf Kirch's patches to support full disk encryption: (jsc#PED-922) a5c57340740c Introduce --no-grub-install option 5c2c3addc51f Handle different cases of controlling cryptomount volumes during first stage boot 26c6bd5df7ae Have grub take a snapshot of "relevant" TPM PCRs - Removed shim-bsc1198101-opensuse-cert-prompt.patch (bsc#1198101) - Detail discussion is in bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1198101 - The shim community review and challenge this prompt. No other distro shows prompt (Have checked Fedora 37, CentOS 9 and Ubuntu 22.10). Currently, it blocked the review process of openSUSE shim. - Other distros lock-down kernel when secure boot is enabled. Some of them used different key for signing kernel binary with In-tree kernel module. And their build service does not provide signed Out-off-tree module. - Updated shim signature after shim 15.7 of SLE be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458, CVE-2022-28737) - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588) - Upgrade shim-install for bsc#1210382 After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated. The 86b73d1 patch added the logic that using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated. - https://github.com/SUSE/shim-resources (git log --oneline) 86b73d1 Fix that bootx64.efi is not updated on Leap f2e8143 Use the long name to specify the grub2 key protector 7283012 cryptodisk: support TPM authorized policies 49e7a0d Do not use tpm_record_pcrs unless the command is in command.lst 26c6bd5 Have grub take a snapshot of "relevant" TPM PCRs 5c2c3ad Handle different cases of controlling cryptomount volumes during first stage boot a5c5734 Introduce --no-grub-install option - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Update shim-install to amend full disk encryption support b540061e041b Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector f2e8143ce831 Use the long name to specify the grub2 key protector 72830120e5ea cryptodisk: support TPM authorized policies 49e7a0d307f3 Do not use tpm_record_pcrs unless the command is in command.lst - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) 226c94ca5cfca Use hint in looking for root if possible - Don't require grub so shim can still be used with systemd-boot - Generate dbx during build so we don't include binary files in sources -- Update to version 15.8 - Various CVE fixes are already merged into this version mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) - remove shim-Enable-the-NX-compatibility-flag-by-default.patch The codes in this patch are already existing in shim-15.8 The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Patches (git log --oneline --reverse 15.7..15.8) 657b248 Make sbat_var.S parse right with buggy gcc/binutils 7c76425 Enable the NX compatibility flag by default. 89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper c7b3051 pe: Align section size up to page size for mem attrs e4f40ae pe: Add IS_PAGE_ALIGNED macro f23883c Don't loop forever in load_certs() with buggy firmware 1f38cb3 Optionally allow to keep shim protocol installed 102a658 Drop invalid calls to `CRYPTO_set_mem_functions` aae3df0 test-sbat: Fix exit code cca3933 Block Debian grub binaries with SBAT < 4 cf59f34 Further improve load_certs() for non-compliant drivers/firmwares 0601f44 SBAT-related documents formatting and spelling 0640e13 Add a security contact email address in README.md 0bfc397 Work around malformed path delimiters in file paths from DHCP a8b0b60 pe: only process RelocDir->Size of reloc section f7a4338 Skip testing msleep() 549d346 Rename 'msecs' to 'usecs' to avoid potential confusion 908c388 Change type of fallback_verbose_wait from int to unsigned long 05eae92 Add SbatLevel_Variable.txt to document the various revocations 243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL 89d25a1 Add a make rule for compile_commands.json 118ff87 Add gnu-stack notes f132655 test: Make our fake dprintf be a statement. be00279 Remove CentOS 7 test builds. 9964960 Split pe.c up even more. 569270d Test (and fix) ImageAddress() 61e9894 Verify signature before verifying sbat levels 1578b55 Add libFuzzer support for csv.c a0673e3 Fix a 1-byte memory leak in .sbat parsing. e246812 Add libFuzzer support to the .sbat parser. fd43eda Work around ImageAddress() usage mistake 1e985a3 Correctly free memory allocated in handle_image() dbbe3c8 mok: Avoid underflow in maximum variable size calculation 04111d4 Make some of the static analysis tools a little easier to run 7ba7440 compile_commands.json: remove stuff clang doesn't like 66e6579 CVE-2023-40546 mok: fix LogError() invocation f271826 Add primitives for overflow-checked arithmetic operations. 8372147 pe-relocate: Add a fuzzer for read_header() 5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries e912071 pe-relocate: make read_header() use checked arithmetic operations. 93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550 afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds. 96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system dae82f6 Further mitigations against CVE-2023-40546 as a class ea0f9df Allow SbatLevel data from external binary b078ef2 Always clear SbatLevel when Secure Boot is disabled 7dfb687 BS Variables for bootmgr revocations a967c0e shim should not self revoke 577cedd Print message when refusing to apply SbatLevel e801b0d sbat revocations: check the full section name 0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers 6f0c8d2 Print errors when setting/clearing memory attrs 57c0eed Updated Revocations for January 2024 CVEs 49c6d95 Fix some minor ia32 build issues. be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all. 13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5 c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist 30a4f37 Rename "previous" revocations to "automatic" 6f395c2 Build time selectable automatic SBATLevel revocations a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER 993a345 Try to load revocations.efi even if directory read fails 1770a03 gitmodules: use shim-15.8 for gnu-efi branch 5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8 - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) 92d0f4305df73 Set the SRK algorithm for the TPM2 protector - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Sync the changelog between openSUSE:Factory/shim with SLE-15-SP3/shim - Add CVE-2022-28737 number to "Mon Mar 27 09:26:02 UTC 2023" record - Add "Thu Apr 13 05:28:10 UTC 2023" record for updating shim-install for bsc#1210382. - Add "Thu Apr 13 09:13:22 UTC 2023" record for changing the logic of checking shim signature. - update public keys of shim-15.8 after it has been signed back from Microsoft. - Update shim-install to apply the missing fix for openSUSE Leap (bsc#1210382) fixed by Gary. * 86b73d1 Fix that bootx64.efi is not updated on Leap - Update shim-install to use the 'removable' way for SL-Micro (bsc#1230316) fixed by Gary. * 433cc4e Always use the removable way for SL-Micro - Drop upstreamed patch: - shim-Enable-TDX-measurement-to-RTMR-register.patch - Enable TDX measurement to RTMR register (jsc#PED-1273) - 4fd484e4c2 15.7 - Add shim-Enable-the-NX-compatibility-flag-by-default.patch to enable the NX compatibility flag by default. (jsc#PED-127) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Kernel can boot with the NX compatibility flag since 82e0d6d76a2a7 be merged to v5.19. On the other hand, upstream is working on improve compressed kernel stage for NX: [PATCH v3 00/24] x86_64: Improvements at compressed kernel stage https://www.spinics.net/lists/kernel/msg4599636.html - Modified shim-install, add the following Olaf Kirch's patches to support full disk encryption: (jsc#PED-922) a5c57340740c Introduce --no-grub-install option 5c2c3addc51f Handle different cases of controlling cryptomount volumes during first stage boot 26c6bd5df7ae Have grub take a snapshot of "relevant" TPM PCRs - Removed shim-bsc1198101-opensuse-cert-prompt.patch (bsc#1198101) - Detail discussion is in bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1198101 - The shim community review and challenge this prompt. No other distro shows prompt (Have checked Fedora 37, CentOS 9 and Ubuntu 22.10). Currently, it blocked the review process of openSUSE shim. - Other distros lock-down kernel when secure boot is enabled. Some of them used different key for signing kernel binary with In-tree kernel module. And their build service does not provide signed Out-off-tree module. - Updated shim signature after shim 15.7 of SLE be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458, CVE-2022-28737) - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588) - Upgrade shim-install for bsc#1210382 After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated. The 86b73d1 patch added the logic that using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated. - https://github.com/SUSE/shim-resources (git log --oneline) 86b73d1 Fix that bootx64.efi is not updated on Leap f2e8143 Use the long name to specify the grub2 key protector 7283012 cryptodisk: support TPM authorized policies 49e7a0d Do not use tpm_record_pcrs unless the command is in command.lst 26c6bd5 Have grub take a snapshot of "relevant" TPM PCRs 5c2c3ad Handle different cases of controlling cryptomount volumes during first stage boot a5c5734 Introduce --no-grub-install option - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Update shim-install to amend full disk encryption support b540061e041b Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector f2e8143ce831 Use the long name to specify the grub2 key protector 72830120e5ea cryptodisk: support TPM authorized policies 49e7a0d307f3 Do not use tpm_record_pcrs unless the command is in command.lst - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) 226c94ca5cfca Use hint in looking for root if possible - Don't require grub so shim can still be used with systemd-boot - Generate dbx during build so we don't include binary files in sources -- Update to version 15.8 - Various CVE fixes are already merged into this version mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) - remove shim-Enable-the-NX-compatibility-flag-by-default.patch The codes in this patch are already existing in shim-15.8 The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Patches (git log --oneline --reverse 15.7..15.8) 657b248 Make sbat_var.S parse right with buggy gcc/binutils 7c76425 Enable the NX compatibility flag by default. 89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper c7b3051 pe: Align section size up to page size for mem attrs e4f40ae pe: Add IS_PAGE_ALIGNED macro f23883c Don't loop forever in load_certs() with buggy firmware 1f38cb3 Optionally allow to keep shim protocol installed 102a658 Drop invalid calls to `CRYPTO_set_mem_functions` aae3df0 test-sbat: Fix exit code cca3933 Block Debian grub binaries with SBAT < 4 cf59f34 Further improve load_certs() for non-compliant drivers/firmwares 0601f44 SBAT-related documents formatting and spelling 0640e13 Add a security contact email address in README.md 0bfc397 Work around malformed path delimiters in file paths from DHCP a8b0b60 pe: only process RelocDir->Size of reloc section f7a4338 Skip testing msleep() 549d346 Rename 'msecs' to 'usecs' to avoid potential confusion 908c388 Change type of fallback_verbose_wait from int to unsigned long 05eae92 Add SbatLevel_Variable.txt to document the various revocations 243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL 89d25a1 Add a make rule for compile_commands.json 118ff87 Add gnu-stack notes f132655 test: Make our fake dprintf be a statement. be00279 Remove CentOS 7 test builds. 9964960 Split pe.c up even more. 569270d Test (and fix) ImageAddress() 61e9894 Verify signature before verifying sbat levels 1578b55 Add libFuzzer support for csv.c a0673e3 Fix a 1-byte memory leak in .sbat parsing. e246812 Add libFuzzer support to the .sbat parser. fd43eda Work around ImageAddress() usage mistake 1e985a3 Correctly free memory allocated in handle_image() dbbe3c8 mok: Avoid underflow in maximum variable size calculation 04111d4 Make some of the static analysis tools a little easier to run 7ba7440 compile_commands.json: remove stuff clang doesn't like 66e6579 CVE-2023-40546 mok: fix LogError() invocation f271826 Add primitives for overflow-checked arithmetic operations. 8372147 pe-relocate: Add a fuzzer for read_header() 5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries e912071 pe-relocate: make read_header() use checked arithmetic operations. 93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550 afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds. 96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system dae82f6 Further mitigations against CVE-2023-40546 as a class ea0f9df Allow SbatLevel data from external binary b078ef2 Always clear SbatLevel when Secure Boot is disabled 7dfb687 BS Variables for bootmgr revocations a967c0e shim should not self revoke 577cedd Print message when refusing to apply SbatLevel e801b0d sbat revocations: check the full section name 0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers 6f0c8d2 Print errors when setting/clearing memory attrs 57c0eed Updated Revocations for January 2024 CVEs 49c6d95 Fix some minor ia32 build issues. be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all. 13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5 c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist 30a4f37 Rename "previous" revocations to "automatic" 6f395c2 Build time selectable automatic SBATLevel revocations a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER 993a345 Try to load revocations.efi even if directory read fails 1770a03 gitmodules: use shim-15.8 for gnu-efi branch 5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8 - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) 92d0f4305df73 Set the SRK algorithm for the TPM2 protector - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Sync the changelog between openSUSE:Factory/shim with SLE-15-SP3/shim - Add CVE-2022-28737 number to "Mon Mar 27 09:26:02 UTC 2023" record - Add "Thu Apr 13 05:28:10 UTC 2023" record for updating shim-install for bsc#1210382. - Add "Thu Apr 13 09:13:22 UTC 2023" record for changing the logic of checking shim signature. - update public keys of shim-15.8 after it has been signed back from Microsoft. - Update shim-install to apply the missing fix for openSUSE Leap (bsc#1210382) fixed by Gary. * 86b73d1 Fix that bootx64.efi is not updated on Leap - Update shim-install to use the 'removable' way for SL-Micro (bsc#1230316) fixed by Gary. * 433cc4e Always use the removable way for SL-Micro - Drop upstreamed patch: - shim-Enable-TDX-measurement-to-RTMR-register.patch - Enable TDX measurement to RTMR register (jsc#PED-1273) - 4fd484e4c2 15.7 - Add shim-Enable-the-NX-compatibility-flag-by-default.patch to enable the NX compatibility flag by default. (jsc#PED-127) - Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) - Kernel can boot with the NX compatibility flag since 82e0d6d76a2a7 be merged to v5.19. On the other hand, upstream is working on improve compressed kernel stage for NX: [PATCH v3 00/24] x86_64: Improvements at compressed kernel stage https://www.spinics.net/lists/kernel/msg4599636.html - Modified shim-install, add the following Olaf Kirch's patches to support full disk encryption: (jsc#PED-922) a5c57340740c Introduce --no-grub-install option 5c2c3addc51f Handle different cases of controlling cryptomount volumes during first stage boot 26c6bd5df7ae Have grub take a snapshot of "relevant" TPM PCRs - Removed shim-bsc1198101-opensuse-cert-prompt.patch (bsc#1198101) - Detail discussion is in bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1198101 - The shim community review and challenge this prompt. No other distro shows prompt (Have checked Fedora 37, CentOS 9 and Ubuntu 22.10). Currently, it blocked the review process of openSUSE shim. - Other distros lock-down kernel when secure boot is enabled. Some of them used different key for signing kernel binary with In-tree kernel module. And their build service does not provide signed Out-off-tree module. - Updated shim signature after shim 15.7 of SLE be signed back: signature-sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458, CVE-2022-28737) - Removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag when using post-process-pe after discussed with grub2 experts in mail. It's useful for further development and testing. (bsc#1205588) - Upgrade shim-install for bsc#1210382 After closing Leap-gap project since Leap 15.3, openSUSE Leap direct uses shim from SLE. So the ca_string is 'SUSE Linux Enterprise Secure Boot CA1', not 'openSUSE Secure Boot CA1'. It causes that the update_boot=no, so all files in /boot/efi/EFI/boot are not updated. The 86b73d1 patch added the logic that using ID field in os-release for checking Leap distro and set ca_string to 'SUSE Linux Enterprise Secure Boot CA1'. Then /boot/efi/EFI/boot/* can also be updated. - https://github.com/SUSE/shim-resources (git log --oneline) 86b73d1 Fix that bootx64.efi is not updated on Leap f2e8143 Use the long name to specify the grub2 key protector 7283012 cryptodisk: support TPM authorized policies 49e7a0d Do not use tpm_record_pcrs unless the command is in command.lst 26c6bd5 Have grub take a snapshot of "relevant" TPM PCRs 5c2c3ad Handle different cases of controlling cryptomount volumes during first stage boot a5c5734 Introduce --no-grub-install option - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Update shim-install to amend full disk encryption support b540061e041b Adopt TPM 2.0 Key File for grub2 TPM 2.0 protector f2e8143ce831 Use the long name to specify the grub2 key protector 72830120e5ea cryptodisk: support TPM authorized policies 49e7a0d307f3 Do not use tpm_record_pcrs unless the command is in command.lst - Adopt the macros from fde-tpm-helper-macros to update the signature in the sealed key after a bootloader upgrade - Update shim-install to fix boot failure of ext4 root file system on RAID10 (bsc#1205855) 226c94ca5cfca Use hint in looking for root if possible - Don't require grub so shim can still be used with systemd-boot - Generate dbx during build so we don't include binary files in sources -- Update to version 15.8 - Various CVE fixes are already merged into this version mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546) avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547) Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548) Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549) pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550) pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551) - remove shim-Enable-the-NX-compatibility-flag-by-default.patch The codes in this patch are already existing in shim-15.8 The NX flag is disable which is same as the default value of shim-15.8, hence, not need to enable it by this patch now. - Patches (git log --oneline --reverse 15.7..15.8) 657b248 Make sbat_var.S parse right with buggy gcc/binutils 7c76425 Enable the NX compatibility flag by default. 89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper c7b3051 pe: Align section size up to page size for mem attrs e4f40ae pe: Add IS_PAGE_ALIGNED macro f23883c Don't loop forever in load_certs() with buggy firmware 1f38cb3 Optionally allow to keep shim protocol installed 102a658 Drop invalid calls to `CRYPTO_set_mem_functions` aae3df0 test-sbat: Fix exit code cca3933 Block Debian grub binaries with SBAT < 4 cf59f34 Further improve load_certs() for non-compliant drivers/firmwares 0601f44 SBAT-related documents formatting and spelling 0640e13 Add a security contact email address in README.md 0bfc397 Work around malformed path delimiters in file paths from DHCP a8b0b60 pe: only process RelocDir->Size of reloc section f7a4338 Skip testing msleep() 549d346 Rename 'msecs' to 'usecs' to avoid potential confusion 908c388 Change type of fallback_verbose_wait from int to unsigned long 05eae92 Add SbatLevel_Variable.txt to document the various revocations 243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL 89d25a1 Add a make rule for compile_commands.json 118ff87 Add gnu-stack notes f132655 test: Make our fake dprintf be a statement. be00279 Remove CentOS 7 test builds. 9964960 Split pe.c up even more. 569270d Test (and fix) ImageAddress() 61e9894 Verify signature before verifying sbat levels 1578b55 Add libFuzzer support for csv.c a0673e3 Fix a 1-byte memory leak in .sbat parsing. e246812 Add libFuzzer support to the .sbat parser. fd43eda Work around ImageAddress() usage mistake 1e985a3 Correctly free memory allocated in handle_image() dbbe3c8 mok: Avoid underflow in maximum variable size calculation 04111d4 Make some of the static analysis tools a little easier to run 7ba7440 compile_commands.json: remove stuff clang doesn't like 66e6579 CVE-2023-40546 mok: fix LogError() invocation f271826 Add primitives for overflow-checked arithmetic operations. 8372147 pe-relocate: Add a fuzzer for read_header() 5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries e912071 pe-relocate: make read_header() use checked arithmetic operations. 93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550 afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds. 96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system dae82f6 Further mitigations against CVE-2023-40546 as a class ea0f9df Allow SbatLevel data from external binary b078ef2 Always clear SbatLevel when Secure Boot is disabled 7dfb687 BS Variables for bootmgr revocations a967c0e shim should not self revoke 577cedd Print message when refusing to apply SbatLevel e801b0d sbat revocations: check the full section name 0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers 6f0c8d2 Print errors when setting/clearing memory attrs 57c0eed Updated Revocations for January 2024 CVEs 49c6d95 Fix some minor ia32 build issues. be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all. 13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5 c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist 30a4f37 Rename "previous" revocations to "automatic" 6f395c2 Build time selectable automatic SBATLevel revocations a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER 993a345 Try to load revocations.efi even if directory read fails 1770a03 gitmodules: use shim-15.8 for gnu-efi branch 5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8 - Limit the requirement of fde-tpm-helper-macros to the distro with suse_version 1600 and above (bsc#1219460) - Update shim-install to set the TPM2 SRK algorithm (bsc#1213945) 92d0f4305df73 Set the SRK algorithm for the TPM2 protector - Sometimes SLE shim signature be Microsoft updated before openSUSE shim signature. When submit request on IBS for updating SLE shim, the submitreq project be generated, but it always be blocked by checking the signature of openSUSE shim. It doesn't make sense checking openSUSE shim signature when building SLE shim on SLE platform, and vice versa. So the following change adds the logic to compare suffix (sles, opensuse) with distro_id (sle, opensuse). When and only when hash mismatch and distro_id match with suffix, stop building. [#] compare suffix (sles, opensuse) with distro_id (sle, opensuse) [#] when hash mismatch and distro_id match with suffix, stop building - Sync the changelog between openSUSE:Factory/shim with SLE-15-SP3/shim - Add CVE-2022-28737 number to "Mon Mar 27 09:26:02 UTC 2023" record - Add "Thu Apr 13 05:28:10 UTC 2023" record for updating shim-install for bsc#1210382. - Add "Thu Apr 13 09:13:22 UTC 2023" record for changing the logic of checking shim signature. - update public keys of shim-15.8 after it has been signed back from Microsoft. - Update shim-install to apply the missing fix for openSUSE Leap (bsc#1210382) fixed by Gary. * 86b73d1 Fix that bootx64.efi is not updated on Leap - Update shim-install to use the 'removable' way for SL-Micro (bsc#1230316) fixed by Gary. * 433cc4e Always use the removable way for SL-Micro - Add patch for CVE-2019-10214. bsc#1144065 + CVE-2019-10214.patch - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Add patch for CVE-2019-10214. bsc#1144065 + CVE-2019-10214.patch - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Add patch for CVE-2019-10214. bsc#1144065 + CVE-2019-10214.patch - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Add patch for CVE-2019-10214. bsc#1144065 + CVE-2019-10214.patch - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Update to version 1.14.4: * [release-1.14] Bump to Skopeo v1.14.4 * [release-1.14] CVE-2024-3727 fix (bsc#1224123) * Packit: update packit targets * [release-1.14] Bump gopkg.in/go-jose to v2.6.3 * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180 * Freeze the fedora-minimal image reference at Fedora 38 * [release-1.14] Bump to v1.14.3 * [release-1.14] Bump c/common to v0.57.4 * [release-1.14] Bump google.golang.org/protobuf to v1.33.0 * [release-1.14] Bump Skopeo to v1.14.3-dev - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Update to version 1.14.4: * [release-1.14] Bump to Skopeo v1.14.4 * [release-1.14] CVE-2024-3727 fix (bsc#1224123) * Packit: update packit targets * [release-1.14] Bump gopkg.in/go-jose to v2.6.3 * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180 * Freeze the fedora-minimal image reference at Fedora 38 * [release-1.14] Bump to v1.14.3 * [release-1.14] Bump c/common to v0.57.4 * [release-1.14] Bump google.golang.org/protobuf to v1.33.0 * [release-1.14] Bump Skopeo to v1.14.3-dev - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Update to version 1.14.4: * [release-1.14] Bump to Skopeo v1.14.4 * [release-1.14] CVE-2024-3727 fix (bsc#1224123) * Packit: update packit targets * [release-1.14] Bump gopkg.in/go-jose to v2.6.3 * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180 * Freeze the fedora-minimal image reference at Fedora 38 * [release-1.14] Bump to v1.14.3 * [release-1.14] Bump c/common to v0.57.4 * [release-1.14] Bump google.golang.org/protobuf to v1.33.0 * [release-1.14] Bump Skopeo to v1.14.3-dev - Removed patches that were merged upstream: - 0002-Add-set-of-image-options-used-only-for-docker-transp.patch - bsc1115165-0001-Introduce-the-sync-command.patch - CVE-2019-10214.patch - Update to skopeo v0.1.41 (bsc#1165715): - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/v5@v5.2.0 - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don't unnecessarily filter out vendor from (go list ./...) output - Use -mod=vendor in (go {list,test,vet}) - Bump github.com/containers/buildah from 1.8.4 to 1.11.4 - Bump github.com/urfave/cli from 1.20.0 to 1.22.1 - skopeo: drop support for ostree - Don't critically fail on a 403 when listing tags - Revert "Temporarily work around auth.json location confusion" - Remove references to atomic - Remove references to storage.conf - Dockerfile: use golang-github-cpuguy83-go-md2man - bump version to v0.1.41-dev - systemtest: inspect container image different from current platform arch - Changes in v0.1.40: - vendor containers/image v5.0.0 - copy: add a --all/-a flag - System tests: various fixes - Temporarily work around auth.json location confusion - systemtest: copy: docker->storage->oci-archive - systemtest/010-inspect.bats: require only PATH - systemtest: add simple env test in inspect.bats - bash completion: add comments to keep scattered options in sync - bash completion: use read -r instead of disabling SC2207 - bash completion: support --opt arg completion - bash-completion: use replacement instead of sed - bash completion: disable shellcheck SC2207 - bash completion: double-quote to avoid re-splitting - bash completions: use bash replacement instead of sed - bash completion: remove unused variable - bash-completions: split decl and assignment to avoid masking retvals - bash completion: double-quote fixes - bash completion: hard-set PROG=skopeo - bash completion: remove unused variable - bash completion: use `||` instead of `-o` - bash completion: rm eval on assigned variable - copy: add --dest-compress-format and --dest-compress-level - flag: add optionalIntValue - Makefile: use go proxy - inspect --raw: skip the NewImage() step - update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f - inspect.go: inspect env variables - ostree: use both image and & storage buildtags - Update to skopeo v0.2.0: - Update on #834: force runc only when cgroupsv1 - Update docs/skopeo.1.md - Add example with repository - Skopeo should support for BigFilesTemporaryDir (SystemContext) - Use fully-qualified image names - Add support for REGISTRY_AUTH_FILE - Partial image encryption support - Remove the list_tags integration test since it does not cover much not already tested by the upstream container/images repo or local unit tests - Updates based on code review to simplify logic and tests - Fix inconsistency in manpage example for list-tags - Adds "list-tags" command to list tags with no known tag required - Update to skopeo v1.0.0: * Add skopeo Login from c/common * Add skopeo login&logout * Add Security Policy * Add tests for using signatures with mirrors * Update c/image for containers/image#912 * Use cobra in skopeo * Update containers/image to v5.4.4 * Bump github.com/containers/storage from 1.18.2 to 1.19.0 * v0.11.2 containers/common - Update to skopeo v1.1.0: * Add Skopeo Stable Image Dockerfile for Quay * Add tags to support regular expressions in yaml conf * Add tags to support regular expressions without breaking the old ones in yaml conf * Add upstream and testing container images * Add upstream and testing container images * Bump github.com/containers/storage from 1.20.1 to 1.20.2 * Bump github.com/stretchr/testify from 1.6.0 to 1.6.1 * Clarify control flow when handling the tags list * Clarify imagesToCopy control flow * Correct a typo in docs/skopeo-sync.1.md * Don't use path.Join to form repository names * Drop redundant fmt.Sprintf inside erorrs.Wrapf/Errorf * Fix error handling on invalid regex * Fix the recently added example in the man page. * Inline isTagSpecified into its only caller * Only create a SystemContext once per registry * Remove the repoReference parameter of imagesToCopyFromRepo * Share the logrus.WithFields settings over the loop bodies * Use MatchString instead of Match with a manual conversion * Use a reference.Named, not types.ImageReference, in imagesToCopyFromRepo * Use a separate field for the "sync images with tag matching regex" feature * Use reference.Tagged to extract the tag from a reference * Work with a reference.Named, not strings, in imagesToCopyFromRegistry - Update to skopeo v1.1.1: * Run htpasswd from our build-container instead of registry:2 * Vendor golang.org/x/text@v0.3.3 - Update to version 1.2.1: * Bump to v1.2.1 * Update nix pin with `make nixpkgs` * Add a smoke test for signedIdentity:remapIdentity * Split copyWithSignedIdentity from TestCopyVerifyingMirroredSignatures * integration test: sync k8s.gcr.io/pause instead of docker.io/alpine * integration test: use fedora-minimal for most manifest list tests * Update vendor of containers/common and containers/storage * Fix reading the after-sync list of tags in SyncSuite.TestYamlUntagged * Bump github.com/containers/common from 0.31.1 to 0.31.2 - Update to version 1.2.3: * Fix for login / logout registry argument * Upgrade dsnet/compress to avoid vulnerable xz version * Enable 'OptimizeDestinationImageAlreadyExists' feature * 020-copy.bats: check that we set the manifest type correctly * Set User-Agent to skopeo/$VERSION * Rebase against master and improve comment about gpgme-config * Fix Makefile to handle PREFIX correctly - Add bash-completion package - Update to version 1.5.0: * bump deps * Update VM Images + Drop prior-ubuntu references * Update installation doc with latest steps * Introduce a --ignore option to allow "sync" command to continue syncing even after a particular image sync fails * vendor-in-container: update to golang:1.16 * update c/common, c/image, c/storage * Add timeouts when waiting on OpenShift or the registry to start * Add docs and bash completions * Add support for decompressing while copying to dir:// * Update to enabled containers/image version * Fix two instances of unused err found by go-staticcheck * Test both imageOptions and imageDestOptions in TestTLSVerifyFlags * Split testing of --tls-verify into separate TestTLSVerifyFlags * Add the --tls-verify option to (skopeo logout) * Added `format` parameter to `sync` command * copy: Add --digestfile - stop building with libostree, this has been disabled upstream three years ago and is now broken - add fish & zsh completion subpackages - correct -completion subpackages requires, buildarch & supplements - remove outdated buildtags for opensuse pre-Leap - fix rpmlint filters - Update to version 1.10.0: * Release v1.10.0 * Update for https://github.com/klauspost/pgzip/pull/50 * Revert addition of -compat=1.17 to (go mod tidy) * Update vendor containers/(common,image) * [CI:DOCS] Add quay-description update reminder * Bump github.com/containers/storage from 1.42.0 to 1.43.0 * Fix documentation in the default registries.d content. * default.yaml should have all options commented * warn about ineffective destination opts in sync cmd * document imageDestOptions.warnAboutIneffectiveOptions() * warn users about --dest-compress and --dest-decompress misuse * warn users about --dest-compress and --dest-decompress misuse * Don't abort sync if the registry returns invalid tags * add inspect layersData * Stop using docker/docker/pkg/homedir in tests * Update for c/image's update of github.com/gobuffalo/pop * Don't include git commit from a parent directory in the --version output * Remove unused GIT_BRANCH definition * Point at --all in the --preserve-digests option documentation * Talk about "registry repositories" in (skopeo sync) documentation * Fix looking for commands with GNU make 4.2.1 * Fix a comment * Reformat with Go 1.19's gofmt * Fix running tests on macOS * Optimize upstream skopeo container image build * GHA: Re-use identical workflow from buildah repo * Bump to v1.9.3-dev * Release v1.9.2 * Bump github.com/containers/common from 0.49.0 to 0.49.1 * Cirrus: Update CI VM images to match podman CI * [CI:DOCS] Cirrus: Use the latest imgts container * Bump to v1.9.2-dev * Release v1.9.1 * Stop using deprecated names from c/common/pkg/retry * Update to github.com/containers/common v0.49.0 * Update to github.com/containers/image/v5 v5.22.0 * Bump github.com/containers/storage from 1.41.0 to 1.42.0 * Bump github.com/sirupsen/logrus from 1.8.1 to 1.9.0 * Bump to v1.9.1-dev * Release v1.9.0 * Update for the renames of sigstore to lookaside * Add --sign-by-sigstore-private-key to (skopeo copy) and (skopeo sync) * Vendor in c/image with sigstore support * Revert "Change a repo used for sync tests" * Vendor unreleased c/image with OCI artifact support * Use errors.As() instead of direct type checks * Remove uses of pkg/errors * Modify error messages on failures to close * Introduce noteCloseFailure, use it for reporting of cleanup errors * Bump github.com/stretchr/testify from 1.7.5 to 1.8.0 * Update IRC information * Use bytes.ReplaceAll instead of bytes.Replace(..., -1) * Update & fix skopeo multiarch image Containerfiles * Cirrus: Migrate multiarch build off github actions * Bump github.com/stretchr/testify from 1.7.4 to 1.7.5 * Bump github.com/stretchr/testify from 1.7.2 to 1.7.4 * Bump github.com/spf13/cobra from 1.4.0 to 1.5.0 * [CI:DOCS] skopeo.spec.rpkg: Fix syntax highlighting * [CI:DOCS] Makefile: include cautionary note for rpm target * CoPR: Autobuild rpm on rhcontainerbot/podman-next * Enable schema1 support on the test registries * Update for docker/distribution CLI change * Use an updated CI image * Change a repo used for sync tests * Use testing.T.Setenv instead of os.Setenv in tests * Update go.mod to Go 1.17 * Bump github.com/docker/docker * Bump github.com/stretchr/testify from 1.7.1 to 1.7.2 * Bump github.com/containers/ocicrypt from 1.1.4 to 1.1.5 * Cirrus: use Ubuntu 22.04 LTS * Update to github.com/opencontainers/runc >= 1.1.2 * fix make completions for all POSIX shells * Update to gopkg.in/yaml.v3 v3.0.0 * Updated skopeo logo with new artwork * [CI:DOCS] Pin actions to a full length commit SHA * shell completion: add completion for transports names * shell completion: add install instructions docs * shell completion: add Makefile target * Stop calling gpgme-config * Update c/image * Remove cgo_pthread_ordering_workaround.go * add completion command to generate shell completion scripts * Bump github.com/docker/docker * Bump github.com/containers/storage from 1.40.2 to 1.41.0 * Avoid hard-coding the location of bash * Config files live in /usr/local/etc on FreeBSD * Bump github.com/docker/docker * Move to v1.8.1-dev * Bump to v1.8.0 * Bump ocicrypt to v1.1.4 * Vendor in containers/storage v1.40.2 * Vendor in containers/(common, storage, image) * [CI:DOCS] install.md: include distro package info links * [CI:DOCS] install.md: remove Kubic package info for Ubuntu * Cirrus: Update to F36 w/ netavark+aardvark-dns * Update vendor of containers/(common,storage,image) * Use filepath.WalkDir instead of filepath.Walk * Extract four copies of the same loop into a function * Update users of deprecated io/ioutil * Add option to specify the identity for signing * Bump containers/image to include sign identity option * delete non-existent option in the cmdline example * Add dry-run mode to skopeo-sync * Update skopeoimage/README.md that tags are v-prefixed * Bump to v1.7.1-dev * Release 1.7.0 * Bump github.com/prometheus/client_golang to v1.11.1 * Bump github.com/containers/common from 0.47.4 to 0.47.5 * Bump github.com/containers/storage from 1.38.2 to 1.39.0 * Bump github.com/docker/docker * Improve the (skopeo delete) man page * Bump github.com/containers/ocicrypt from 1.1.2 to 1.1.3 * Update the command to install golint * Formally record that we require Go 1.15 * Use check.C.MkDir() instead of manual ioutil.TempDir() calls * Update to Go 1.14 and revendor * Use assert.ErrorContains * Bump github.com/stretchr/testify from 1.7.0 to 1.7.1 * Simplify the proxy server a bit * Add various missing error handling * Remove assignments to an unused variable * Rename "self" receiver * Add support for docker-archive: to skopeo list-tags * Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 * Bump github.com/docker/docker * Update github.com/containerd/containerd * Bump github.com/containers/image/v5 from 5.19.1 to 5.20.0 * do not recommend upgrading all packages * Improve a comment in the 010-inspect.bats test * Move to v1.7.0-dev * Bump to v1.6.1 * Work around systemd-resolved's handling of .invalid domains * Beautify a few calls * Only look for the layer digests in the Layers field. * Don't expect the config blob to be listed in (skopeo inspect) * Cirrus: Use updated VM images * Bump c/common to v0.47.4 * tests: skip sif test on RHEL * Bump to v1.6.1-dev * Release v1.6.0 * Bump version of containers/image and containers/common * Improve the documentation of boolean flags * Document where various fields of (skopeo inspect) come from * Improve the documentation of the argument to (skopeo inspect) * Update vendor of containers/storage and containers/common * add a SIF systemtest * Update vendor of containers/common * Github workflow: Fix yaml syntax * Bump github.com/containers/storage from 1.38.0 to 1.38.1 * prompt-less signing via passphrase file * Github-workflow: Report both failures and errors * Run codespell on code * Update the vendor of containers/common * Bump github.com/containers/storage from 1.37.0 to 1.38.0 * Update github.com/containerd/containerd to 1.5.9 * Fix the pseudo-version of github.com/opencontainers/image-spec * Update github.com/opencontainers/runc to v1.0.3 * Bump github.com/spf13/cobra from 1.2.1 to 1.3.0 * Bump github.com/docker/docker * Add option to preserve digests on copy * Add option to preserve digests on copy * proxy: Also bump compatible semver * proxy: Add a GetFullConfig method * Update github.com/containerd/containerd to v1.5.8 * Update opencontainers/image-spec * Add an option to allow copying image indexes alone * Use a dynamic temp dir for test * Bump to 1.5.3-dev * Release 1.5.2 * Update to c/image v5.17.0 * Cirrus: Bump Fedora to release 35 & Ubuntu to 21.10 * Bump github.com/docker/docker * proxy: Uncapitalize all errors * tests: Add new "procutils" that exposes PDEATHSIG * proxy_test: Test `GetConfig` * proxy_test: Add helper to read all from a reply * proxy_test: Add a helper method to call without fd * proxy: Add support for manifest lists * tests/integration/proxy_test: New test that exercises `proxy.go` * proxy: Use float → int helper for pipeid * proxy: Add a helper to return a byte array * proxy: Add an API to fetch the config upconverted to OCI * Fix bug that prevented useful diagnostics on registry fail * use fedora:latest in contrib/skopeoimage/*/Dockerfile * Move to v1.5.2-dev * Bump to v1.5.1 * main: Error out if an unrecognized subcommand is provided * move optional-flag code to c/common/pkg/flag * Add --dest-precompute-digests option for docker * bump containers/image to 2541165 * Add instructions to generate static binaries * Add new `experimental-image-proxy` hidden command * issue#785 inspect command - introduce a way to skip querying available tags for an image * Document container images as an alternative to installing packages * Introduce --username and --password to pass credentials * Move to v1.5.1-dev - Update to version 1.11.1: * [release-1.11] Bump to v1.11.1 * Update to c/image 5.24.1 * Move to v1.11.1-dev * Bump to v1.11.0 * [CI:DOCS] Format manual page documents * Update module github.com/containers/common to v0.51.0 * Update module github.com/containers/image/v5 to v5.24.0 * Add (skopeo generate-sigstore-key) * Update c/image after https://github.com/containers/image/pull/1810 * Touch up conscious language issues * Partially fix removal of temporary data in (make test-system) * Don't affect $XDG_RUNTIME_DIR of Podman starting the registry * Update module github.com/containers/storage to v1.45.3 * Fix storage.conf setup in test-system * Fix (test-integration), in a container without CI * Cirrus: Fix c/image CI testing * Bump github.com/containers/ocicrypt from 1.1.6 to 1.1.7 * Cirrus: Add a common intra-test reset function * Fix unnecessary use of podman in CI test * Cirrus: Update to F37 CI VM Images * Cirrus: Remove redundant package install attempt * fix(deps): update module github.com/containers/storage to v1.45.1 * Add support for Fulcio and Rekor, and --sign-by-sigstore=param-file * Update c/image after https://github.com/containers/image/pull/1787 * fix(deps): update module github.com/containers/storage to v1.45.0 * Cirrus: Skip OSX CI on release-branches * Correctly use the stdout parameter in some places * fix(deps): update module golang.org/x/term to v0.4.0 * [skip-ci] Update actions/stale action to v7 * proxy: Fix leak of blobs from containers-storage * vendor: Bump golang.org/x/net to 4.0 * proxy: Ensure images are closed when proxy is shutting down * Add an example for creating a docker-archive file * proxy: Add GetLayerInfo API * fix(deps): update module golang.org/x/term to v0.3.0 * [skip-ci] GHA/Cirrus-cron: Fix execution order * Update skopeo-inspect man page example * README: Update example to show newly exposed LayerData * [CI:BUILD] Cirrus: Migrate OSX task to M1 * Adds sync with tag suffix example * GHA: Add cirrus-cron auto-rerun job * Adds `--append-suffix` flag to sync * fix(deps): update module github.com/containers/storage to v1.44.0 * Cirrus: Add reverse-deps. test to verify proxy ext * [skip-ci] Update actions/stale action to v6 * fix(deps): update module golang.org/x/term to v0.2.0 * Renovate: Override global no-rebase option * chore(deps): update actions/stale to v3 * fix(deps): update module github.com/spf13/cobra to v1.6.1 * Close a HTTP response body * fix(deps): update module golang.org/x/term to v0.1.0 * fix(deps): update module github.com/stretchr/testify to v1.8.1 * Update to c/image main branch * bump to v1.11.0-dev * chore(deps): add renovate.json * proxy: Bump semver for OpenImageOptional * proxy: Add `OpenImageOptional` * Add a workaround for public.ecr.aws not implementing tag list at all * Update AWS workaround to use Golang types * Reorganize the "list tags failed" logic in inspect.go a bit * Remove a (skopeo inspect) workaround for IBM Bluemix * Fix an error message to refer to repo, not a single image * Remove a special case for failing to list tags in (skopeo sync) * Update tests for changed error texts * Include c/image after https://github.com/containers/image/pull/1299 * Fold a long line. * Remove single-use "wanted" variables * Bump github.com/spf13/cobra from 1.5.0 to 1.6.0 * Bump github.com/containers/ocicrypt from 1.1.5 to 1.1.6 * Bump github.com/opencontainers/image-spec from 1.1.0-rc1 to 1.1.0-rc2 * Bump to v1.10.1-dev - Update to version 1.11.2: * Release 1.11.2 * bump golang.org/x/net to v0.7.0 * [release-1.11] Bump to v1.11.2-dev - Update to version 1.12.0: * Release 1.12.0 * Update module github.com/containers/common to v0.52.0 * Update module github.com/containers/storage to v1.46.1 * Add (make tools) to install (for now only) golangci-lint, use it in Cirrus * Use golangci-lint instead of golint * Finally, eliminate hack/make.sh * Actually fail if (go vet) fails * Speed up validate-git-marks by about a factor of three * Don't use hack/make.sh for validate-git-marks * Test all files by validate-git-marks * Simplify the package list of (go vet) * Don't use hack/make.sh for validate-gofmt * Run gofmt on all files, not just the changed ones * Don't use hack/make.sh for validate-lint * Lint many more files in validate-lint * Don't use hack/make.sh for validate-vet * Remove no-longer-necessary module options * Fix Makefile dependencies * Remove some outright unused code from hack/make* * Cross-link the top-level and subcommand option lists * Fix error handling of signature.NewEphemeralGPGSigningMechanism * chore(deps): update dependency containers/automation_images to v20230405 * Avoid use of a deprecated capability.NewPid * fix(deps): update module github.com/spf13/cobra to v1.7.0 * fix(deps): update module github.com/containers/image/v5 to v5.25.0 * fix(deps): update module golang.org/x/term to v0.7.0 * Use multiple fingerprint function Allow comma separated fingerprint list * Review comments (to be squashed later * Rename argument. Only use any with public key file. Double check fingerprint is in public key file. * Verify signatures from a trust store * Update c/image from the main branch * Update module github.com/containers/common to v0.51.2 * Update dependency containers/automation_images to v20230330 * systemtests: Fix 040-local-registry-auth about XDG_RUNTIME_DIR * [CI:BUILD] Packit: trigger builds on commit to main branch * [skip-ci] Update actions/stale action to v8 * Make the installation instructions more prominent in README.md * Update dependency containers/automation_images to v20230320 * Update module github.com/containers/common to v0.51.1 * Cirrus: Update CI VM images * bump golang.org/x/net to v0.8.0 * Update module golang.org/x/term to v0.6.0 * Simplify inspectOptions.writeOutput a bit more * Factor out the output of data in (skopeo inspect) * Use io.WriteString * Update module github.com/stretchr/testify to v1.8.2 * Update module github.com/containers/storage to v1.45.4 * Update golang.org/x/exp digest to 5e25df0 * Fix formatting of inspect examples * Use common library reporter * Fix some warnings * Fix tabelating output in (skopeo inspect --format) * Corrected typo in skopeo-sync and updated description * Replace gopkg.in/check.v1 by github.com/stretchr/testify/suite/ * Update c/image after https://github.com/containers/image/pull/1842 * [CI:BUILD] Packit: initial enablement * Renovate: c/common rule moved to defaults * Update c/image after https://github.com/containers/image/pull/1816 * Run codespell on codebase * [CI:DOCS] Disable dependabot * Update module golang.org/x/term to v0.5.0 * Update golang.org/x/exp digest to 46f607a * Remove unnecessary blank lines * Pre-allocate an array * Simplify a condition * Rename a variable to avoid an underscore * Add missing comment punctuation * Fix, or remove, comments using lint syntax * Simplify an increment * Reformat import statements * Use %w when wrapping errors * Remove a duplicate word * Use net/netip.Addr instead of net.IP * s/interface{}/any/g * Use golang.org/x/exp * Use strings.Cut * go mod tidy -go=1.18 * [CI:BUILD] enable debuginfo for el8 copr builds * [CI:BUILD] copr: fix el8 build and enable debuginfo * Cirrus: Use human-readable CI VM Images * Update module gopkg.in/yaml.v2 to v3 * Add unit tests for tlsVerifyConfig's yaml.Unmarshaler * [CI:DOCS] Fix up language in README - Update to version 1.13.0: * Bump to v1.13.0 * proxy: Policy verification of OCI Image before pulling * Update module github.com/opencontainers/image-spec to v1.1.0-rc4 * Update module github.com/containers/common to v0.55.1 * Update module github.com/containers/common to v0.54.0 * Update module github.com/containers/image/v5 to v5.26.0 * [CI:BUILD] RPM: fix ELN builds * Update module github.com/containers/storage to v1.47.0 * Packit: easier to read distro conditionals * Update dependency golangci/golangci-lint to v1.53.3 * Help Renovate manage the golangci-lint version * Minor: Cleanup renovate configuration * Update dependency containers/automation_images to v20230614 * Update module golang.org/x/term to v0.9.0 * [CI:BUILD] Packit: add jobs for downstream Fedora package builds * Update module github.com/sirupsen/logrus to v1.9.3 * Update dependency containers/automation_images to v20230601 * Update golang.org/x/exp digest to 2e198f4 * Update github.com/containers/image/v5 digest to e14c1c5 * Update module github.com/stretchr/testify to v1.8.4 * Update module github.com/stretchr/testify to v1.8.3 * Update dependency containers/automation_images to v20230517 * Update module github.com/sirupsen/logrus to v1.9.2 * Update module github.com/docker/distribution to v2.8.2+incompatible * Trigger an update of the ostree_ext container image * Update c/image with https://github.com/containers/image/pull/1944 * Update module github.com/containers/common to v0.53.0 * Update module golang.org/x/term to v0.8.0 * Update dependency containers/automation_images to v20230426 * Update golang.org/x/exp digest to 47ecfdc * Emphasize the semantics of --preserve-digests a tiny bit * Improve the static build documentation a tiny bit * Bump to v1.12.1-dev - Update to version 1.13.1: * [release-1.13] Bump to v1.13.1 * [release-1.13] Bump c/common to v0.55.2 * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec * [release-1.13] Bump to v1.13.1-dev - Update to version 1.13.2: * [release-1.13] Bump to v1.13.2 * [release-1.31] Bump c/common v0.55.3 * Packit: remove pre-sync action * [release-1.13] Bump to v1.13.2-dev - Bump go version to 1.21 (bsc#1215611) - Update to version 1.14.0: * Bump to v1.14.0 * fix(deps): update module github.com/containers/common to v0.57.0 * chore(deps): update dependency containers/automation_images to v20231116 * fix(deps): update module github.com/containers/image/v5 to v5.29.0 * Add documentation and smoke tests for the new --compat-auth-file options * Update c/image and c/common to latest * fix(deps): update module github.com/containers/storage to v1.51.0 * fix(deps): update module golang.org/x/term to v0.14.0 * fix(deps): update module github.com/spf13/cobra to v1.8.0 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2 * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1 * fix(deps): update github.com/containers/common digest to 3e5caa0 * chore(deps): update module google.golang.org/grpc to v1.57.1 [security] * fix(deps): update module github.com/containers/ocicrypt to v1.1.9 * Update github.com/klauspost/compress to v1.17.2 * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security] * Fix ENTRYPOINT documentation, drop others. * Remove unused environment variables in Cirrus * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0 * chore(deps): update dependency containers/automation_images to v20231004 * chore(deps): update module golang.org/x/net to v0.17.0 [security] * copy: Note support for `zstd:chunked` * fix(deps): update module golang.org/x/term to v0.13.0 * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible * fix(deps): update github.com/containers/common digest to 745eaa4 * Packit: switch to @containers/packit-build team for copr failure notification comments * Packit: tag @lsm5 on copr build failures * vendor of containers/common * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5 * fix(deps): update module github.com/containers/common to v0.56.0 * Cirrus: Remove multi-arch skopeo image builds * fix(deps): update module github.com/containers/image/v5 to v5.28.0 * Increase the golangci-lint timeout * fix(deps): update module github.com/containers/storage to v1.50.2 * fix(deps): update module github.com/containers/storage to v1.50.1 * fix(deps): update golang.org/x/exp digest to 9212866 * Fix a man page link * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6 * GHA: Closed issue/PR comment-lock test * fix(deps): update module github.com/containers/common to v0.55.4 * fix(deps): update module github.com/containers/storage to v1.49.0 * rpm: spdx compatible license field * chore(deps): update dependency golangci/golangci-lint to v1.54.2 * chore(deps): update dependency containers/automation_images to v20230816 * Packit: set eln target correctly * packit: Build PRs into default packit COPRs * DOCS: Update Go version requirement info * DOCS: Add information about the cross-build * fix(deps): update module github.com/containers/ocicrypt to v1.1.8 * fix(deps): update module github.com/containers/common to v0.55.3 * Update c/image after https://github.com/containers/image/pull/2070 * chore(deps): update dependency golangci/golangci-lint to v1.54.1 * chore(deps): update dependency containers/automation_images to v20230809 * fix(deps): update golang.org/x/exp digest to 352e893 * chore(deps): update dependency containers/automation_images to v20230807 * Update to Go 1.19 * fix(deps): update module golang.org/x/term to v0.11.0 * Update c/image for golang.org/x/exp * RPM: define gobuild macro for rhel/centos stream * Fix handling the unexpected return value combination from IsRunningImageAllowed * Close the PolicyContext, as required by the API * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext * Packit: remove pre-sync action * fix(deps): update module github.com/containers/common to v0.55.2 * proxy: Change the imgid to uint64 * [CI:BUILD] Packit: install golist before updating downstream spec * Update module golang.org/x/term to v0.10.0 * Bump to v1.14.0-dev * Bump to v1.13.0 - Update to version 1.14.1: * Bump to v1.14.1 * fix(deps): update module github.com/containers/common to v0.57.2 * fix(deps): update module github.com/containers/image/v5 to v5.29.1 * chore(deps): update dependency containers/automation_images to v20240102 * Fix libsubid detection * fix(deps): update module golang.org/x/term to v0.16.0 * fix(deps): update golang.org/x/exp digest to 02704c9 * chore(deps): update dependency containers/automation_images to v20231208 * [skip-ci] Update actions/stale action to v9 * fix(deps): update module github.com/containers/common to v0.57.1 * fix(deps): update golang.org/x/exp digest to 6522937 * DOCS: add Gentoo in install.md * DOCS: Update to add Arch Linux in install.md * fix(deps): update module golang.org/x/term to v0.15.0 * Bump to v1.14.1-dev - Update to version 1.14.2: * [release-1.14] Bump Skopeo to v1.14.2 * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563) - Update to version 1.14.4: * [release-1.14] Bump to Skopeo v1.14.4 * [release-1.14] CVE-2024-3727 fix (bsc#1224123) * Packit: update packit targets * [release-1.14] Bump gopkg.in/go-jose to v2.6.3 * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180 * Freeze the fedora-minimal image reference at Fedora 38 * [release-1.14] Bump to v1.14.3 * [release-1.14] Bump c/common to v0.57.4 * [release-1.14] Bump google.golang.org/protobuf to v1.33.0 * [release-1.14] Bump Skopeo to v1.14.3-dev - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - added error handing for failed ambit detection (bsc#1174038) - version 0.8.11 - fixed error when using mksubvolume to create /tmp (bsc#1174401) - version 0.8.12 - call fsync after writing snapshot info file (bsc#1078336) - version 0.8.13 - improved error messages for wrong command line options and arguments (bsc#1150156) - fix LVM setup for volume groups and logical volumes with one character long names (gh#openSUSE/snapper#465) - activate snapperd using systemd service - package new snapperd.service file on Debian based distributions (gh#openSUSE/snapper#557) - added option to cleanup to make requested free space available (jsc#SLE-15765) - version 0.8.14 - use C++11 regexes instead of own regcomp/regexec wrapper class (see gh#openSUSE/snapper#583) - state in man-pages that ext4 support is discontinued (gh#openSUSE/snapper#331) - do not override passwd after getpwuid_r et.al. calls (gh#openSUSE/snapper#589) - fixed compilation with --disable-btrfs (gh#openSUSE/snapper#505) - in systemd-helper continue with other configs if one config is broken (gh#openSUSE/snapper#495) - added option to abbreviate columns in table (see gh#openSUSE/snapper#268) - version 0.8.15 - fixed testsuite for equal-date (gh#openSUSE/snapper#526) - updated translations (bsc#1149754) - fixed creating root config (root prefix handling) (gh#openSUSE/snapper#627) - avoid stale btrfs qgroups on transactional systems (bsc#1210151) * added pr805.patch - wait for existing btrfs quota rescans to finish (bsc#1210150) * added pr790.patch - improved responsiveness of snapperd when a btrfs quota rescan is running (see bsc#1211459) * added pr821.patch - handle content-length of stomp in zypper plugin (gh#openSUSE/snapper#918) (bsc#1229142) * added pr919.patch * added pr920.patch - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Add net-snmp-5.7.3-modern-rpm-api.patch: Supprt modern RPM (>= 4.6) API. In RPM 4.14, the RPM 4.4 compatibility APIs are being removed. - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - Format with spec-cleaner - Drop sle11 support as it fails to build anyway for ages - Rename python packages to be python-%{name} with obsoletes * Use new singlespec macros * Add patch converting the py files to python3/2 compat mode net-snmp-python3.patch - Run full autoreconf instead of partial - Build with threads by building few targets first - Take systemd service files from fedora to replace sysV scripts - Also convert the sysconfig files to match fedora ones, they get bit more terse but it works seamlessly with systemd - Add patch from Fedora to support natively systemd: * net-snmp-5.7.2-systemd.patch - Drop the check phase as whole 90% of the tests fail it makes more sense to run them somewhere localy - Properly conditionalize the py2 build - Fix RPM group for shlib subpackage. - Remove executable flags from systemd service files (bsc#1089295). - Fix permissions on unit files wrt bsc#1087977 - Use %license (boo#1082318) - Create /var/agentx via systemd tmpfiles in case of rollback, snapshots and transactional updates [bsc#1098032] - Fix remote DoS in agent/helpers/table.c (bsc#1111122, CVE-2018-18065) Add net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch - swintst_rpm: Protect against unspecified Group name (bsc#1102775) Add net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch - Add tsm and tlstm MIBs and the USM security module. (bsc#1081164) - Fix agentx freezing on timeout (bsc#1027353) Add net-snmp-fix-agentx-freezing-on-timeout.patch - Add Lustre filesystem support (bsc#1140341, jsc#SLE-6120). Add net-snmp-5.7.3-add-lustre-fs-support.patch - Add info about the original agent which triggered the trap. When the trap is forwarded there was no info about the original agent (bsc#1116807). Add net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch - Fix missing sysconfig files creation (bsc#1108471). - Make extended MIB read-only (bsc#1174961, CVE-2020-15862). Add net-snmp-5.7.3-make-extended-mib-read-only.patch - Fix output for high memTotalReal RAM values (bsc#1152968). Add net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch - Fix hrStorage autofs objects timeout problems (bsc#1179699, bsc#1145864). Add net-snmp-5.7.3-host-mib-skip-autofs-entries.patch Add net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch - Fix NSS mounted volumes in hrStorageDescr (bsc#1100146). Add net-snmp-5.7.3-recognize-nss-pools-and-nss-volumes-oes.patch - Fix subagent crash at save_set_var() (bsc#1178021). Add net-snmp-5.7.3-subagent-set-response.patch - Fix subagent data corruption (bsc#1178351, bsc#1179009). Add net-snmp-5.7.3-fix-subagent-data-corruption.patch - Fix LFH violation during v3 user creation (bsc#1181591). Add net-snmp-5.7.3-fix-create-v3-user-outfile.patch - Decouple snmp-mibs from net-snmp version to allow major version upgrade (bsc#1196955). - update to 5.9.3 (bsc#1201103, jsc#SLE-11203): - security: - These two CVEs can be exploited by a user with read-only credentials: - CVE-2022-24805 A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. - These CVEs can be exploited by a user with read-write credentials: - CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously - CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. - CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. - Fixed library versioning bug found in 5.9.2. - Library version change to libsnmp40. - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Fixed python2 backward compability. add: * net-snmp-5.9.3-fixed-python2-bindings.patch - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Change to use systemd service files directly from net-snmp package. add: * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch remove: * snmpd.service * snmptrapd.service * harden_snmpd.service.patch * harden_snmptrapd.service.patch - Refactor and remove obsolete patches to work with version number 5.9.3: add: * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch remove: * net-snmp-5.9.1-pie.patch * net-snmp-5.9.1-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-add-lustre-fs-support.patch * net-snmp-5.7.3-Fix-Makefile.PL.patch * net-snmp-5.7.3-modern-rpm-api.patch * net-snmp-5.7.3-net-snmp-config-headercheck.patch * net-snmp-5.7.3-perl-tk-warning.patch * net-snmp-5.7.3-snmpstatus-suppress-output.patch * net-snmp-5.7.3-socket-path.patch * net-snmp-5.7.3-subagent-set-response.patch * net-snmp-5.7.3-testing-empty-arptable.patch * net-snmp-5.7.3-velocity-mib.patch * net-snmp-5.7.3-fix-create-v3-user-outfile.patch * net-snmp-5.7.3-pie.patch * net-snmp-4.7.2-systemd.patch * net-snmp-5.7.3-build-with-openssl-1.1.patch * net-snmp-5.7.3-fix-agentx-freezing-on-timeout.patch * net-snmp-5.7.3-fix-missing-mib-hrStorage-indexes.patch * net-snmp-5.7.3-fix-snmpd-crashing-when-an-agentx-disconnects.patch * net-snmp-5.7.3-fix-snmp_pdu_parse-incomplete.patch * net-snmp-5.7.3-fix-subagent-data-corruption.patch * net-snmp-5.7.3-helpers-table-skip-if-next-handler-called.patch * net-snmp-5.7.3-host-mib-skip-autofs-entries.patch * net-snmp-5.7.3-make-extended-mib-read-only.patch * net-snmp-5.7.3-netgroups.patch * net-snmp-5.7.3-Remove-U64-typedef.patch * net-snmp-5.7.3-snmptrapd-add-forwarder-info.patch * net-snmp-5.7.3-swintst_rpm-Protect-against-unspecified-Group-name.patch * net-snmp-5.7.3-ucd-snmp-mib-add-64-bit-mem-obj.patch * net-snmp-python3.patch - Fixed NULL pointer exception issue when handling ipDefaultTTL or pv6IpForwarding (bsc#1205148, CVE-2022-44793, bsc#1205150, CVE-2022-44792). add: * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch - Enable AES-192 and AES-256 privacy protocol (bsc#1206828). - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add: * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch delete: * net-snmp-5.9.1-harden_snmpd.service.patch * net-snmp-5.9.1-harden_snmptrapd.service.patch - Update to net-snmp-5.9.4 (bsc#1214364). add (rename): * net-snmp-5.9.4-add-lustre-fs-support.patch * net-snmp-5.9.4-add-netgroups-functionality.patch * net-snmp-5.9.4-fix-create-v3-user-outfile.patch * net-snmp-5.9.4-fixed-python2-bindings.patch * net-snmp-5.9.4-fix-Makefile.PL.patch * net-snmp-5.9.4-modern-rpm-api.patch * net-snmp-5.9.4-net-snmp-config-headercheck.patch * net-snmp-5.9.4-perl-tk-warning.patch * net-snmp-5.9.4-pie.patch * net-snmp-5.9.4-snmpstatus-suppress-output.patch * net-snmp-5.9.4-socket-path.patch * net-snmp-5.9.4-subagent-set-response.patch * net-snmp-5.9.4-suse-systemd-service-files.patch * net-snmp-5.9.4-testing-empty-arptable.patch delete (now part of v5.9.4): * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch delete (rename): * net-snmp-5.9.1-add-lustre-fs-support.patch * net-snmp-5.9.1-fix-Makefile.PL.patch * net-snmp-5.9.1-modern-rpm-api.patch * net-snmp-5.9.1-net-snmp-config-headercheck.patch * net-snmp-5.9.1-perl-tk-warning.patch * net-snmp-5.9.1-snmpstatus-suppress-output.patch * net-snmp-5.9.1-socket-path.patch * net-snmp-5.9.1-subagent-set-response.patch * net-snmp-5.9.1-suse-systemd-service-files.patch * net-snmp-5.9.1-testing-empty-arptable.patch * net-snmp-5.9.1-velocity-mib.patch * net-snmp-5.9.3-fix-create-v3-user-outfile.patch * net-snmp-5.9.3-pie.patch * net-snmp-5.9.3-fixed-python2-bindings.patch - Removing legacy MIBs used by Velocity Software (jira#PED-6416). - Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts - Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044). add (rename): * net-snmp-5.9.4-harden_snmpd.service.patch * net-snmp-5.9.4-harden_snmptrapd.service.patch delete (rename): * net-snmp-5.9.3-harden_snmpd.service.patch * net-snmp-5.9.3-harden_snmptrapd.service.patch - logrotate should use reload instead of restart (bsc#1232030) - correctly apply the patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - correctly apply the patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - correctly apply the patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - correctly apply the patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - Security fix for readline.sh: arbitrary file overwrite (bsc#1225462) - add CVE-2024-54661.patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - Security fix for readline.sh: arbitrary file overwrite (bsc#1225462) - add CVE-2024-54661.patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - Security fix for readline.sh: arbitrary file overwrite (bsc#1225462) - add CVE-2024-54661.patch - Update to version 1.7.3.0 * Too many changes to list; please read the CHANGES file for news - Remove redundant %clean section - Update fix-linux-errqueue.h-not-found.patch and socat-remove_date.patch - remove socat-remove_date.patch, export BUILD_DATE instead (new feature since 1.7.2.4) - run tests, don't abort yet - require tcpd-devel only on SUSE systems at build time - test-suite, use a small but safe subset of all tests - don't remove "example" scripts from builddir, they are needed for tests - update to 1.7.3.1, security fixes: * Socat security advisory 7 and MSVR-1499: "Bad DH p parameter in OpenSSL" (bnc#938913 and CVE-2015-4000). * Socat security advisory 8: "Stack overflow in arguments parser" (bnc#964844) - update to 1.7.3.2, bug fixes: * fixes uninterruptable hang / CPU loop on host resolution problems * some compile problems, and lots of other bugs and porting issues - remove fix-linux-errqueue.h-not-found.patch, this build issue was fixed by upstream - socat-openssl-1.1-tests.patch: make tests work on openssl1. (bsc#1042674) - Add socat-ignore-tests-failure-boo1078346.patch flaky test failures PowerPC and s390 , bypass boo#1078346 - Use %license instead of %doc [bsc#1082318] - We HAVE_SSLv23_*_method, just not as functions, but macros add the relevant defines in the command line so support for autonegotiation of the highest TLS version is restored. - Replace old variables by modern counterparts. - Update to version 1.7.3.3: * bugfix release, see the CHANGES file for all changes - Drop patch: * socat-openssl-1.1-tests.patch (not longer needed) - Run spec-cleaner - socat-common-fixes.patch: include tcpd.h where needed to fix - fno-common bsc#1160293 - Update to version 1.7.3.4: * bugfix release, see the CHANGES file for all changes - Refresh patches: * socat-common-fixes.patch * socat-ignore-tests-failure-boo1078346.patch - update to 1.7.4.1: Security: * Buffer size option (-b) is internally doubled for CR-CRLF conversion, but not checked for integer overflow. This could lead to heap based buffer overflow, assuming the attacker could provide this parameter. * Many further bugfixes and new features, see the CHANGES file - Update to version 1.7.4.2: * Fixes a lot of bugs, e.g., for options -r and -R. * Further bugfixes, see the CHANGES file - update to 1.7.4.3: * fixes the TCP_INFO issue that broke building on non-Linux platforms. * building on AIX works again. * A few more corrections and improvements have been added - Use autosetup - Add socat-fix-asan-error.patch that is offered to upstream and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'. - Update to 1.7.4.4: * FIX: In error.c msg2() there was a stack overflow on long messages: The terminating \0 Byte was written behind the last position. * FIX: UDP-RECVFROM with fork sometimes terminated when multiple packets arrived. * FIX: a couple of weaknesses and errors when accessing invalid or  incompatible file system entries with UNIX domain, file, and generic addresses. * FIX: bad parser error message on "socat /tmp/x\"x/x -" - Drop socat-fix-asan-error.patch - Update to 1.8.0.0: * Support for network namespaces (option netns) * TCP client now automatically tries all addresses (IPv4 and IPv6) provided by nameserver until success * Implementation of POSIX message queue (mq) control and access on Linux (addresses POSIXMQ-READ and following) * New wrapper script socat-chain.sh allows to stack two addresses, e.g.HTTP proxy connect over SSL * New script socat-mux.sh allows n-to-1 / 1-to-n communications * New script socat-broker.sh allows group communications * Experimental socks5 client feature * Address ACCEPT-FD for systemd "inetd" mode * UDP-Lite and DCCP address types * Addresses SOCKETPAIR and SHELL * New option bind-tmpname allows forked off children to bind UNIX domain client sockets to random unique pathes * New option retrieve-vlan (with INTERFACE addresses) now makes kernel keep VLAN tags in incoming packets * Simple statistics output with Socat option --statistics and with SIGUSR1 * A couple of new options, many fixes and corrections, see file CHANGES - Drop socat-common-fixes.patch (no longer necessary) - Refactor socat-ignore-tests-failure-boo1078346.patch (test suite no longer exits at this stage) - Add socat-test-dhparam fixture (reduce build load and time) - Add socat-test-without-tty.patch for testing without tty. - Note: This version introduces "socat1", linking to "socat" - Note: This version introduces additional shell scripts, those are shipped in a new "socat-extra" subpackage - Security fix for readline.sh: arbitrary file overwrite (bsc#1225462) - add CVE-2024-54661.patch - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - update to 3.23.1: * Fix two problems in the new LEFT JOIN strength reduction optimization * Fix misbehavior of the FTS5 xBestIndex method * Fix a harmless reference to an uninitialized virtual machine register * Fix the eval.c extension so that it works with PRAGMA empty_result_callbacks=ON * Fix the generate_series virtual table so that it correctly returns no rows if any of its constraints are NULL * Performance enhancements in the parser - CVE-2018-20346, bsc#1119687: Upgrade to the most recent version to fix a remote code execution vulnerability in FTS3 (Magellan). - Drop sqlite-fts5-link.patch and do it in the spec file instead. - Version 3.27.2: * Add the VACUUM INTO command * Issue an SQLITE_WARNING message on the error log if a double-quoted string literal is used * Add the remove_diacritics=2 option to FTS3 and FTS5. * Add the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3(). Use that option to prevent circular references to shadow tables from causing resource leaks. * Enhancements to the sqlite3_deserialize() interface * Enhancements to the CLI, mostly to support testing and debugging of the SQLite library itself * Increased robustness against malicious SQL that is run against a maliciously corrupted database - Version 3.26.0: * Optimization: When doing an UPDATE on a table with indexes on expressions, do not update the expression indexes if they do not refer to any of the columns of the table being updated. * Allow the xBestIndex() method of virtual table implementations to return SQLITE_CONSTRAINT to indicate that the proposed query plan is unusable and should not be given further consideration. * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the ability to create corrupt database files using ordinary SQL. * Added support for read-only shadow tables when the SQLITE_DBCONFIG_DEFENSIVE option is enabled. * Added the PRAGMA legacy_alter_table command, which if enabled causes the ALTER TABLE command to behave like older version of SQLite (prior to version 3.25.0) for compatibility. * Added PRAGMA table_xinfo that works just like PRAGMA table_info except that it also shows hidden columns in virtual tables. * Added the explain virtual table as a run-time loadable extension. * Add a limit counter to the query planner to prevent excessive sqlite3_prepare() times for certain pathological SQL inputs. * Added support for the sqlite3_normalized_sql() interface, when compiling with SQLITE_ENABLE_NORMALIZE. * Enhanced triggers so that they can use table-valued functions that exist in schemas other than the schema where the trigger is defined. * Improvements to the ".help" command in the CLI. * The SQLITE_HISTORY environment variable, if it exists, specifies the name of the command-line editing history file. * The --deserialize option associated with opening a new database in the CLI cause the database file to be read into memory and accessed using the sqlite3_deserialize() API. This simplifies running tests on a database without modifying the file on disk. - Version 3.25.2: * Add the PRAGMA legacy_alter_table=ON command that causes the "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier * Fix issue with some expressions with windows functions in views - Version 3.25.1: * Avoid false-positive error checks on ALTER TABLE * Further ORDER BY LIMIT optimization fixes for window functions - Version 3.25.0: * Add support for window functions * Add support for renaming columns within a table * Query optimizer improvements * slightly better concurrency in multi-threaded environments * The ORDER BY LIMIT optimization might have caused an infinite loop in the byte code of the prepared statement under very obscure circumstances, due to a confluence of minor defects in the query optimizer - Version 3.24.0: * Add support for PostgreSQL-style UPSERT * Add support for auxiliary columns in r-tree tables * Add C-language APIs for discovering SQL keywords used by SQLite * Add C-language APIs for dynamic strings based on sqlite3_str * Enhance ALTER TABLE so that it recognizes "true" and "false" as valid arguments to DEFAULT * Add the sorter-reference optimization as a compile-time option * Improve the format of the EXPLAIN QUERY PLAN raw output, so that it gives better information about the query plan and about the relationships between the various components of the plan * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the sqlite3_db_config() API. * Automatically intercept the raw EXPLAIN QUERY PLAN output an reformat it into an ASCII-art graph. * Lines that begin with "#" and that are not in the middle of an SQL statement are interpreted as comments * Add the --append option to the ".backup" command * Add the ".dbconfig" command * various performance improvements * various bug fixes - Upgrade to 3.28.0: * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read. * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference. * Enhanced window functions * Enhanced VACUUM INTO so that it works for read-only databases. * New query optimizations. * Added the sqlite3_value_frombind() API for determining if the argument to an SQL function is from a bound parameter. * Security and compatibilities enhancements to fts3_tokenizer(). * Improved robustness against corrupt database files. - bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch: Improper validation of qlite_stat1 sz field leads to division by zero. - Sync version 3.36.0 from Factory to implement jsc#SLE-16032. - Obsoletes sqlite3-CVE-2019-16168.patch. - The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far: * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization * bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error * bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded '\0' input * bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference * bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite() * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive * bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names * CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables * CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query * CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091) - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter ("START") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.38.0 * Add the -> and ->> operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like "--wrap N", "--wordwrap on", and "--quote" to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value "3") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script - Sync version 3.44.0 from Factory * Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow * sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86. * Obsoletes sqlite-CVE-2022-46908.patch * Obsoletes sqlite-src-3390000-func7-pg-181.patch - Use url for source - Cleanup spec file with spec-cleaner - Enable LZ4 support - add patches to fix eventual file corruption (boo#953723) 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch - fix build for SLE12 and older - Machines with 1024 processors or more reach the limit of maximum file descriptors (bsc#984136). Other limits apply that may be hit for no good reason. Simply limit the number of used threads to an arbitrary number, squashfs-thread-limit. - sysmacros.patch: Include <sys/sysmacros.h> for major/minor/makedev - Use / as sed command delimiter. Comma can actually show up in optflags (think -Wl,…), which then breaks the sed command line parsing. - Use | instead of / that can be part of -L or -I options. - Disable LTO (boo#1133284). - Add -offset function to skip n bytes at the beginning of the squashfs… https://github.com/plougher/squashfs-tools/commit/5a498ad24dcfeac9f3d747e894f22901f3ac10 (0003-Add-offset-function-to-skip-n-bytes.patch) - Version 4.4 - 2019-08-29: * Reproducible builds, new compressors, CVE fixes, security hardening and new options for Mksquashfs/Unsquashfs. - Overall improvements: * Mksquashfs now generates reproducible images by default. * Mkfs time and file timestamps can also be specified. * Support for the Zstandard (ZSTD) compression algorithm. * CVE-2015-4645 and CVE-2015-4646 have been fixed. - Mksquashfs improvements and major bug fixes: * Pseudo files now support symbolic links. * New -mkfs-time option. * New -all-time option. * New -root-mode option. * New -quiet option. * New -noId option. * New -offset option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, don't allow "/" pseudo filenames. * Bug fix, allow quoting of pseudo files, to better handle filenames with spaces. * Fix compilation with glibc 2.25+. - Unsquashfs improvements and major bug fixes: * CVE-2015-4645 and CVE-2015-4646 have been fixed. * Unsquashfs has been further hardened against corrupted filestems. * Unsquashfs is now more strict about error handling. * New -ignore-errors option. * New -strict-errors option. * New -lln[umeric] option. * New -lc option. * New -llc option. * New -mkfs-time option. * New -UTC option. * New -offset option. * New -quiet option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, fatal and non-fatal errors now set the exit code to 1. * Bug fix, fix time setting for symlinks. * Bug fix, try to set sticky-bit when running as a user process. * Fix compilation with glibc 2.25+. - build changes: * re-created patches to fit squashfs 4.4 * removed 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch (new version includes this change) * removed 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch (new version includes this change) * removed 0003-Add-offset-function-to-skip-n-bytes.patch (new version includes this change) * removed sysmacros.patch (new version includes this change) - Add -fcommon in order to fix boo#1160294. - enabled ZSTD compression support for openSUSE >= 15.1 - update to 4.5: * Mksquashfs now supports "Actions". * New sqfstar command which will create a Squashfs image from a tar archive. * Tar style handling of source pathnames in Mksquashfs. * Cpio style handling of source pathnames in Mksquashfs. * New option to throttle the amount of CPU and I/O. * Mksquashfs now allows no source directory to be specified. * New Pseudo file "R" definition which allows a Regular file o be created with data stored within the Pseudo file. * Symbolic links are now followed in extract files * Unsquashfs now supports "exclude" files. * Max depth traversal option added. * Unsquashfs can now output a "Pseudo file" representing the input Squashfs filesystem. * New -one-file-system option in Mksquashfs. * New -no-hardlinks option in Mksquashfs. * Exit code in Unsquashfs changed to distinguish between non-fatal errors (exit 2), and fatal errors (exit 1). * Xattr id count added in Unsquashfs "-stat" output. * Unsquashfs "write outside directory" exploit fixed. * Error handling in Unsquashfs writer thread fixed. * Fix failure to truncate destination if appending aborted. * Prevent Mksquashfs reading the destination file. - update to 4.5.1 (bsc#1190531, CVE-2021-41072): * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and Sqfscat(1). * The -help text output from the utilities has been improved and extended as well (but the Manpages are now more comprehensive). * CVE-2021-41072 which is a writing outside of destination exploit, has been fixed. * The number of hard-links in the filesystem is now also displayed by Mksquashfs in the output summary. * The number of hard-links written by Unsquashfs is now also displayed in the output summary. * Unsquashfs will now write to a pre-existing destination directory, rather than aborting. * Unsquashfs now allows "." to used as the destination, to extract to the current directory. * The Unsquashfs progress bar now tracks empty files and hardlinks, in addition to data blocks. * -no-hardlinks option has been implemented for Sqfstar. * More sanity checking for "corrupted" filesystems, including checks for multiply linked directories and directory loops. * Options that may cause filesystems to be unmountable have been moved into a new "experts" category in the Mksquashfs help text (and Manpage). * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to overflow the stack, or cause system calls to fail with a too long pathname. * Don't always use "max open file limit" when calculating length of queues, as a very large file limit can cause Unsquashfs to abort. Instead use the smaller of max open file limit and cache size. * Fix Mksquashfs silently ignoring Pseudo file definitions when appending. * Don't abort if no XATTR support has been built in, and there's XATTRs in the filesystem. This is a regression introduced in 2019 in Version 4.4. * Fix duplicate check when the last file block is sparse. - set LZMA_XZ_SUPPORT=1 so you can (un)squash -comp lzma images - Do not repeat openSUSE / SLE version tests - Actually format and package the man pages - update to 4.6.1: * Race condition which can cause corruption of the "fragment table" fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option). * Fix build failure when the tools are being built without extended attribute (XATTRs) support. * Fix XATTR error message when an unrecognised prefix is found * Fix incorrect free of pointer when an unrecognised XATTR prefix is found. * Major improvements in extended attribute handling, pseudo file handling, and miscellaneous new options and improvements * Extended attribute handling improved in Mksquashfs and Sqfstar * New Pseudo file xattr definition to add extended attributes to files. * New xattrs-add Action to add extended attributes to files * Extended attribute handling improved in Unsquashfs * Other major improvements * Unsquashfs can now output Pseudo files to standard out. * Mksquashfs can now input Pseudo files from standard in. * Squashfs filesystems can now be converted (different block size compression etc) without unpacking to an intermediate filesystem or mounting, by piping the output of Unsquashfs to Mksquashfs. * Pseudo files are now supported by Sqfstar. * "Non-anchored" excludes are now supported by Unsquashfs. - For reference: previous updates fixed * CVE-2021-40153 (bsc#1189936) * CVE-2015-4645, CVE-2015-4646 (bsc#935380) - Use url for source - Cleanup spec file with spec-cleaner - Enable LZ4 support - add patches to fix eventual file corruption (boo#953723) 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch - fix build for SLE12 and older - Machines with 1024 processors or more reach the limit of maximum file descriptors (bsc#984136). Other limits apply that may be hit for no good reason. Simply limit the number of used threads to an arbitrary number, squashfs-thread-limit. - sysmacros.patch: Include <sys/sysmacros.h> for major/minor/makedev - Use / as sed command delimiter. Comma can actually show up in optflags (think -Wl,…), which then breaks the sed command line parsing. - Use | instead of / that can be part of -L or -I options. - Disable LTO (boo#1133284). - Add -offset function to skip n bytes at the beginning of the squashfs… https://github.com/plougher/squashfs-tools/commit/5a498ad24dcfeac9f3d747e894f22901f3ac10 (0003-Add-offset-function-to-skip-n-bytes.patch) - Version 4.4 - 2019-08-29: * Reproducible builds, new compressors, CVE fixes, security hardening and new options for Mksquashfs/Unsquashfs. - Overall improvements: * Mksquashfs now generates reproducible images by default. * Mkfs time and file timestamps can also be specified. * Support for the Zstandard (ZSTD) compression algorithm. * CVE-2015-4645 and CVE-2015-4646 have been fixed. - Mksquashfs improvements and major bug fixes: * Pseudo files now support symbolic links. * New -mkfs-time option. * New -all-time option. * New -root-mode option. * New -quiet option. * New -noId option. * New -offset option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, don't allow "/" pseudo filenames. * Bug fix, allow quoting of pseudo files, to better handle filenames with spaces. * Fix compilation with glibc 2.25+. - Unsquashfs improvements and major bug fixes: * CVE-2015-4645 and CVE-2015-4646 have been fixed. * Unsquashfs has been further hardened against corrupted filestems. * Unsquashfs is now more strict about error handling. * New -ignore-errors option. * New -strict-errors option. * New -lln[umeric] option. * New -lc option. * New -llc option. * New -mkfs-time option. * New -UTC option. * New -offset option. * New -quiet option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, fatal and non-fatal errors now set the exit code to 1. * Bug fix, fix time setting for symlinks. * Bug fix, try to set sticky-bit when running as a user process. * Fix compilation with glibc 2.25+. - build changes: * re-created patches to fit squashfs 4.4 * removed 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch (new version includes this change) * removed 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch (new version includes this change) * removed 0003-Add-offset-function-to-skip-n-bytes.patch (new version includes this change) * removed sysmacros.patch (new version includes this change) - Add -fcommon in order to fix boo#1160294. - enabled ZSTD compression support for openSUSE >= 15.1 - update to 4.5: * Mksquashfs now supports "Actions". * New sqfstar command which will create a Squashfs image from a tar archive. * Tar style handling of source pathnames in Mksquashfs. * Cpio style handling of source pathnames in Mksquashfs. * New option to throttle the amount of CPU and I/O. * Mksquashfs now allows no source directory to be specified. * New Pseudo file "R" definition which allows a Regular file o be created with data stored within the Pseudo file. * Symbolic links are now followed in extract files * Unsquashfs now supports "exclude" files. * Max depth traversal option added. * Unsquashfs can now output a "Pseudo file" representing the input Squashfs filesystem. * New -one-file-system option in Mksquashfs. * New -no-hardlinks option in Mksquashfs. * Exit code in Unsquashfs changed to distinguish between non-fatal errors (exit 2), and fatal errors (exit 1). * Xattr id count added in Unsquashfs "-stat" output. * Unsquashfs "write outside directory" exploit fixed. * Error handling in Unsquashfs writer thread fixed. * Fix failure to truncate destination if appending aborted. * Prevent Mksquashfs reading the destination file. - update to 4.5.1 (bsc#1190531, CVE-2021-41072): * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and Sqfscat(1). * The -help text output from the utilities has been improved and extended as well (but the Manpages are now more comprehensive). * CVE-2021-41072 which is a writing outside of destination exploit, has been fixed. * The number of hard-links in the filesystem is now also displayed by Mksquashfs in the output summary. * The number of hard-links written by Unsquashfs is now also displayed in the output summary. * Unsquashfs will now write to a pre-existing destination directory, rather than aborting. * Unsquashfs now allows "." to used as the destination, to extract to the current directory. * The Unsquashfs progress bar now tracks empty files and hardlinks, in addition to data blocks. * -no-hardlinks option has been implemented for Sqfstar. * More sanity checking for "corrupted" filesystems, including checks for multiply linked directories and directory loops. * Options that may cause filesystems to be unmountable have been moved into a new "experts" category in the Mksquashfs help text (and Manpage). * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to overflow the stack, or cause system calls to fail with a too long pathname. * Don't always use "max open file limit" when calculating length of queues, as a very large file limit can cause Unsquashfs to abort. Instead use the smaller of max open file limit and cache size. * Fix Mksquashfs silently ignoring Pseudo file definitions when appending. * Don't abort if no XATTR support has been built in, and there's XATTRs in the filesystem. This is a regression introduced in 2019 in Version 4.4. * Fix duplicate check when the last file block is sparse. - set LZMA_XZ_SUPPORT=1 so you can (un)squash -comp lzma images - Do not repeat openSUSE / SLE version tests - Actually format and package the man pages - update to 4.6.1: * Race condition which can cause corruption of the "fragment table" fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option). * Fix build failure when the tools are being built without extended attribute (XATTRs) support. * Fix XATTR error message when an unrecognised prefix is found * Fix incorrect free of pointer when an unrecognised XATTR prefix is found. * Major improvements in extended attribute handling, pseudo file handling, and miscellaneous new options and improvements * Extended attribute handling improved in Mksquashfs and Sqfstar * New Pseudo file xattr definition to add extended attributes to files. * New xattrs-add Action to add extended attributes to files * Extended attribute handling improved in Unsquashfs * Other major improvements * Unsquashfs can now output Pseudo files to standard out. * Mksquashfs can now input Pseudo files from standard in. * Squashfs filesystems can now be converted (different block size compression etc) without unpacking to an intermediate filesystem or mounting, by piping the output of Unsquashfs to Mksquashfs. * Pseudo files are now supported by Sqfstar. * "Non-anchored" excludes are now supported by Unsquashfs. - For reference: previous updates fixed * CVE-2021-40153 (bsc#1189936) * CVE-2015-4645, CVE-2015-4646 (bsc#935380) - Since version 4.3, squasfs does not require attr-devel but uses glibc instead. - Use url for source - Cleanup spec file with spec-cleaner - Enable LZ4 support - add patches to fix eventual file corruption (boo#953723) 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch - fix build for SLE12 and older - Machines with 1024 processors or more reach the limit of maximum file descriptors (bsc#984136). Other limits apply that may be hit for no good reason. Simply limit the number of used threads to an arbitrary number, squashfs-thread-limit. - sysmacros.patch: Include <sys/sysmacros.h> for major/minor/makedev - Use / as sed command delimiter. Comma can actually show up in optflags (think -Wl,…), which then breaks the sed command line parsing. - Use | instead of / that can be part of -L or -I options. - Disable LTO (boo#1133284). - Add -offset function to skip n bytes at the beginning of the squashfs… https://github.com/plougher/squashfs-tools/commit/5a498ad24dcfeac9f3d747e894f22901f3ac10 (0003-Add-offset-function-to-skip-n-bytes.patch) - Version 4.4 - 2019-08-29: * Reproducible builds, new compressors, CVE fixes, security hardening and new options for Mksquashfs/Unsquashfs. - Overall improvements: * Mksquashfs now generates reproducible images by default. * Mkfs time and file timestamps can also be specified. * Support for the Zstandard (ZSTD) compression algorithm. * CVE-2015-4645 and CVE-2015-4646 have been fixed. - Mksquashfs improvements and major bug fixes: * Pseudo files now support symbolic links. * New -mkfs-time option. * New -all-time option. * New -root-mode option. * New -quiet option. * New -noId option. * New -offset option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, don't allow "/" pseudo filenames. * Bug fix, allow quoting of pseudo files, to better handle filenames with spaces. * Fix compilation with glibc 2.25+. - Unsquashfs improvements and major bug fixes: * CVE-2015-4645 and CVE-2015-4646 have been fixed. * Unsquashfs has been further hardened against corrupted filestems. * Unsquashfs is now more strict about error handling. * New -ignore-errors option. * New -strict-errors option. * New -lln[umeric] option. * New -lc option. * New -llc option. * New -mkfs-time option. * New -UTC option. * New -offset option. * New -quiet option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, fatal and non-fatal errors now set the exit code to 1. * Bug fix, fix time setting for symlinks. * Bug fix, try to set sticky-bit when running as a user process. * Fix compilation with glibc 2.25+. - build changes: * re-created patches to fit squashfs 4.4 * removed 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch (new version includes this change) * removed 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch (new version includes this change) * removed 0003-Add-offset-function-to-skip-n-bytes.patch (new version includes this change) * removed sysmacros.patch (new version includes this change) - Add -fcommon in order to fix boo#1160294. - enabled ZSTD compression support for openSUSE >= 15.1 - update to 4.5: * Mksquashfs now supports "Actions". * New sqfstar command which will create a Squashfs image from a tar archive. * Tar style handling of source pathnames in Mksquashfs. * Cpio style handling of source pathnames in Mksquashfs. * New option to throttle the amount of CPU and I/O. * Mksquashfs now allows no source directory to be specified. * New Pseudo file "R" definition which allows a Regular file o be created with data stored within the Pseudo file. * Symbolic links are now followed in extract files * Unsquashfs now supports "exclude" files. * Max depth traversal option added. * Unsquashfs can now output a "Pseudo file" representing the input Squashfs filesystem. * New -one-file-system option in Mksquashfs. * New -no-hardlinks option in Mksquashfs. * Exit code in Unsquashfs changed to distinguish between non-fatal errors (exit 2), and fatal errors (exit 1). * Xattr id count added in Unsquashfs "-stat" output. * Unsquashfs "write outside directory" exploit fixed. * Error handling in Unsquashfs writer thread fixed. * Fix failure to truncate destination if appending aborted. * Prevent Mksquashfs reading the destination file. - update to 4.5.1 (bsc#1190531, CVE-2021-41072): * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and Sqfscat(1). * The -help text output from the utilities has been improved and extended as well (but the Manpages are now more comprehensive). * CVE-2021-41072 which is a writing outside of destination exploit, has been fixed. * The number of hard-links in the filesystem is now also displayed by Mksquashfs in the output summary. * The number of hard-links written by Unsquashfs is now also displayed in the output summary. * Unsquashfs will now write to a pre-existing destination directory, rather than aborting. * Unsquashfs now allows "." to used as the destination, to extract to the current directory. * The Unsquashfs progress bar now tracks empty files and hardlinks, in addition to data blocks. * -no-hardlinks option has been implemented for Sqfstar. * More sanity checking for "corrupted" filesystems, including checks for multiply linked directories and directory loops. * Options that may cause filesystems to be unmountable have been moved into a new "experts" category in the Mksquashfs help text (and Manpage). * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to overflow the stack, or cause system calls to fail with a too long pathname. * Don't always use "max open file limit" when calculating length of queues, as a very large file limit can cause Unsquashfs to abort. Instead use the smaller of max open file limit and cache size. * Fix Mksquashfs silently ignoring Pseudo file definitions when appending. * Don't abort if no XATTR support has been built in, and there's XATTRs in the filesystem. This is a regression introduced in 2019 in Version 4.4. * Fix duplicate check when the last file block is sparse. - set LZMA_XZ_SUPPORT=1 so you can (un)squash -comp lzma images - Do not repeat openSUSE / SLE version tests - Actually format and package the man pages - update to 4.6.1: * Race condition which can cause corruption of the "fragment table" fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option). * Fix build failure when the tools are being built without extended attribute (XATTRs) support. * Fix XATTR error message when an unrecognised prefix is found * Fix incorrect free of pointer when an unrecognised XATTR prefix is found. * Major improvements in extended attribute handling, pseudo file handling, and miscellaneous new options and improvements * Extended attribute handling improved in Mksquashfs and Sqfstar * New Pseudo file xattr definition to add extended attributes to files. * New xattrs-add Action to add extended attributes to files * Extended attribute handling improved in Unsquashfs * Other major improvements * Unsquashfs can now output Pseudo files to standard out. * Mksquashfs can now input Pseudo files from standard in. * Squashfs filesystems can now be converted (different block size compression etc) without unpacking to an intermediate filesystem or mounting, by piping the output of Unsquashfs to Mksquashfs. * Pseudo files are now supported by Sqfstar. * "Non-anchored" excludes are now supported by Unsquashfs. - For reference: previous updates fixed * CVE-2021-40153 (bsc#1189936) * CVE-2015-4645, CVE-2015-4646 (bsc#935380) - Use url for source - Cleanup spec file with spec-cleaner - Enable LZ4 support - add patches to fix eventual file corruption (boo#953723) 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch - fix build for SLE12 and older - Machines with 1024 processors or more reach the limit of maximum file descriptors (bsc#984136). Other limits apply that may be hit for no good reason. Simply limit the number of used threads to an arbitrary number, squashfs-thread-limit. - sysmacros.patch: Include <sys/sysmacros.h> for major/minor/makedev - Use / as sed command delimiter. Comma can actually show up in optflags (think -Wl,…), which then breaks the sed command line parsing. - Use | instead of / that can be part of -L or -I options. - Disable LTO (boo#1133284). - Add -offset function to skip n bytes at the beginning of the squashfs… https://github.com/plougher/squashfs-tools/commit/5a498ad24dcfeac9f3d747e894f22901f3ac10 (0003-Add-offset-function-to-skip-n-bytes.patch) - Version 4.4 - 2019-08-29: * Reproducible builds, new compressors, CVE fixes, security hardening and new options for Mksquashfs/Unsquashfs. - Overall improvements: * Mksquashfs now generates reproducible images by default. * Mkfs time and file timestamps can also be specified. * Support for the Zstandard (ZSTD) compression algorithm. * CVE-2015-4645 and CVE-2015-4646 have been fixed. - Mksquashfs improvements and major bug fixes: * Pseudo files now support symbolic links. * New -mkfs-time option. * New -all-time option. * New -root-mode option. * New -quiet option. * New -noId option. * New -offset option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, don't allow "/" pseudo filenames. * Bug fix, allow quoting of pseudo files, to better handle filenames with spaces. * Fix compilation with glibc 2.25+. - Unsquashfs improvements and major bug fixes: * CVE-2015-4645 and CVE-2015-4646 have been fixed. * Unsquashfs has been further hardened against corrupted filestems. * Unsquashfs is now more strict about error handling. * New -ignore-errors option. * New -strict-errors option. * New -lln[umeric] option. * New -lc option. * New -llc option. * New -mkfs-time option. * New -UTC option. * New -offset option. * New -quiet option. * Update lz4 wrapper to use new functions introduced in 1.7.0. * Bug fix, fatal and non-fatal errors now set the exit code to 1. * Bug fix, fix time setting for symlinks. * Bug fix, try to set sticky-bit when running as a user process. * Fix compilation with glibc 2.25+. - build changes: * re-created patches to fit squashfs 4.4 * removed 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch (new version includes this change) * removed 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch (new version includes this change) * removed 0003-Add-offset-function-to-skip-n-bytes.patch (new version includes this change) * removed sysmacros.patch (new version includes this change) - Add -fcommon in order to fix boo#1160294. - enabled ZSTD compression support for openSUSE >= 15.1 - update to 4.5: * Mksquashfs now supports "Actions". * New sqfstar command which will create a Squashfs image from a tar archive. * Tar style handling of source pathnames in Mksquashfs. * Cpio style handling of source pathnames in Mksquashfs. * New option to throttle the amount of CPU and I/O. * Mksquashfs now allows no source directory to be specified. * New Pseudo file "R" definition which allows a Regular file o be created with data stored within the Pseudo file. * Symbolic links are now followed in extract files * Unsquashfs now supports "exclude" files. * Max depth traversal option added. * Unsquashfs can now output a "Pseudo file" representing the input Squashfs filesystem. * New -one-file-system option in Mksquashfs. * New -no-hardlinks option in Mksquashfs. * Exit code in Unsquashfs changed to distinguish between non-fatal errors (exit 2), and fatal errors (exit 1). * Xattr id count added in Unsquashfs "-stat" output. * Unsquashfs "write outside directory" exploit fixed. * Error handling in Unsquashfs writer thread fixed. * Fix failure to truncate destination if appending aborted. * Prevent Mksquashfs reading the destination file. - update to 4.5.1 (bsc#1190531, CVE-2021-41072): * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and Sqfscat(1). * The -help text output from the utilities has been improved and extended as well (but the Manpages are now more comprehensive). * CVE-2021-41072 which is a writing outside of destination exploit, has been fixed. * The number of hard-links in the filesystem is now also displayed by Mksquashfs in the output summary. * The number of hard-links written by Unsquashfs is now also displayed in the output summary. * Unsquashfs will now write to a pre-existing destination directory, rather than aborting. * Unsquashfs now allows "." to used as the destination, to extract to the current directory. * The Unsquashfs progress bar now tracks empty files and hardlinks, in addition to data blocks. * -no-hardlinks option has been implemented for Sqfstar. * More sanity checking for "corrupted" filesystems, including checks for multiply linked directories and directory loops. * Options that may cause filesystems to be unmountable have been moved into a new "experts" category in the Mksquashfs help text (and Manpage). * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to overflow the stack, or cause system calls to fail with a too long pathname. * Don't always use "max open file limit" when calculating length of queues, as a very large file limit can cause Unsquashfs to abort. Instead use the smaller of max open file limit and cache size. * Fix Mksquashfs silently ignoring Pseudo file definitions when appending. * Don't abort if no XATTR support has been built in, and there's XATTRs in the filesystem. This is a regression introduced in 2019 in Version 4.4. * Fix duplicate check when the last file block is sparse. - set LZMA_XZ_SUPPORT=1 so you can (un)squash -comp lzma images - Do not repeat openSUSE / SLE version tests - Actually format and package the man pages - update to 4.6.1: * Race condition which can cause corruption of the "fragment table" fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option). * Fix build failure when the tools are being built without extended attribute (XATTRs) support. * Fix XATTR error message when an unrecognised prefix is found * Fix incorrect free of pointer when an unrecognised XATTR prefix is found. * Major improvements in extended attribute handling, pseudo file handling, and miscellaneous new options and improvements * Extended attribute handling improved in Mksquashfs and Sqfstar * New Pseudo file xattr definition to add extended attributes to files. * New xattrs-add Action to add extended attributes to files * Extended attribute handling improved in Unsquashfs * Other major improvements * Unsquashfs can now output Pseudo files to standard out. * Mksquashfs can now input Pseudo files from standard in. * Squashfs filesystems can now be converted (different block size compression etc) without unpacking to an intermediate filesystem or mounting, by piping the output of Unsquashfs to Mksquashfs. * Pseudo files are now supported by Sqfstar. * "Non-anchored" excludes are now supported by Unsquashfs. - For reference: previous updates fixed * CVE-2021-40153 (bsc#1189936) * CVE-2015-4645, CVE-2015-4646 (bsc#935380) - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Only send cldap-ping to our local domain; (bsc#1217319); (gh#SSSD/sssd#5822); - Do not write kdc info file for GC lookup; (bsc#1217319); (gh#SSSD/sssd#5956); - Add patch 0007-bsc1217319-gh5875-gh5956.patch - Decrease sudo responder log level when searching non-existent entries; (bsc#1216907); Add patch 0008-SUDO-decrease-log-level-in-case-object-wasn-t-found.patch - Update shadowLastChanged attribute during LDAP password change; (bsc#1218537); Add patch 0009-Update-shadowLastChanged-attribute-during-LDAP-passw.patch - Fix possible race evaluating GPO based access policies; (CVE-2023-3758); (bsc#1223100); Add patch 0010-ad-gpo-use-hash-to-store-intermediate-results.patch - Use the name from the cached entries when updating them to avoid capitalization problems; (bsc#1223050); Add patch 0011-SYSDB-Use-SYSDB_NAME-from-cached-entry-when-updating.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - Install infopipe dbus service (bsc#1106598) - Update samba secrets after changing machine password; (jsc#SLE-11503); Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch - Fix dynamic DNS updates not using FQDN (bsc#1160587); Add 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch - Fix build against samba >= 4.12 + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch - Fix build with curl >= 7.62.0 + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch - Fix a dependency loop by moving internal libraries to sssd-common package; (bsc#1182058); - Move sssctl command from sssd to sssd-tools package; (bsc#1184289); - Create timestamp attribute in cache objects if missing; (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch - Use /run instead of /var/run for daemon PID files; (bsc#1185185); - Fix sss_cache spurious error messages when invoked from shadow-utils; (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Update to version 2.5.2; (jsc#SLE-17763); * originalADgidNumber attribute in the SSSD cache is now indexed. * Add new config option fallback_to_nss. - Changes from version 2.5.1 * auto_private_groups option can be set centrally through ID range setting in IPA (see ipa idrange commands family). This feature requires SSSD update on both client and server. This feature also requires freeipa 4.9.4 and newer. * Fix getsidbyname issues with IPA users with a user-private-group. * Default value of ldap_sudo_random_offset changed to 0 (disabled). This makes sure that sudo rules are available as soon as possible after SSSD start in default configuration. - Changes from version 2.5.0 * Added support for automatic renewal of renewable TGTs that are stored in KCM ccache. This can be enabled by setting tgt_renewal = true. See the sssd-kcm man page for more details. This feature requires MIT Kerberos krb5-1.19-0.beta2.3 or higher. * Backround sudo periodic tasks (smart and full refresh) periods are now extended by a random offset to spread the load on the server in environments with many clients. * Completing a sudo full refresh now postpones the smart refresh by ldap_sudo_smart_refresh_interval value. This ensure that the smart refresh is not run too soon after a successful full refresh. * If debug_backtrace_enabled is set to true then on any error all prior debug messages (to some limit) are printed even if debug_level is set to low value. * Besides trusted domains known by the forest root, trusted domains known by the local domain are used as well. * New configuration option offline_timeout_random_offset to control random factor in backend probing interval when SSSD is in offline mode. * ad_gpo_implicit_deny is now respected even if there are no applicable GPOs present. * During the IPA subdomains request a failure in reading a single specific configuration option is not considered fatal and the request will continue. * Unknown IPA id-range types are not considered as an error - Changes from version 2.4.2 * Default value of "user" config option was fixed into accordance with man page, i.e. default is "root". * pam_sss_gss now support authentication indicators to further harden the authentication. - Changes from version 2.4.1 * New PAM module pam_sss_gss for authentication using GSSAPI. * case_sensitive=Preserving can now be set for trusted domains with AD and IPA providers. * krb5_use_subdomain_realm=True can now be used when sub-domain user principal names have upnSuffixes which are not known in the parent domain. SSSD will try to send the Kerberos request directly to a KDC of the sub-domain. * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald output, to avoid issues with PID parsing in rsyslog (BSD-style forwarder) output. * Added pam_gssapi_check_upn to enforce authentication only with principal that can be associated with target user. * Added pam_gssapi_services to list PAM services that can authenticate using GSSAPI. - Changes from version 2.4.0 * Session recording can now exclude specific users or groups when scope is set to all (see exclude_users and exclude_groups options). * Active Directory provider now sends CLDAP pings over UDP protocol to Domain Controllers in parallel to determine site and forest to speed up server discovery. - Changes from version 2.3.1 * Domains can be now explicitly enabled or disabled using enable option in domain section. This can be especially used in configuration snippets. * New configuration options memcache_size_passwd, memcache_size_group, memcache_size_initgroups that can be used to control memory cache size. * Fixed several regressions in GPO processing introduced in sssd-2.3.0 * Fixed regression in PAM responder: failures in cache only lookups are no longer considered fatal. * Fixed regression in proxy provider: pwfield=x is now default value only for sssd-shadowutils target. - Changes from version 2.3.0 * SSSD can now handle hosts and networks nsswitch databases (see resolve_provider option). * By default, authentication request only refresh user's initgroups if it is expired or there is not active user's session (see pam_initgroups_scheme option). * OpenSSL is used as default crypto provider, NSS is deprecated. * The AD provider now defaults to GSS-SPNEGO SASL mechanism (see ldap_sasl_mech option). * The AD provider can now be configured to use only ldaps port (see ad_use_ldaps option). * SSSD now accepts host entries from GPO's security filter. * New debug level (0x10000) added for low level LDB messages only (see sssd.conf man page). - Changes from version 2.2.3 * allow_missing_name now treats empty strings the same as missing names. * "soft_ocsp" and "soft_crl" options have been added to make the checks for revoked certificates more flexible if the system is offline. * Smart card authentication in polkit is now allowed by default. * Handling of FreeIPA users and groups containing ‘@’ sign now works. * Issue when autofs was unable to mount shares was fixed. * SSSD was unable to hande ldap_uri containing URIs with different port numbers, which has been rectified. - Changes from version 2.2.2 * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache. This has been fixed. * Because of a race condition SSSD could crash during shutdown. The race condition was fixed. * Fixed a bug that limited number of external groups fetched by SSSD to 2000. * pam_sss now properly creates gnome keyring during login. * SSSD with KCM could wrongly pick older ccache instead of the latest one after login. This was fixed. - Changes from version 2.2.1 * New options were added which allow sssd-kcm to handle bigger data. * SSSD can now automatically refresh cached user data from subdomains in IPA/AD trust. * Fixed issue with SSSD hanging when connecting to non-responsive server with ldaps://. * SSSD is now restarted by systemd after crashes. * Fixed refression when dyndns_update was set to True and dyndns_refresh_interval was not set or set to 0 then DNS records were not updated at all. * Fixed issue when default_domain_suffix was used with files provider and caused all results from files domain to be fully qualified. * Fixed issue with sudo rules not being visible on OpenLDAP servers * Fixed crash with auth_provider = proxy that prevented logins - Changes from version 2.2.0 * The Kerberos provider can now include more KDC addresses or host names when writing data for the Kerberos locator plugin. * The 2FA prompting can now be configured. * The LDAP authentication provider now allows to use a different method of changing LDAP passwords using a modify operation in addition to the default extended operation. * The "auto_private_groups" configuration option now takes a new value hybrid. * A new option "ad_gpo_ignore_unreadable" was added. * The "cached_auth_timeout" parameter is now inherited by trusted domains. * The "ldap_sasl_mech" option now accepts another mechanism "GSS-SPNEGO" in addition to "GSSAPI". * The sssctl tool has two new commands, "cert-show" and "cert-map". - Changes from version 2.1.0 * Any provider can now match and map certificates to user identities. * pam_sss can now be configured to only perform Smart Card authentication or return an error if this is not possible. * pam_sss can also prompt the user to insert a Smart Card if, during an authentication it is not available. * It is now possible to refresh the KCM configuration without restarting the whole SSSD deamon * A new configuration option ad_gpo_implicit_deny was added. This option (when set to True) can be used to deny access to users even if there is not applicable GPO. * The dynamic DNS update can now batch DNS updates to include all address family updates in a single transaction. - Changes from version 2.0.0 * The Python API for managing users and groups in local domains (id_provider=local) was removed completely. The local provider (id_provider=local) and the command line tools to manage users and groups in the local domains, such as sss_useradd is not built anymore. * The LDAP provider had a special-case branch for evaluating group memberships with the RFC2307bis schema when group nesting was explicitly disabled. This codepath is removed. * The ldap_groups_use_matching_rule_in_chain and ldap_initgroups_use_matching_rule_in_chain options and the code that evaluated them was removed. * The "ldap_sudo_include_regexp" option changed its default value from true to false. Wildcards in the sudoHost LDAP attribute are no longer evaluated. This was costly to evaluate on the LDAP server side and at the same time rarely used. * The KCM responder has a new back end to store credential caches in a local database * The list of PAM services which are allowed to authenticate using a Smart Card is now configurable using a new option pam_p11_allowed_services. - Make cifs-idmap plugin (idmapwb.so) use update-alternatives mechanism to be able to switch between cifs-utils and sssd; (bsc#1182682). - Build sssd's KCM - Drop obsolete patches: + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch + 0002-intg-Do-not-hardcode-nsslibdir.patch + 0003-MONITOR-Do-not-use-two-configuration-databases.patch + 0004-Strip-whitespaces-in-netgroup-triple.patch + 0005-nss-sssd-returns-for-emtpy-home-directories.patch + 0006-Rotate-child-log-files.patch + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch + 0014-util-Remove-the-unused-function-is_email_from_domain.patch + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch + 0019-winbind-idmap-plugin-support-inferface-version-6.patch + 0020-winbind-idmap-plugin-fix-detection.patch + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch + 0027-utils-make-N_ELEMENTS-public.patch + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch + sssd-gpo_host_security_filter-1.16.1.patch + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch + 0036-ad_gpo_ndr.c-more-ndr-updates.patch + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch + 0038-CACHE-Create-timestamp-if-missing.patch + 0039-sss_cache-Do-not-fail-for-missing-domains.patch - Remove libsmbclient-devel BuildRequires in favor of pkgconfig(smbclient) - Update the private ldb modules installation following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba - Remove caches only when performing a package downgrade. The sssd daemon takes care of upgrading the database format when necessary (bsc#1195552) - Fix 32-bit libraries package. Libraries were moved from sssd to sssd-common to fix bsc#1182058 and baselibs.conf was not updated accordingly; (bsc#1196166); - Add 'ldap_ignore_unreadable_references' parameter to skip unreadable objects referenced by 'member' attributte; (bsc#1190775); (gh#SSSD/sssd#4893); Add patch 0001-ldap-ignore-unreadable-references.patch - Fix shell command injection in sssctl via the logs-fetch and cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add 0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch - Fix sdap_access_host No matching host rule found; (bsc#1202559); Add patch 0001-Fix-sdap_access_host-No-matching-host-rule-found.patch - Fix build with MIT 1.20; Add patch 0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch - Fix sssd entering failed state under heavy load by adding watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283); Add patch 0001-sssd-watchdog.patch - ldap password policy: return failure if there are no grace logins left; (bsc#1214434); Add patch 0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch - disable test failing with kernel 5.0 - Update to strace 5.0 * Changes in behavior * -D option now implies -I4 * Diagnostic message is no longer printed if an attempt to restart a process has failed with ESRCH. * ASCII dump no longer tries to read the whole buffer at once. * Improvements * Changed the way tracees are handled: all pending tracees are now waited for before further processing, this improves fairness of tracee processing. * Enhanced xlat styles support configured by -X option. * Enhanced decoding of bpf syscall. * Enhanced pid formatting in strace-log-merge output. * Wired up kexec_file_load and rseq syscalls on aarch64, arc, metag, nios2, or1k, riscv, and tile architectures. * Updated lists of BPF_*, BTRFS_*, FAN_*, IFLA_*, KERN_*, KVM_CAP_*, NDA_*, NETNSA_*, NT_*, PR_*, REL_*, SECCOMP_*, SCTP_*, UDP_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.0. * Bug fixes * Fixed ordering of sockaddr_in6 fields. * Fixed strace-k test on alpha. * Fixed build on mips o32. * Fixed build on NOMMU architectures. * Fixed build in --with-libiberty=yes mode. * Fixed potential NULL dereference during printing of line continuation for syscalls that haven't been decoded. * Fixed strace-log-merge error diagnostics. - Ignore testsuite failures - Update to strace 5.1 * Bug fixes * Fixed decoding of last two arguments of clone syscall on riscv. * Improvements * Added C-SKY architecture support. * Implemented decoding of SO_TIMESTAMP*_NEW control messages. * Implemented decoding of clock_gettime64, clock_settime64, clock_adjtime64, clock_getres_time64, clock_nanosleep_time64, timer_gettime64, timer_settime64, timerfd_gettime64, timerfd_settime64, utimensat_time64, pselect6_time64, ppoll_time64, io_pgetevents_time64, recvmmsg_time64, mq_timedsend_time64, mq_timedreceive_time64, semtimedop_time64, rt_sigtimedwait_time64, futex_time64, sched_rr_get_interval_time64, pidfd_send_signal, io_uring_setup, io_uring_enter, and io_uring_register syscalls. * Enhanced decoding of bpf syscall. * Wired up getegid, geteuid, getppid, io_pgetevents, statfs64, and fstatfs64 syscalls on alpha. * Wired up kexec_file_load and migrate_pages syscalls on arm. * Wired up io_pgetevents, perf_event_open, seccomp, and statx syscalls on ia64. * Wired up seccomp syscall on m68k. * Wired up statx syscall on sh. * Wired up pkey_mprotect, pkey_alloc, and pkey_free syscalls on alpha, hppa, ia64, m68k, s390, s390x, sh, sparc, and sparc64. * Wired up rseq syscall on alpha, hppa, ia64, m68k, sh, sparc, sparc64, and xtensa. * Wired up direct ipc syscalls on m68k, mips o32, powerpc, powerpc64, s390, s390x, sh, sparc, sparc64, and x86. * Updated lists of BPF_*, FAN_*, F_SEAL_*, IPV6_*, NT_*, PR_SPEC_*, SO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.1. - Update to strace 5.2 (boo#1149727) * Improvements * Implemented syscall return status filtering with -e status=set option and its aliases: -z (limit syscall printing to successful syscalls only) and -Z (limit syscall printing to failed syscalls only). * Implemented decoding of open_tree, move_mount, fsopen, fsconfig, fsmount, and fspick syscalls. * Enhanced decoding of bpf, clone, inotify_init, mbind, and set_mempolicy syscalls. * Updated lists of AT_*, AUDIT_*, BPF_*, CLONE_*, ETH_*, KEY_*, KVM_*, MPOL_*, TIPC_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.2. * Bug fixes * Fixed syscall tampering on powerpc, powerpc64, sparc, and sparc64 when PTRACE_GET_SYSCALL_INFO is in use. * Fixed build with cutting-edge toolchain. - Update to strace 5.3 * Improvements * Implemented usage of seccomp-bpf for stopping tracees only for filtered syscalls. Use --seccomp-bpf option to enable. * Implemented decoding of pidfd_open and clone3 syscalls. * Enhanced decoding of io_cancel, io_submit, s390_sthyi, and syslog syscalls. * Enhanced decoding of NETLINK_ROUTE protocol. * Implemented decoding of UNIX_DIAG_UID netlink attribute. * Implemented decoding of WDIOC_* ioctl commands. * Enchanced syscall count statistics: overhead is now applied per-call, added ability for sorting on errors field. * Syscall delay injection and overhead values can now be supplied with time measure unit suffix and provided in IEEE 754 floating point format. * Updated lists of AUDIT_*, BPF_*, ETH_*, KEYCTL_*, KVM_*, MAP_*, SO_*, TCP_*, V4L2_*, XDP_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.3. * Enhanced manual page. * Bug fixes * Fixed syscall tampering on arc, avr32, csky, ia64, m68k, metag, mips, nios2, or1k, riscv, s390, s390x, sparc, sparc64, and tile architectures when PTRACE_GET_SYSCALL_INFO is in use. * Fixed decoding of sockaddr_hci (AF_BLUETOOTH) addresses that lack hci_channel field. * Fixed evdev ioctl bitset decoding. * Fixed tests on alpha with Linux kernel headers 5.1+. * Portability * Removed support for decoding syscalls in range [1024...1079] on AArch64 architecture as this range has never been implemented in mainline kernel releases. - Update to strace 5.4 * Improvements * Implemented -DD and -DDD options that move strace into a separate process group and session, respectively. * Enhanced seccomp-bpf tracee syscall filtering support by implementing new "binary match" BPF program generation strategy and automatically choosing the strategy that generates the shortest BPF program. * Implemented decoding of BPF_BTF_GET_NEXT_ID bpf syscall command. * Enhanced decoding of BPF_MAP_LOOKUP_ELEM bpf syscall command. * Implemented PTP_CLOCK_GETCAPS2, PTP_EXTTS_REQUEST2, PTP_PEROUT_REQUEST2, PTP_ENABLE_PPS2, and PTP_SYS_OFFSET2 ioctl decoding. * Updated lists of BPF_*, CAN_*, KEXEC_*, KVM_*, MADV_*, MSG_*, P_*, PR_*, PTP_*, SCTP_*, and V4L2_* constants. * Implemented ability to build ARM EABI mpers support using a separate compiler on aarch64. * Updated lists of ioctl commands from Linux 5.4. * Enhanced manual page. * Bug fixes * Fixed -b execve when --seccomp-bpf option is specified. * Fixed decoding of BPF_PROG_LOAD bpf syscall command. * Fixed build on no-MMU architectures. * Fixed build on antique systems that do not provide necessary definitions of AUDIT_ARCH_* constants. - Use -ffat-lto-objects to work around mpers.sh failure - Update to strace 5.5 * Improvements * Added -e trace=%creds option for tracing syscalls related to process credentials. * Enhanced decoding of arch_prctl, keyctl, io_uring_register, io_uring_setup, and perf_event_open syscalls. * Enhanced decoding of BPF_PROG_LOAD bpf syscall command. * Updated decoding of clone3 syscall to match Linux 5.5. * Implemented decoding of TCA_ACT_FLAGS and TCA_STATS_PKT64 netlink attributes. * Updated lists of AUDIT_*, BPF_*, CLONE_*, KEY_*, KVM_*, PPC_PTRACE_*, SCTP_*, STATX_*, TIPC_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.5. * Enhanced manual page and "strace --help" output. * Bug fixes * Fixed stack trace printing for early syscalls when strace is configured to use libdw backend for stack tracing (addresses Fedora bug #1788636). * Fixed stack trace caching when --seccomp-bpf option is specified. * Fixed potentially unaligned access in decoder of SO_TIMESTAMP*_NEW control messages. * Fixed decoding of NDA_LLADDR netlink neighbor table attribute. * Fixed build of mpers support when CFLAGS contains -flto. * Fixed build on no-MMU architectures. * Fixed build with glibc-2.31 and Linux kernel headers < 5.3. * Fixed tests for glibc-2.31. - Update to strace 5.6 * Changes in behaviour * Messages about unknown tracees are now subject to the strace's quietness setting (-q/--quiet). * If -A option is provided without -o, or -S option without -c/-C, a warning about its uselessness is printed now. * The usage of --seccomp-bpf without -f has no effect now. * Improvements * Every short option now has a long option alias, which also has enabled the following improvements: * Ability to use human-readable settings for -I/--interruptible, - D/--daemonize options. * Ability to silence specific messages using -e quiet/--quiet qualifier (an alias for the -q option), including those that couldn't be silenced previously (path resolution messages and "superseded by execve"). * Ability to specify selected fd decoding features using - e decode-fds/--decode-fds qualifier (an alias for the -y option). * Ability to set precision for the absolute timestamp, relative timestamp, and syscall time output (using --absolute-timestamps, - -relative-timestamps, and --syscall-times options, respectively). * Implemented ability to select the set of displayed columns in the call summary output (-U/--summary-columns option). * Implemented ability to sort on any summary column. * Implemented ability to show information about minimum and maximum call duration in the call summary output (addresses Debian bug #240945). * Implemented printing of PIDs associated with pidfds in -yy mode. * Implemented PTRACE_GETREGS API support on hppa, sh, sh64, and xtensa. * Improved performance of libdw-based stack traces printing by implementing a symbol-to-address cache. * Implemented decoding of openat2 and pidfd_getfd syscalls. * Enhanced io_uring_register, prctl, sched_getattr, and sched_setattr syscall decoding. * Implemented decoding of BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, and BPF_MAP_DELETE_BATCH bpf syscall commands. * Enhanced decoding of BPF_MAP_CREATE and BPF_PROG_ATTACH bpf syscall commands. * Enhanced decoding of RTC_VL_READ ioctl command. * Enhanced decoding of IFLA_* netlink attributes. * Implemented HIDIOCGRAWUNIQ() ioctl command number printing. * Wired up kexec_file_load syscall on hppa. * Updated lists of AUDIT_*, BPF_*, CLONE_*, GRND_*, IFLA_*, IORING_*, IPPROTO_*, KEY_*, KVM_*, RTM_F_*, SCHED_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.6. * Bug fixes * Fixed build on csky abiv1 architecture. * Various minor fixes in VIDIOC_* ioctl output formatting. * Fix printing of the size field for _IOC_NONE ioctl command numbers on sparc. - Update to strace 5.7 * Improvements * Implemented interval specification in "when=" subexpression of syscall tampering expressions. * Added -e trace=%clock option for tracing syscalls reading of modifying system clocks. * Implemented decoding of BPF_LINK_CREATE and BPF_LINK_UPDATE bpf syscall commands. * Updated decoding of clone3 syscall to match Linux 5.7. * Updated lists of BPF_*, BTRFS_*, CLONE_*, FAN_*, IORING_*, KVM_*, LWTUNNEL_*, MREMAP_*, PERF_*, SECCOMP_*, UFFDIO_*, V4L2_*, and XDP_* constants. * Updated lists of ioctl commands from Linux 5.7. * Bug fixes * Fixed decoding of getdents and getdents64 syscalls when they return a lot of directory entries. * Fixed pathtrace matching of openat2 syscall. - Update to strace 5.8 * Changes in behaviour * Modified %process class to contain system calls associated with process lifecycle (creation, exec, termination): kill, tkill, tgkill, pidfd_send_signal and rt_sigqueueinfo are added, arch_prctl and unshare are removed. * Improvements * Implemented decoding of faccessat2 syscall. * Implemented decoding of LOOP_CONFIGURE ioctl command. * Updated decoding of io_uring_setup syscall to match Linux 5.8. * Updated lists of AUDIT_*, BPF_*, CAP_*, ETH_*, INET_DIAG_*, IORING_*, KEYCTL_*, KVM_*, LOOP_*, NDA_*, RTC_*, TCA_*, STATX_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.8. * Bug fixes * Added statx syscall to %fstat trace class. - Update to strace 5.9 * Improvements * Added -n/--syscall-number option for printing syscall numbers. * Added --pidns-translation option for PID namespace translation (addresses Fedora bug #1035433). * Implemented decoding of close_range syscall. * Implemented decoding of TEE_* ioctl commands. * Implemented decoding of struct msginfo argument of IPC_INFO and MSG_INFO msgctl syscall commands. * Implemented decoding of struct msqid_ds argument of MSG_STAT and MSG_STAT_ANY msgctl syscall commands. * Implemented decoding of struct seminfo argument of IPC_INFO and SEM_INFO semctl syscall commands. * Implemented decoding of struct semid_ds argument of IPC_SET, IPC_STAT, SEM_STAT, and SEM_STAT_ANY semctl syscall commands. * Implemented decoding of struct shminfo argument of IPC_INFO shmctl syscall command. * Implemented decoding of struct shm_info argument of SHM_INFO shmctl syscall command. * Implemented decoding of struct shmid_ds argument of SHM_STAT and SHM_STAT_ANY shmctl syscall commands. * Updated lists of BPF_*, CAP_*, FAN_*, IFLA_*, INET_DIAG_REQ_*, IORING_FEAT_*, IP_*, IPV6_*, KVM_*, NDA_*, PTP_PEROUT_*, RTPROT_*, and V4L2_FMT_FLAG_* constants. * Updated lists of ioctl commands from Linux 5.9. - Update to strace 5.10 * Improvements * libdw-based stack tracing is now enabled for non-native personalities. * Implemented decoding of process_madvise syscall introduced in Linux 5.10. * Updated decoding of pidfd_open syscall to match Linux 5.10. * Updated decoding of membarrier syscall to match Linux 5.10. * Updated lists of ALG_*, BPF_*, INET_DIAG_*, IORING_*, KEY_*, KVM_*, MDBA_*, MEMBARRIER_CMD_*, MS_*, NLMSGERR_*, NT_*, STATX_*, SEGV_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.10. * Bug fixes * Added clock_gettime64, clock_settime64, clock_adjtime64, and lock_getres_time64 syscalls to %clock trace class. - Update to strace 5.11 * Improvements * Implemented poke injection (--inject=SET:poke_enter= and - -inject=SET:poke_exit= options). * Implemented decoding of epoll_pwait2 syscall introduced in Linux 5.11. * Implemented decoding of GPIO_* ioctl commands. * Implemented decoding of FS_IOC_FS[GS]ETXATTR, FS_IOC_[GS]ETFLAGS, and FS_IOC32_[GS]ETFLAGS ioctl commands. * Implemented decoding of SIOCADDMULTI, SIOCDELMULTI, SIOCGIFENCAP, SIOCOUTQNSD, SIOCSIFENCAP, and SIOCSIFHWBROADCAST ioctl commands. * Implemented decoding of UBI_IOCRPEB and UBI_IOCSPEB ioctl commands. * Implemented decoding of V4L2_BUF_TYPE_META_CAPTURE, V4L2_BUF_TYPE_META_OUTPUT, and VIDIOC_QUERY_EXT_CTRL ioctl commands. * Updated lists of BPF_*, BTRFS_*, CLOSE_RANGE_*, ETH_*, IORING_*, KVM_*, PR_*, PTRACE_*, RTA_*, RTAX_*, RTM_*, RTNH_*, SCTP_*, SO_*, SYS_*, UFFD_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.11. * Bug fixes * Fixed decoding of SIOCGIFINDEX, SIOCBRADDIF, and SIOCBRDELIF ioctl commands. - Add strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch in order to workaround gh#171 issue related to the latest binutils release (https://sourceware.org/bugzilla/show_bug.cgi?id=27309). - Update to strace 5.12 * Improvements * Implemented --secontext[=full] option to display SELinux contexts. * Implemented decoding of mount_setattr syscall introduced in Linux 5.12. * Updated decoding of IFLA_BRPORT_* netlink attributes to match Linux 5.12. * Updated lists of DEVCONF_*, IORING_*, KVM_*, MPOL_*, MTD_*, NFT_MSG_*, RESOLVE_*, RTM_*, ST_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.12. - strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch: removed - Update to strace 5.13 * Improvements * Print netlink data in a more structured way. * Implemented decoding of NT_PRSTATUS and NT_FPREGSET regsets of PTRACE_GETREGSET and PTRACE_SETREGSET requests. * Implemented decoding of regs argument of PTRACE_GETREGS, PTRACE_GETREGS64, PTRACE_SETREGS, PTRACE_SETREGS64, PTRACE_GETFPREGS, and PTRACE_SETFPREGS requests. * Implemented powerpc System Call Vectored ABI support. * Implemented decoding of landlock_add_rule, landlock_create_ruleset, and landlock_restrict_self syscalls introduced in Linux 5.13. * Enhanced decoding of perf_event_open syscall. * Updated lists of BPF_*, IORING_*, KEXEC_*, KEY_*, KVM_*, NT_*, PR_*, PTRACE_*, RTM_*, RTPROT_*, TRAP_*, UFFD_*, UFFDIO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.13. - Update to strace 5.14 * Improvements * Implemented decoding of memfd_secret and quotactl_fd syscalls, introduced in Linux 5.14. * Enhanced prctl syscall decoding. * Enhanced decoding of IFLA_* netlink attributes. * Enhanced decoding of MDBA_ROUTER_PATTR_* mdb router port netlink attributes. * Updated lists of BPF_*, IORING_*, MADV_*, MOUNT_ATTR_*, SCTP_*, and UFFD_* constants. * Updated lists of ioctl commands from Linux 5.14. - Change the license to the correct LGPL-2.1-or-later (bsc#1228216). - disable test failing with kernel 5.0 - Update to strace 5.0 * Changes in behavior * -D option now implies -I4 * Diagnostic message is no longer printed if an attempt to restart a process has failed with ESRCH. * ASCII dump no longer tries to read the whole buffer at once. * Improvements * Changed the way tracees are handled: all pending tracees are now waited for before further processing, this improves fairness of tracee processing. * Enhanced xlat styles support configured by -X option. * Enhanced decoding of bpf syscall. * Enhanced pid formatting in strace-log-merge output. * Wired up kexec_file_load and rseq syscalls on aarch64, arc, metag, nios2, or1k, riscv, and tile architectures. * Updated lists of BPF_*, BTRFS_*, FAN_*, IFLA_*, KERN_*, KVM_CAP_*, NDA_*, NETNSA_*, NT_*, PR_*, REL_*, SECCOMP_*, SCTP_*, UDP_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.0. * Bug fixes * Fixed ordering of sockaddr_in6 fields. * Fixed strace-k test on alpha. * Fixed build on mips o32. * Fixed build on NOMMU architectures. * Fixed build in --with-libiberty=yes mode. * Fixed potential NULL dereference during printing of line continuation for syscalls that haven't been decoded. * Fixed strace-log-merge error diagnostics. - Ignore testsuite failures - Update to strace 5.1 * Bug fixes * Fixed decoding of last two arguments of clone syscall on riscv. * Improvements * Added C-SKY architecture support. * Implemented decoding of SO_TIMESTAMP*_NEW control messages. * Implemented decoding of clock_gettime64, clock_settime64, clock_adjtime64, clock_getres_time64, clock_nanosleep_time64, timer_gettime64, timer_settime64, timerfd_gettime64, timerfd_settime64, utimensat_time64, pselect6_time64, ppoll_time64, io_pgetevents_time64, recvmmsg_time64, mq_timedsend_time64, mq_timedreceive_time64, semtimedop_time64, rt_sigtimedwait_time64, futex_time64, sched_rr_get_interval_time64, pidfd_send_signal, io_uring_setup, io_uring_enter, and io_uring_register syscalls. * Enhanced decoding of bpf syscall. * Wired up getegid, geteuid, getppid, io_pgetevents, statfs64, and fstatfs64 syscalls on alpha. * Wired up kexec_file_load and migrate_pages syscalls on arm. * Wired up io_pgetevents, perf_event_open, seccomp, and statx syscalls on ia64. * Wired up seccomp syscall on m68k. * Wired up statx syscall on sh. * Wired up pkey_mprotect, pkey_alloc, and pkey_free syscalls on alpha, hppa, ia64, m68k, s390, s390x, sh, sparc, and sparc64. * Wired up rseq syscall on alpha, hppa, ia64, m68k, sh, sparc, sparc64, and xtensa. * Wired up direct ipc syscalls on m68k, mips o32, powerpc, powerpc64, s390, s390x, sh, sparc, sparc64, and x86. * Updated lists of BPF_*, FAN_*, F_SEAL_*, IPV6_*, NT_*, PR_SPEC_*, SO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.1. - Update to strace 5.2 (boo#1149727) * Improvements * Implemented syscall return status filtering with -e status=set option and its aliases: -z (limit syscall printing to successful syscalls only) and -Z (limit syscall printing to failed syscalls only). * Implemented decoding of open_tree, move_mount, fsopen, fsconfig, fsmount, and fspick syscalls. * Enhanced decoding of bpf, clone, inotify_init, mbind, and set_mempolicy syscalls. * Updated lists of AT_*, AUDIT_*, BPF_*, CLONE_*, ETH_*, KEY_*, KVM_*, MPOL_*, TIPC_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.2. * Bug fixes * Fixed syscall tampering on powerpc, powerpc64, sparc, and sparc64 when PTRACE_GET_SYSCALL_INFO is in use. * Fixed build with cutting-edge toolchain. - Update to strace 5.3 * Improvements * Implemented usage of seccomp-bpf for stopping tracees only for filtered syscalls. Use --seccomp-bpf option to enable. * Implemented decoding of pidfd_open and clone3 syscalls. * Enhanced decoding of io_cancel, io_submit, s390_sthyi, and syslog syscalls. * Enhanced decoding of NETLINK_ROUTE protocol. * Implemented decoding of UNIX_DIAG_UID netlink attribute. * Implemented decoding of WDIOC_* ioctl commands. * Enchanced syscall count statistics: overhead is now applied per-call, added ability for sorting on errors field. * Syscall delay injection and overhead values can now be supplied with time measure unit suffix and provided in IEEE 754 floating point format. * Updated lists of AUDIT_*, BPF_*, ETH_*, KEYCTL_*, KVM_*, MAP_*, SO_*, TCP_*, V4L2_*, XDP_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.3. * Enhanced manual page. * Bug fixes * Fixed syscall tampering on arc, avr32, csky, ia64, m68k, metag, mips, nios2, or1k, riscv, s390, s390x, sparc, sparc64, and tile architectures when PTRACE_GET_SYSCALL_INFO is in use. * Fixed decoding of sockaddr_hci (AF_BLUETOOTH) addresses that lack hci_channel field. * Fixed evdev ioctl bitset decoding. * Fixed tests on alpha with Linux kernel headers 5.1+. * Portability * Removed support for decoding syscalls in range [1024...1079] on AArch64 architecture as this range has never been implemented in mainline kernel releases. - Update to strace 5.4 * Improvements * Implemented -DD and -DDD options that move strace into a separate process group and session, respectively. * Enhanced seccomp-bpf tracee syscall filtering support by implementing new "binary match" BPF program generation strategy and automatically choosing the strategy that generates the shortest BPF program. * Implemented decoding of BPF_BTF_GET_NEXT_ID bpf syscall command. * Enhanced decoding of BPF_MAP_LOOKUP_ELEM bpf syscall command. * Implemented PTP_CLOCK_GETCAPS2, PTP_EXTTS_REQUEST2, PTP_PEROUT_REQUEST2, PTP_ENABLE_PPS2, and PTP_SYS_OFFSET2 ioctl decoding. * Updated lists of BPF_*, CAN_*, KEXEC_*, KVM_*, MADV_*, MSG_*, P_*, PR_*, PTP_*, SCTP_*, and V4L2_* constants. * Implemented ability to build ARM EABI mpers support using a separate compiler on aarch64. * Updated lists of ioctl commands from Linux 5.4. * Enhanced manual page. * Bug fixes * Fixed -b execve when --seccomp-bpf option is specified. * Fixed decoding of BPF_PROG_LOAD bpf syscall command. * Fixed build on no-MMU architectures. * Fixed build on antique systems that do not provide necessary definitions of AUDIT_ARCH_* constants. - Use -ffat-lto-objects to work around mpers.sh failure - Update to strace 5.5 * Improvements * Added -e trace=%creds option for tracing syscalls related to process credentials. * Enhanced decoding of arch_prctl, keyctl, io_uring_register, io_uring_setup, and perf_event_open syscalls. * Enhanced decoding of BPF_PROG_LOAD bpf syscall command. * Updated decoding of clone3 syscall to match Linux 5.5. * Implemented decoding of TCA_ACT_FLAGS and TCA_STATS_PKT64 netlink attributes. * Updated lists of AUDIT_*, BPF_*, CLONE_*, KEY_*, KVM_*, PPC_PTRACE_*, SCTP_*, STATX_*, TIPC_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.5. * Enhanced manual page and "strace --help" output. * Bug fixes * Fixed stack trace printing for early syscalls when strace is configured to use libdw backend for stack tracing (addresses Fedora bug #1788636). * Fixed stack trace caching when --seccomp-bpf option is specified. * Fixed potentially unaligned access in decoder of SO_TIMESTAMP*_NEW control messages. * Fixed decoding of NDA_LLADDR netlink neighbor table attribute. * Fixed build of mpers support when CFLAGS contains -flto. * Fixed build on no-MMU architectures. * Fixed build with glibc-2.31 and Linux kernel headers < 5.3. * Fixed tests for glibc-2.31. - Update to strace 5.6 * Changes in behaviour * Messages about unknown tracees are now subject to the strace's quietness setting (-q/--quiet). * If -A option is provided without -o, or -S option without -c/-C, a warning about its uselessness is printed now. * The usage of --seccomp-bpf without -f has no effect now. * Improvements * Every short option now has a long option alias, which also has enabled the following improvements: * Ability to use human-readable settings for -I/--interruptible, - D/--daemonize options. * Ability to silence specific messages using -e quiet/--quiet qualifier (an alias for the -q option), including those that couldn't be silenced previously (path resolution messages and "superseded by execve"). * Ability to specify selected fd decoding features using - e decode-fds/--decode-fds qualifier (an alias for the -y option). * Ability to set precision for the absolute timestamp, relative timestamp, and syscall time output (using --absolute-timestamps, - -relative-timestamps, and --syscall-times options, respectively). * Implemented ability to select the set of displayed columns in the call summary output (-U/--summary-columns option). * Implemented ability to sort on any summary column. * Implemented ability to show information about minimum and maximum call duration in the call summary output (addresses Debian bug #240945). * Implemented printing of PIDs associated with pidfds in -yy mode. * Implemented PTRACE_GETREGS API support on hppa, sh, sh64, and xtensa. * Improved performance of libdw-based stack traces printing by implementing a symbol-to-address cache. * Implemented decoding of openat2 and pidfd_getfd syscalls. * Enhanced io_uring_register, prctl, sched_getattr, and sched_setattr syscall decoding. * Implemented decoding of BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, and BPF_MAP_DELETE_BATCH bpf syscall commands. * Enhanced decoding of BPF_MAP_CREATE and BPF_PROG_ATTACH bpf syscall commands. * Enhanced decoding of RTC_VL_READ ioctl command. * Enhanced decoding of IFLA_* netlink attributes. * Implemented HIDIOCGRAWUNIQ() ioctl command number printing. * Wired up kexec_file_load syscall on hppa. * Updated lists of AUDIT_*, BPF_*, CLONE_*, GRND_*, IFLA_*, IORING_*, IPPROTO_*, KEY_*, KVM_*, RTM_F_*, SCHED_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.6. * Bug fixes * Fixed build on csky abiv1 architecture. * Various minor fixes in VIDIOC_* ioctl output formatting. * Fix printing of the size field for _IOC_NONE ioctl command numbers on sparc. - Update to strace 5.7 * Improvements * Implemented interval specification in "when=" subexpression of syscall tampering expressions. * Added -e trace=%clock option for tracing syscalls reading of modifying system clocks. * Implemented decoding of BPF_LINK_CREATE and BPF_LINK_UPDATE bpf syscall commands. * Updated decoding of clone3 syscall to match Linux 5.7. * Updated lists of BPF_*, BTRFS_*, CLONE_*, FAN_*, IORING_*, KVM_*, LWTUNNEL_*, MREMAP_*, PERF_*, SECCOMP_*, UFFDIO_*, V4L2_*, and XDP_* constants. * Updated lists of ioctl commands from Linux 5.7. * Bug fixes * Fixed decoding of getdents and getdents64 syscalls when they return a lot of directory entries. * Fixed pathtrace matching of openat2 syscall. - Update to strace 5.8 * Changes in behaviour * Modified %process class to contain system calls associated with process lifecycle (creation, exec, termination): kill, tkill, tgkill, pidfd_send_signal and rt_sigqueueinfo are added, arch_prctl and unshare are removed. * Improvements * Implemented decoding of faccessat2 syscall. * Implemented decoding of LOOP_CONFIGURE ioctl command. * Updated decoding of io_uring_setup syscall to match Linux 5.8. * Updated lists of AUDIT_*, BPF_*, CAP_*, ETH_*, INET_DIAG_*, IORING_*, KEYCTL_*, KVM_*, LOOP_*, NDA_*, RTC_*, TCA_*, STATX_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.8. * Bug fixes * Added statx syscall to %fstat trace class. - Update to strace 5.9 * Improvements * Added -n/--syscall-number option for printing syscall numbers. * Added --pidns-translation option for PID namespace translation (addresses Fedora bug #1035433). * Implemented decoding of close_range syscall. * Implemented decoding of TEE_* ioctl commands. * Implemented decoding of struct msginfo argument of IPC_INFO and MSG_INFO msgctl syscall commands. * Implemented decoding of struct msqid_ds argument of MSG_STAT and MSG_STAT_ANY msgctl syscall commands. * Implemented decoding of struct seminfo argument of IPC_INFO and SEM_INFO semctl syscall commands. * Implemented decoding of struct semid_ds argument of IPC_SET, IPC_STAT, SEM_STAT, and SEM_STAT_ANY semctl syscall commands. * Implemented decoding of struct shminfo argument of IPC_INFO shmctl syscall command. * Implemented decoding of struct shm_info argument of SHM_INFO shmctl syscall command. * Implemented decoding of struct shmid_ds argument of SHM_STAT and SHM_STAT_ANY shmctl syscall commands. * Updated lists of BPF_*, CAP_*, FAN_*, IFLA_*, INET_DIAG_REQ_*, IORING_FEAT_*, IP_*, IPV6_*, KVM_*, NDA_*, PTP_PEROUT_*, RTPROT_*, and V4L2_FMT_FLAG_* constants. * Updated lists of ioctl commands from Linux 5.9. - Update to strace 5.10 * Improvements * libdw-based stack tracing is now enabled for non-native personalities. * Implemented decoding of process_madvise syscall introduced in Linux 5.10. * Updated decoding of pidfd_open syscall to match Linux 5.10. * Updated decoding of membarrier syscall to match Linux 5.10. * Updated lists of ALG_*, BPF_*, INET_DIAG_*, IORING_*, KEY_*, KVM_*, MDBA_*, MEMBARRIER_CMD_*, MS_*, NLMSGERR_*, NT_*, STATX_*, SEGV_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.10. * Bug fixes * Added clock_gettime64, clock_settime64, clock_adjtime64, and lock_getres_time64 syscalls to %clock trace class. - Update to strace 5.11 * Improvements * Implemented poke injection (--inject=SET:poke_enter= and - -inject=SET:poke_exit= options). * Implemented decoding of epoll_pwait2 syscall introduced in Linux 5.11. * Implemented decoding of GPIO_* ioctl commands. * Implemented decoding of FS_IOC_FS[GS]ETXATTR, FS_IOC_[GS]ETFLAGS, and FS_IOC32_[GS]ETFLAGS ioctl commands. * Implemented decoding of SIOCADDMULTI, SIOCDELMULTI, SIOCGIFENCAP, SIOCOUTQNSD, SIOCSIFENCAP, and SIOCSIFHWBROADCAST ioctl commands. * Implemented decoding of UBI_IOCRPEB and UBI_IOCSPEB ioctl commands. * Implemented decoding of V4L2_BUF_TYPE_META_CAPTURE, V4L2_BUF_TYPE_META_OUTPUT, and VIDIOC_QUERY_EXT_CTRL ioctl commands. * Updated lists of BPF_*, BTRFS_*, CLOSE_RANGE_*, ETH_*, IORING_*, KVM_*, PR_*, PTRACE_*, RTA_*, RTAX_*, RTM_*, RTNH_*, SCTP_*, SO_*, SYS_*, UFFD_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.11. * Bug fixes * Fixed decoding of SIOCGIFINDEX, SIOCBRADDIF, and SIOCBRDELIF ioctl commands. - Add strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch in order to workaround gh#171 issue related to the latest binutils release (https://sourceware.org/bugzilla/show_bug.cgi?id=27309). - Update to strace 5.12 * Improvements * Implemented --secontext[=full] option to display SELinux contexts. * Implemented decoding of mount_setattr syscall introduced in Linux 5.12. * Updated decoding of IFLA_BRPORT_* netlink attributes to match Linux 5.12. * Updated lists of DEVCONF_*, IORING_*, KVM_*, MPOL_*, MTD_*, NFT_MSG_*, RESOLVE_*, RTM_*, ST_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.12. - strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch: removed - Update to strace 5.13 * Improvements * Print netlink data in a more structured way. * Implemented decoding of NT_PRSTATUS and NT_FPREGSET regsets of PTRACE_GETREGSET and PTRACE_SETREGSET requests. * Implemented decoding of regs argument of PTRACE_GETREGS, PTRACE_GETREGS64, PTRACE_SETREGS, PTRACE_SETREGS64, PTRACE_GETFPREGS, and PTRACE_SETFPREGS requests. * Implemented powerpc System Call Vectored ABI support. * Implemented decoding of landlock_add_rule, landlock_create_ruleset, and landlock_restrict_self syscalls introduced in Linux 5.13. * Enhanced decoding of perf_event_open syscall. * Updated lists of BPF_*, IORING_*, KEXEC_*, KEY_*, KVM_*, NT_*, PR_*, PTRACE_*, RTM_*, RTPROT_*, TRAP_*, UFFD_*, UFFDIO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.13. - Update to strace 5.14 * Improvements * Implemented decoding of memfd_secret and quotactl_fd syscalls, introduced in Linux 5.14. * Enhanced prctl syscall decoding. * Enhanced decoding of IFLA_* netlink attributes. * Enhanced decoding of MDBA_ROUTER_PATTR_* mdb router port netlink attributes. * Updated lists of BPF_*, IORING_*, MADV_*, MOUNT_ATTR_*, SCTP_*, and UFFD_* constants. * Updated lists of ioctl commands from Linux 5.14. - Change the license to the correct LGPL-2.1-or-later (bsc#1228216). - disable test failing with kernel 5.0 - Update to strace 5.0 * Changes in behavior * -D option now implies -I4 * Diagnostic message is no longer printed if an attempt to restart a process has failed with ESRCH. * ASCII dump no longer tries to read the whole buffer at once. * Improvements * Changed the way tracees are handled: all pending tracees are now waited for before further processing, this improves fairness of tracee processing. * Enhanced xlat styles support configured by -X option. * Enhanced decoding of bpf syscall. * Enhanced pid formatting in strace-log-merge output. * Wired up kexec_file_load and rseq syscalls on aarch64, arc, metag, nios2, or1k, riscv, and tile architectures. * Updated lists of BPF_*, BTRFS_*, FAN_*, IFLA_*, KERN_*, KVM_CAP_*, NDA_*, NETNSA_*, NT_*, PR_*, REL_*, SECCOMP_*, SCTP_*, UDP_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.0. * Bug fixes * Fixed ordering of sockaddr_in6 fields. * Fixed strace-k test on alpha. * Fixed build on mips o32. * Fixed build on NOMMU architectures. * Fixed build in --with-libiberty=yes mode. * Fixed potential NULL dereference during printing of line continuation for syscalls that haven't been decoded. * Fixed strace-log-merge error diagnostics. - Ignore testsuite failures - Update to strace 5.1 * Bug fixes * Fixed decoding of last two arguments of clone syscall on riscv. * Improvements * Added C-SKY architecture support. * Implemented decoding of SO_TIMESTAMP*_NEW control messages. * Implemented decoding of clock_gettime64, clock_settime64, clock_adjtime64, clock_getres_time64, clock_nanosleep_time64, timer_gettime64, timer_settime64, timerfd_gettime64, timerfd_settime64, utimensat_time64, pselect6_time64, ppoll_time64, io_pgetevents_time64, recvmmsg_time64, mq_timedsend_time64, mq_timedreceive_time64, semtimedop_time64, rt_sigtimedwait_time64, futex_time64, sched_rr_get_interval_time64, pidfd_send_signal, io_uring_setup, io_uring_enter, and io_uring_register syscalls. * Enhanced decoding of bpf syscall. * Wired up getegid, geteuid, getppid, io_pgetevents, statfs64, and fstatfs64 syscalls on alpha. * Wired up kexec_file_load and migrate_pages syscalls on arm. * Wired up io_pgetevents, perf_event_open, seccomp, and statx syscalls on ia64. * Wired up seccomp syscall on m68k. * Wired up statx syscall on sh. * Wired up pkey_mprotect, pkey_alloc, and pkey_free syscalls on alpha, hppa, ia64, m68k, s390, s390x, sh, sparc, and sparc64. * Wired up rseq syscall on alpha, hppa, ia64, m68k, sh, sparc, sparc64, and xtensa. * Wired up direct ipc syscalls on m68k, mips o32, powerpc, powerpc64, s390, s390x, sh, sparc, sparc64, and x86. * Updated lists of BPF_*, FAN_*, F_SEAL_*, IPV6_*, NT_*, PR_SPEC_*, SO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.1. - Update to strace 5.2 (boo#1149727) * Improvements * Implemented syscall return status filtering with -e status=set option and its aliases: -z (limit syscall printing to successful syscalls only) and -Z (limit syscall printing to failed syscalls only). * Implemented decoding of open_tree, move_mount, fsopen, fsconfig, fsmount, and fspick syscalls. * Enhanced decoding of bpf, clone, inotify_init, mbind, and set_mempolicy syscalls. * Updated lists of AT_*, AUDIT_*, BPF_*, CLONE_*, ETH_*, KEY_*, KVM_*, MPOL_*, TIPC_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.2. * Bug fixes * Fixed syscall tampering on powerpc, powerpc64, sparc, and sparc64 when PTRACE_GET_SYSCALL_INFO is in use. * Fixed build with cutting-edge toolchain. - Update to strace 5.3 * Improvements * Implemented usage of seccomp-bpf for stopping tracees only for filtered syscalls. Use --seccomp-bpf option to enable. * Implemented decoding of pidfd_open and clone3 syscalls. * Enhanced decoding of io_cancel, io_submit, s390_sthyi, and syslog syscalls. * Enhanced decoding of NETLINK_ROUTE protocol. * Implemented decoding of UNIX_DIAG_UID netlink attribute. * Implemented decoding of WDIOC_* ioctl commands. * Enchanced syscall count statistics: overhead is now applied per-call, added ability for sorting on errors field. * Syscall delay injection and overhead values can now be supplied with time measure unit suffix and provided in IEEE 754 floating point format. * Updated lists of AUDIT_*, BPF_*, ETH_*, KEYCTL_*, KVM_*, MAP_*, SO_*, TCP_*, V4L2_*, XDP_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.3. * Enhanced manual page. * Bug fixes * Fixed syscall tampering on arc, avr32, csky, ia64, m68k, metag, mips, nios2, or1k, riscv, s390, s390x, sparc, sparc64, and tile architectures when PTRACE_GET_SYSCALL_INFO is in use. * Fixed decoding of sockaddr_hci (AF_BLUETOOTH) addresses that lack hci_channel field. * Fixed evdev ioctl bitset decoding. * Fixed tests on alpha with Linux kernel headers 5.1+. * Portability * Removed support for decoding syscalls in range [1024...1079] on AArch64 architecture as this range has never been implemented in mainline kernel releases. - Update to strace 5.4 * Improvements * Implemented -DD and -DDD options that move strace into a separate process group and session, respectively. * Enhanced seccomp-bpf tracee syscall filtering support by implementing new "binary match" BPF program generation strategy and automatically choosing the strategy that generates the shortest BPF program. * Implemented decoding of BPF_BTF_GET_NEXT_ID bpf syscall command. * Enhanced decoding of BPF_MAP_LOOKUP_ELEM bpf syscall command. * Implemented PTP_CLOCK_GETCAPS2, PTP_EXTTS_REQUEST2, PTP_PEROUT_REQUEST2, PTP_ENABLE_PPS2, and PTP_SYS_OFFSET2 ioctl decoding. * Updated lists of BPF_*, CAN_*, KEXEC_*, KVM_*, MADV_*, MSG_*, P_*, PR_*, PTP_*, SCTP_*, and V4L2_* constants. * Implemented ability to build ARM EABI mpers support using a separate compiler on aarch64. * Updated lists of ioctl commands from Linux 5.4. * Enhanced manual page. * Bug fixes * Fixed -b execve when --seccomp-bpf option is specified. * Fixed decoding of BPF_PROG_LOAD bpf syscall command. * Fixed build on no-MMU architectures. * Fixed build on antique systems that do not provide necessary definitions of AUDIT_ARCH_* constants. - Use -ffat-lto-objects to work around mpers.sh failure - Update to strace 5.5 * Improvements * Added -e trace=%creds option for tracing syscalls related to process credentials. * Enhanced decoding of arch_prctl, keyctl, io_uring_register, io_uring_setup, and perf_event_open syscalls. * Enhanced decoding of BPF_PROG_LOAD bpf syscall command. * Updated decoding of clone3 syscall to match Linux 5.5. * Implemented decoding of TCA_ACT_FLAGS and TCA_STATS_PKT64 netlink attributes. * Updated lists of AUDIT_*, BPF_*, CLONE_*, KEY_*, KVM_*, PPC_PTRACE_*, SCTP_*, STATX_*, TIPC_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.5. * Enhanced manual page and "strace --help" output. * Bug fixes * Fixed stack trace printing for early syscalls when strace is configured to use libdw backend for stack tracing (addresses Fedora bug #1788636). * Fixed stack trace caching when --seccomp-bpf option is specified. * Fixed potentially unaligned access in decoder of SO_TIMESTAMP*_NEW control messages. * Fixed decoding of NDA_LLADDR netlink neighbor table attribute. * Fixed build of mpers support when CFLAGS contains -flto. * Fixed build on no-MMU architectures. * Fixed build with glibc-2.31 and Linux kernel headers < 5.3. * Fixed tests for glibc-2.31. - Update to strace 5.6 * Changes in behaviour * Messages about unknown tracees are now subject to the strace's quietness setting (-q/--quiet). * If -A option is provided without -o, or -S option without -c/-C, a warning about its uselessness is printed now. * The usage of --seccomp-bpf without -f has no effect now. * Improvements * Every short option now has a long option alias, which also has enabled the following improvements: * Ability to use human-readable settings for -I/--interruptible, - D/--daemonize options. * Ability to silence specific messages using -e quiet/--quiet qualifier (an alias for the -q option), including those that couldn't be silenced previously (path resolution messages and "superseded by execve"). * Ability to specify selected fd decoding features using - e decode-fds/--decode-fds qualifier (an alias for the -y option). * Ability to set precision for the absolute timestamp, relative timestamp, and syscall time output (using --absolute-timestamps, - -relative-timestamps, and --syscall-times options, respectively). * Implemented ability to select the set of displayed columns in the call summary output (-U/--summary-columns option). * Implemented ability to sort on any summary column. * Implemented ability to show information about minimum and maximum call duration in the call summary output (addresses Debian bug #240945). * Implemented printing of PIDs associated with pidfds in -yy mode. * Implemented PTRACE_GETREGS API support on hppa, sh, sh64, and xtensa. * Improved performance of libdw-based stack traces printing by implementing a symbol-to-address cache. * Implemented decoding of openat2 and pidfd_getfd syscalls. * Enhanced io_uring_register, prctl, sched_getattr, and sched_setattr syscall decoding. * Implemented decoding of BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, and BPF_MAP_DELETE_BATCH bpf syscall commands. * Enhanced decoding of BPF_MAP_CREATE and BPF_PROG_ATTACH bpf syscall commands. * Enhanced decoding of RTC_VL_READ ioctl command. * Enhanced decoding of IFLA_* netlink attributes. * Implemented HIDIOCGRAWUNIQ() ioctl command number printing. * Wired up kexec_file_load syscall on hppa. * Updated lists of AUDIT_*, BPF_*, CLONE_*, GRND_*, IFLA_*, IORING_*, IPPROTO_*, KEY_*, KVM_*, RTM_F_*, SCHED_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.6. * Bug fixes * Fixed build on csky abiv1 architecture. * Various minor fixes in VIDIOC_* ioctl output formatting. * Fix printing of the size field for _IOC_NONE ioctl command numbers on sparc. - Update to strace 5.7 * Improvements * Implemented interval specification in "when=" subexpression of syscall tampering expressions. * Added -e trace=%clock option for tracing syscalls reading of modifying system clocks. * Implemented decoding of BPF_LINK_CREATE and BPF_LINK_UPDATE bpf syscall commands. * Updated decoding of clone3 syscall to match Linux 5.7. * Updated lists of BPF_*, BTRFS_*, CLONE_*, FAN_*, IORING_*, KVM_*, LWTUNNEL_*, MREMAP_*, PERF_*, SECCOMP_*, UFFDIO_*, V4L2_*, and XDP_* constants. * Updated lists of ioctl commands from Linux 5.7. * Bug fixes * Fixed decoding of getdents and getdents64 syscalls when they return a lot of directory entries. * Fixed pathtrace matching of openat2 syscall. - Update to strace 5.8 * Changes in behaviour * Modified %process class to contain system calls associated with process lifecycle (creation, exec, termination): kill, tkill, tgkill, pidfd_send_signal and rt_sigqueueinfo are added, arch_prctl and unshare are removed. * Improvements * Implemented decoding of faccessat2 syscall. * Implemented decoding of LOOP_CONFIGURE ioctl command. * Updated decoding of io_uring_setup syscall to match Linux 5.8. * Updated lists of AUDIT_*, BPF_*, CAP_*, ETH_*, INET_DIAG_*, IORING_*, KEYCTL_*, KVM_*, LOOP_*, NDA_*, RTC_*, TCA_*, STATX_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.8. * Bug fixes * Added statx syscall to %fstat trace class. - Update to strace 5.9 * Improvements * Added -n/--syscall-number option for printing syscall numbers. * Added --pidns-translation option for PID namespace translation (addresses Fedora bug #1035433). * Implemented decoding of close_range syscall. * Implemented decoding of TEE_* ioctl commands. * Implemented decoding of struct msginfo argument of IPC_INFO and MSG_INFO msgctl syscall commands. * Implemented decoding of struct msqid_ds argument of MSG_STAT and MSG_STAT_ANY msgctl syscall commands. * Implemented decoding of struct seminfo argument of IPC_INFO and SEM_INFO semctl syscall commands. * Implemented decoding of struct semid_ds argument of IPC_SET, IPC_STAT, SEM_STAT, and SEM_STAT_ANY semctl syscall commands. * Implemented decoding of struct shminfo argument of IPC_INFO shmctl syscall command. * Implemented decoding of struct shm_info argument of SHM_INFO shmctl syscall command. * Implemented decoding of struct shmid_ds argument of SHM_STAT and SHM_STAT_ANY shmctl syscall commands. * Updated lists of BPF_*, CAP_*, FAN_*, IFLA_*, INET_DIAG_REQ_*, IORING_FEAT_*, IP_*, IPV6_*, KVM_*, NDA_*, PTP_PEROUT_*, RTPROT_*, and V4L2_FMT_FLAG_* constants. * Updated lists of ioctl commands from Linux 5.9. - Update to strace 5.10 * Improvements * libdw-based stack tracing is now enabled for non-native personalities. * Implemented decoding of process_madvise syscall introduced in Linux 5.10. * Updated decoding of pidfd_open syscall to match Linux 5.10. * Updated decoding of membarrier syscall to match Linux 5.10. * Updated lists of ALG_*, BPF_*, INET_DIAG_*, IORING_*, KEY_*, KVM_*, MDBA_*, MEMBARRIER_CMD_*, MS_*, NLMSGERR_*, NT_*, STATX_*, SEGV_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.10. * Bug fixes * Added clock_gettime64, clock_settime64, clock_adjtime64, and lock_getres_time64 syscalls to %clock trace class. - Update to strace 5.11 * Improvements * Implemented poke injection (--inject=SET:poke_enter= and - -inject=SET:poke_exit= options). * Implemented decoding of epoll_pwait2 syscall introduced in Linux 5.11. * Implemented decoding of GPIO_* ioctl commands. * Implemented decoding of FS_IOC_FS[GS]ETXATTR, FS_IOC_[GS]ETFLAGS, and FS_IOC32_[GS]ETFLAGS ioctl commands. * Implemented decoding of SIOCADDMULTI, SIOCDELMULTI, SIOCGIFENCAP, SIOCOUTQNSD, SIOCSIFENCAP, and SIOCSIFHWBROADCAST ioctl commands. * Implemented decoding of UBI_IOCRPEB and UBI_IOCSPEB ioctl commands. * Implemented decoding of V4L2_BUF_TYPE_META_CAPTURE, V4L2_BUF_TYPE_META_OUTPUT, and VIDIOC_QUERY_EXT_CTRL ioctl commands. * Updated lists of BPF_*, BTRFS_*, CLOSE_RANGE_*, ETH_*, IORING_*, KVM_*, PR_*, PTRACE_*, RTA_*, RTAX_*, RTM_*, RTNH_*, SCTP_*, SO_*, SYS_*, UFFD_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.11. * Bug fixes * Fixed decoding of SIOCGIFINDEX, SIOCBRADDIF, and SIOCBRDELIF ioctl commands. - Add strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch in order to workaround gh#171 issue related to the latest binutils release (https://sourceware.org/bugzilla/show_bug.cgi?id=27309). - Update to strace 5.12 * Improvements * Implemented --secontext[=full] option to display SELinux contexts. * Implemented decoding of mount_setattr syscall introduced in Linux 5.12. * Updated decoding of IFLA_BRPORT_* netlink attributes to match Linux 5.12. * Updated lists of DEVCONF_*, IORING_*, KVM_*, MPOL_*, MTD_*, NFT_MSG_*, RESOLVE_*, RTM_*, ST_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.12. - strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch: removed - Update to strace 5.13 * Improvements * Print netlink data in a more structured way. * Implemented decoding of NT_PRSTATUS and NT_FPREGSET regsets of PTRACE_GETREGSET and PTRACE_SETREGSET requests. * Implemented decoding of regs argument of PTRACE_GETREGS, PTRACE_GETREGS64, PTRACE_SETREGS, PTRACE_SETREGS64, PTRACE_GETFPREGS, and PTRACE_SETFPREGS requests. * Implemented powerpc System Call Vectored ABI support. * Implemented decoding of landlock_add_rule, landlock_create_ruleset, and landlock_restrict_self syscalls introduced in Linux 5.13. * Enhanced decoding of perf_event_open syscall. * Updated lists of BPF_*, IORING_*, KEXEC_*, KEY_*, KVM_*, NT_*, PR_*, PTRACE_*, RTM_*, RTPROT_*, TRAP_*, UFFD_*, UFFDIO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.13. - Update to strace 5.14 * Improvements * Implemented decoding of memfd_secret and quotactl_fd syscalls, introduced in Linux 5.14. * Enhanced prctl syscall decoding. * Enhanced decoding of IFLA_* netlink attributes. * Enhanced decoding of MDBA_ROUTER_PATTR_* mdb router port netlink attributes. * Updated lists of BPF_*, IORING_*, MADV_*, MOUNT_ATTR_*, SCTP_*, and UFFD_* constants. * Updated lists of ioctl commands from Linux 5.14. - Change the license to the correct LGPL-2.1-or-later (bsc#1228216). - disable test failing with kernel 5.0 - Update to strace 5.0 * Changes in behavior * -D option now implies -I4 * Diagnostic message is no longer printed if an attempt to restart a process has failed with ESRCH. * ASCII dump no longer tries to read the whole buffer at once. * Improvements * Changed the way tracees are handled: all pending tracees are now waited for before further processing, this improves fairness of tracee processing. * Enhanced xlat styles support configured by -X option. * Enhanced decoding of bpf syscall. * Enhanced pid formatting in strace-log-merge output. * Wired up kexec_file_load and rseq syscalls on aarch64, arc, metag, nios2, or1k, riscv, and tile architectures. * Updated lists of BPF_*, BTRFS_*, FAN_*, IFLA_*, KERN_*, KVM_CAP_*, NDA_*, NETNSA_*, NT_*, PR_*, REL_*, SECCOMP_*, SCTP_*, UDP_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.0. * Bug fixes * Fixed ordering of sockaddr_in6 fields. * Fixed strace-k test on alpha. * Fixed build on mips o32. * Fixed build on NOMMU architectures. * Fixed build in --with-libiberty=yes mode. * Fixed potential NULL dereference during printing of line continuation for syscalls that haven't been decoded. * Fixed strace-log-merge error diagnostics. - Ignore testsuite failures - Update to strace 5.1 * Bug fixes * Fixed decoding of last two arguments of clone syscall on riscv. * Improvements * Added C-SKY architecture support. * Implemented decoding of SO_TIMESTAMP*_NEW control messages. * Implemented decoding of clock_gettime64, clock_settime64, clock_adjtime64, clock_getres_time64, clock_nanosleep_time64, timer_gettime64, timer_settime64, timerfd_gettime64, timerfd_settime64, utimensat_time64, pselect6_time64, ppoll_time64, io_pgetevents_time64, recvmmsg_time64, mq_timedsend_time64, mq_timedreceive_time64, semtimedop_time64, rt_sigtimedwait_time64, futex_time64, sched_rr_get_interval_time64, pidfd_send_signal, io_uring_setup, io_uring_enter, and io_uring_register syscalls. * Enhanced decoding of bpf syscall. * Wired up getegid, geteuid, getppid, io_pgetevents, statfs64, and fstatfs64 syscalls on alpha. * Wired up kexec_file_load and migrate_pages syscalls on arm. * Wired up io_pgetevents, perf_event_open, seccomp, and statx syscalls on ia64. * Wired up seccomp syscall on m68k. * Wired up statx syscall on sh. * Wired up pkey_mprotect, pkey_alloc, and pkey_free syscalls on alpha, hppa, ia64, m68k, s390, s390x, sh, sparc, and sparc64. * Wired up rseq syscall on alpha, hppa, ia64, m68k, sh, sparc, sparc64, and xtensa. * Wired up direct ipc syscalls on m68k, mips o32, powerpc, powerpc64, s390, s390x, sh, sparc, sparc64, and x86. * Updated lists of BPF_*, FAN_*, F_SEAL_*, IPV6_*, NT_*, PR_SPEC_*, SO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.1. - Update to strace 5.2 (boo#1149727) * Improvements * Implemented syscall return status filtering with -e status=set option and its aliases: -z (limit syscall printing to successful syscalls only) and -Z (limit syscall printing to failed syscalls only). * Implemented decoding of open_tree, move_mount, fsopen, fsconfig, fsmount, and fspick syscalls. * Enhanced decoding of bpf, clone, inotify_init, mbind, and set_mempolicy syscalls. * Updated lists of AT_*, AUDIT_*, BPF_*, CLONE_*, ETH_*, KEY_*, KVM_*, MPOL_*, TIPC_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.2. * Bug fixes * Fixed syscall tampering on powerpc, powerpc64, sparc, and sparc64 when PTRACE_GET_SYSCALL_INFO is in use. * Fixed build with cutting-edge toolchain. - Update to strace 5.3 * Improvements * Implemented usage of seccomp-bpf for stopping tracees only for filtered syscalls. Use --seccomp-bpf option to enable. * Implemented decoding of pidfd_open and clone3 syscalls. * Enhanced decoding of io_cancel, io_submit, s390_sthyi, and syslog syscalls. * Enhanced decoding of NETLINK_ROUTE protocol. * Implemented decoding of UNIX_DIAG_UID netlink attribute. * Implemented decoding of WDIOC_* ioctl commands. * Enchanced syscall count statistics: overhead is now applied per-call, added ability for sorting on errors field. * Syscall delay injection and overhead values can now be supplied with time measure unit suffix and provided in IEEE 754 floating point format. * Updated lists of AUDIT_*, BPF_*, ETH_*, KEYCTL_*, KVM_*, MAP_*, SO_*, TCP_*, V4L2_*, XDP_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.3. * Enhanced manual page. * Bug fixes * Fixed syscall tampering on arc, avr32, csky, ia64, m68k, metag, mips, nios2, or1k, riscv, s390, s390x, sparc, sparc64, and tile architectures when PTRACE_GET_SYSCALL_INFO is in use. * Fixed decoding of sockaddr_hci (AF_BLUETOOTH) addresses that lack hci_channel field. * Fixed evdev ioctl bitset decoding. * Fixed tests on alpha with Linux kernel headers 5.1+. * Portability * Removed support for decoding syscalls in range [1024...1079] on AArch64 architecture as this range has never been implemented in mainline kernel releases. - Update to strace 5.4 * Improvements * Implemented -DD and -DDD options that move strace into a separate process group and session, respectively. * Enhanced seccomp-bpf tracee syscall filtering support by implementing new "binary match" BPF program generation strategy and automatically choosing the strategy that generates the shortest BPF program. * Implemented decoding of BPF_BTF_GET_NEXT_ID bpf syscall command. * Enhanced decoding of BPF_MAP_LOOKUP_ELEM bpf syscall command. * Implemented PTP_CLOCK_GETCAPS2, PTP_EXTTS_REQUEST2, PTP_PEROUT_REQUEST2, PTP_ENABLE_PPS2, and PTP_SYS_OFFSET2 ioctl decoding. * Updated lists of BPF_*, CAN_*, KEXEC_*, KVM_*, MADV_*, MSG_*, P_*, PR_*, PTP_*, SCTP_*, and V4L2_* constants. * Implemented ability to build ARM EABI mpers support using a separate compiler on aarch64. * Updated lists of ioctl commands from Linux 5.4. * Enhanced manual page. * Bug fixes * Fixed -b execve when --seccomp-bpf option is specified. * Fixed decoding of BPF_PROG_LOAD bpf syscall command. * Fixed build on no-MMU architectures. * Fixed build on antique systems that do not provide necessary definitions of AUDIT_ARCH_* constants. - Use -ffat-lto-objects to work around mpers.sh failure - Update to strace 5.5 * Improvements * Added -e trace=%creds option for tracing syscalls related to process credentials. * Enhanced decoding of arch_prctl, keyctl, io_uring_register, io_uring_setup, and perf_event_open syscalls. * Enhanced decoding of BPF_PROG_LOAD bpf syscall command. * Updated decoding of clone3 syscall to match Linux 5.5. * Implemented decoding of TCA_ACT_FLAGS and TCA_STATS_PKT64 netlink attributes. * Updated lists of AUDIT_*, BPF_*, CLONE_*, KEY_*, KVM_*, PPC_PTRACE_*, SCTP_*, STATX_*, TIPC_*, V4L2_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.5. * Enhanced manual page and "strace --help" output. * Bug fixes * Fixed stack trace printing for early syscalls when strace is configured to use libdw backend for stack tracing (addresses Fedora bug #1788636). * Fixed stack trace caching when --seccomp-bpf option is specified. * Fixed potentially unaligned access in decoder of SO_TIMESTAMP*_NEW control messages. * Fixed decoding of NDA_LLADDR netlink neighbor table attribute. * Fixed build of mpers support when CFLAGS contains -flto. * Fixed build on no-MMU architectures. * Fixed build with glibc-2.31 and Linux kernel headers < 5.3. * Fixed tests for glibc-2.31. - Update to strace 5.6 * Changes in behaviour * Messages about unknown tracees are now subject to the strace's quietness setting (-q/--quiet). * If -A option is provided without -o, or -S option without -c/-C, a warning about its uselessness is printed now. * The usage of --seccomp-bpf without -f has no effect now. * Improvements * Every short option now has a long option alias, which also has enabled the following improvements: * Ability to use human-readable settings for -I/--interruptible, - D/--daemonize options. * Ability to silence specific messages using -e quiet/--quiet qualifier (an alias for the -q option), including those that couldn't be silenced previously (path resolution messages and "superseded by execve"). * Ability to specify selected fd decoding features using - e decode-fds/--decode-fds qualifier (an alias for the -y option). * Ability to set precision for the absolute timestamp, relative timestamp, and syscall time output (using --absolute-timestamps, - -relative-timestamps, and --syscall-times options, respectively). * Implemented ability to select the set of displayed columns in the call summary output (-U/--summary-columns option). * Implemented ability to sort on any summary column. * Implemented ability to show information about minimum and maximum call duration in the call summary output (addresses Debian bug #240945). * Implemented printing of PIDs associated with pidfds in -yy mode. * Implemented PTRACE_GETREGS API support on hppa, sh, sh64, and xtensa. * Improved performance of libdw-based stack traces printing by implementing a symbol-to-address cache. * Implemented decoding of openat2 and pidfd_getfd syscalls. * Enhanced io_uring_register, prctl, sched_getattr, and sched_setattr syscall decoding. * Implemented decoding of BPF_MAP_LOOKUP_BATCH, BPF_MAP_LOOKUP_AND_DELETE_BATCH, BPF_MAP_UPDATE_BATCH, and BPF_MAP_DELETE_BATCH bpf syscall commands. * Enhanced decoding of BPF_MAP_CREATE and BPF_PROG_ATTACH bpf syscall commands. * Enhanced decoding of RTC_VL_READ ioctl command. * Enhanced decoding of IFLA_* netlink attributes. * Implemented HIDIOCGRAWUNIQ() ioctl command number printing. * Wired up kexec_file_load syscall on hppa. * Updated lists of AUDIT_*, BPF_*, CLONE_*, GRND_*, IFLA_*, IORING_*, IPPROTO_*, KEY_*, KVM_*, RTM_F_*, SCHED_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.6. * Bug fixes * Fixed build on csky abiv1 architecture. * Various minor fixes in VIDIOC_* ioctl output formatting. * Fix printing of the size field for _IOC_NONE ioctl command numbers on sparc. - Update to strace 5.7 * Improvements * Implemented interval specification in "when=" subexpression of syscall tampering expressions. * Added -e trace=%clock option for tracing syscalls reading of modifying system clocks. * Implemented decoding of BPF_LINK_CREATE and BPF_LINK_UPDATE bpf syscall commands. * Updated decoding of clone3 syscall to match Linux 5.7. * Updated lists of BPF_*, BTRFS_*, CLONE_*, FAN_*, IORING_*, KVM_*, LWTUNNEL_*, MREMAP_*, PERF_*, SECCOMP_*, UFFDIO_*, V4L2_*, and XDP_* constants. * Updated lists of ioctl commands from Linux 5.7. * Bug fixes * Fixed decoding of getdents and getdents64 syscalls when they return a lot of directory entries. * Fixed pathtrace matching of openat2 syscall. - Update to strace 5.8 * Changes in behaviour * Modified %process class to contain system calls associated with process lifecycle (creation, exec, termination): kill, tkill, tgkill, pidfd_send_signal and rt_sigqueueinfo are added, arch_prctl and unshare are removed. * Improvements * Implemented decoding of faccessat2 syscall. * Implemented decoding of LOOP_CONFIGURE ioctl command. * Updated decoding of io_uring_setup syscall to match Linux 5.8. * Updated lists of AUDIT_*, BPF_*, CAP_*, ETH_*, INET_DIAG_*, IORING_*, KEYCTL_*, KVM_*, LOOP_*, NDA_*, RTC_*, TCA_*, STATX_*, and *_MAGIC constants. * Updated lists of ioctl commands from Linux 5.8. * Bug fixes * Added statx syscall to %fstat trace class. - Update to strace 5.9 * Improvements * Added -n/--syscall-number option for printing syscall numbers. * Added --pidns-translation option for PID namespace translation (addresses Fedora bug #1035433). * Implemented decoding of close_range syscall. * Implemented decoding of TEE_* ioctl commands. * Implemented decoding of struct msginfo argument of IPC_INFO and MSG_INFO msgctl syscall commands. * Implemented decoding of struct msqid_ds argument of MSG_STAT and MSG_STAT_ANY msgctl syscall commands. * Implemented decoding of struct seminfo argument of IPC_INFO and SEM_INFO semctl syscall commands. * Implemented decoding of struct semid_ds argument of IPC_SET, IPC_STAT, SEM_STAT, and SEM_STAT_ANY semctl syscall commands. * Implemented decoding of struct shminfo argument of IPC_INFO shmctl syscall command. * Implemented decoding of struct shm_info argument of SHM_INFO shmctl syscall command. * Implemented decoding of struct shmid_ds argument of SHM_STAT and SHM_STAT_ANY shmctl syscall commands. * Updated lists of BPF_*, CAP_*, FAN_*, IFLA_*, INET_DIAG_REQ_*, IORING_FEAT_*, IP_*, IPV6_*, KVM_*, NDA_*, PTP_PEROUT_*, RTPROT_*, and V4L2_FMT_FLAG_* constants. * Updated lists of ioctl commands from Linux 5.9. - Update to strace 5.10 * Improvements * libdw-based stack tracing is now enabled for non-native personalities. * Implemented decoding of process_madvise syscall introduced in Linux 5.10. * Updated decoding of pidfd_open syscall to match Linux 5.10. * Updated decoding of membarrier syscall to match Linux 5.10. * Updated lists of ALG_*, BPF_*, INET_DIAG_*, IORING_*, KEY_*, KVM_*, MDBA_*, MEMBARRIER_CMD_*, MS_*, NLMSGERR_*, NT_*, STATX_*, SEGV_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.10. * Bug fixes * Added clock_gettime64, clock_settime64, clock_adjtime64, and lock_getres_time64 syscalls to %clock trace class. - Update to strace 5.11 * Improvements * Implemented poke injection (--inject=SET:poke_enter= and - -inject=SET:poke_exit= options). * Implemented decoding of epoll_pwait2 syscall introduced in Linux 5.11. * Implemented decoding of GPIO_* ioctl commands. * Implemented decoding of FS_IOC_FS[GS]ETXATTR, FS_IOC_[GS]ETFLAGS, and FS_IOC32_[GS]ETFLAGS ioctl commands. * Implemented decoding of SIOCADDMULTI, SIOCDELMULTI, SIOCGIFENCAP, SIOCOUTQNSD, SIOCSIFENCAP, and SIOCSIFHWBROADCAST ioctl commands. * Implemented decoding of UBI_IOCRPEB and UBI_IOCSPEB ioctl commands. * Implemented decoding of V4L2_BUF_TYPE_META_CAPTURE, V4L2_BUF_TYPE_META_OUTPUT, and VIDIOC_QUERY_EXT_CTRL ioctl commands. * Updated lists of BPF_*, BTRFS_*, CLOSE_RANGE_*, ETH_*, IORING_*, KVM_*, PR_*, PTRACE_*, RTA_*, RTAX_*, RTM_*, RTNH_*, SCTP_*, SO_*, SYS_*, UFFD_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.11. * Bug fixes * Fixed decoding of SIOCGIFINDEX, SIOCBRADDIF, and SIOCBRDELIF ioctl commands. - Add strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch in order to workaround gh#171 issue related to the latest binutils release (https://sourceware.org/bugzilla/show_bug.cgi?id=27309). - Update to strace 5.12 * Improvements * Implemented --secontext[=full] option to display SELinux contexts. * Implemented decoding of mount_setattr syscall introduced in Linux 5.12. * Updated decoding of IFLA_BRPORT_* netlink attributes to match Linux 5.12. * Updated lists of DEVCONF_*, IORING_*, KVM_*, MPOL_*, MTD_*, NFT_MSG_*, RESOLVE_*, RTM_*, ST_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.12. - strace-readelf-debug-dump-info-wide-output-changes-in-2.36.patch: removed - Update to strace 5.13 * Improvements * Print netlink data in a more structured way. * Implemented decoding of NT_PRSTATUS and NT_FPREGSET regsets of PTRACE_GETREGSET and PTRACE_SETREGSET requests. * Implemented decoding of regs argument of PTRACE_GETREGS, PTRACE_GETREGS64, PTRACE_SETREGS, PTRACE_SETREGS64, PTRACE_GETFPREGS, and PTRACE_SETFPREGS requests. * Implemented powerpc System Call Vectored ABI support. * Implemented decoding of landlock_add_rule, landlock_create_ruleset, and landlock_restrict_self syscalls introduced in Linux 5.13. * Enhanced decoding of perf_event_open syscall. * Updated lists of BPF_*, IORING_*, KEXEC_*, KEY_*, KVM_*, NT_*, PR_*, PTRACE_*, RTM_*, RTPROT_*, TRAP_*, UFFD_*, UFFDIO_*, and V4L2_* constants. * Updated lists of ioctl commands from Linux 5.13. - Update to strace 5.14 * Improvements * Implemented decoding of memfd_secret and quotactl_fd syscalls, introduced in Linux 5.14. * Enhanced prctl syscall decoding. * Enhanced decoding of IFLA_* netlink attributes. * Enhanced decoding of MDBA_ROUTER_PATTR_* mdb router port netlink attributes. * Updated lists of BPF_*, IORING_*, MADV_*, MOUNT_ATTR_*, SCTP_*, and UFFD_* constants. * Updated lists of ioctl commands from Linux 5.14. - Change the license to the correct LGPL-2.1-or-later (bsc#1228216). - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix NOPASSWD issue introduced by patches for CVE-2023-42465 [bsc#1221151, bsc#1221134] * Update sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch * Enable running regression selftests during build time. - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix NOPASSWD issue introduced by patches for CVE-2023-42465 [bsc#1221151, bsc#1221134] * Update sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch * Enable running regression selftests during build time. - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix NOPASSWD issue introduced by patches for CVE-2023-42465 [bsc#1221151, bsc#1221134] * Update sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch * Enable running regression selftests during build time. - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix NOPASSWD issue introduced by patches for CVE-2023-42465 [bsc#1221151, bsc#1221134] * Update sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch * Enable running regression selftests during build time. - Fix commented out "Defaults env_keep" in sudo-sudoers.patch - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix commented out "Defaults env_keep" in sudo-sudoers.patch - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix commented out "Defaults env_keep" in sudo-sudoers.patch - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Fix commented out "Defaults env_keep" in sudo-sudoers.patch - update to 1.9.7p2 - enabled openssl support for secure central session recording collection (without it's clear text) - fixed SLES12 build * When formatting JSON output, octal numbers are now stored as strings, not numbers. The JSON spec does not actually support octal numbers with a '0' prefix. * Fixed a compilation issue on Solaris 9. * Sudo now can handle the getgroups() function returning a different number of groups for subsequent invocations. GitHub PR #106. * When loading a Python plugin, python_plugin.so now verifies that the module loaded matches the one we tried to load. This allows sudo to display a more useful error message when trying to load a plugin with a name that conflicts with a Python module installed in the system location. * Sudo no longer sets the the open files resource limit to "unlimited" while it runs. This avoids a problem where sudo's closefrom() emulation would need to close a very large number of descriptors on systems without a way to determine which ones are actually open. * Sudo now includes a configure check for va_copy or __va_copy and only defines its own version if the configure test fails. * Fixed a bug in sudo's utmp file handling which prevented old entries from being reused. As a result, the utmp (or utmpx) file was appended to unnecessarily. GitHub PR #108. * Fixed a bug introduced in sudo 1.9.7 that prevented sudo_logsrvd from accepting TLS connections when OpenSSL is used. Bug #988. * Fixed an SELinux sudoedit bug when the edited temporary file could not be opened. The sesh helper would still be run even when there are no temporary files available to install. * Fixed a compilation problem on FreeBSD. * The sudo_noexec.so file is now built as a module on all systems other than macOS. This makes it possible to use other libtool implementations such as slibtool. On macOS shared libraries and modules are not interchangeable and the version of libtool shipped with sudo must be used. * Fixed a few bugs in the getgrouplist() emulation on Solaris when reading from the local group file. * Fixed a bug in sudo_logsrvd that prevented periodic relay server connection retries from occurring in "store_first" mode. * Disabled the nss_search()-based getgrouplist() emulation on HP-UX due to a crash when the group source is set to "compat" in /etc/nsswitch.conf. This is probably due to a mismatch between include/compat/nss_dbdefs.h and what HP-UX uses internally. On HP-UX we now just cycle through groups the slow way using getgrent(). Bug #978. - update to 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. - update to 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. - pack /usr/libexec/sudo/sudo/sudo_intercept.so - Add support in the LDAP filter for negated users, patch taken from upstream (jsc#20068) * Adds sudo-feature-negated-LDAP-users.patch - Update to 1.9.9 * Sudo can now be built with OpenSSL 3.0 without generating warnings about deprecated OpenSSL APIs. * A digest can now be specified along with the ALL command in the LDAP and SSSD back-ends. Sudo 1.9.0 introduced support for this in the sudoers file but did not include corresponding changes for the other back-ends. * visudo now only warns about an undefined alias or a cycle in an alias once for each alias. * The sudoRole cn was truncated by a single character in warning messages. GitHub issue #115. * The cvtsudoers utility has new --group-file and --passwd-file options to use a custom passwd or group file when the - -match-local option is also used. * The cvtsudoers utility can now filter or match based on a command. * The cvtsudoers utility can now produce output in csv (comma-separated value) format. This can be used to help generate entitlement reports. * Fixed a bug in sudo_logsrvd that could result in the connection being dropped for very long command lines. * Fixed a bug where sudo_logsrvd would not accept a restore point of zero. * Fixed a bug in visudo where the value of the editor setting was not used if it did not match the user’s EDITOR environment variable. This was only a problem if the env_editor setting was not enabled. Bug #1000. * Sudo now builds with the -fcf-protection compiler option and the - z now linker option if supported. * The output of sudoreplay -l now more closely matches the traditional sudo log format. * The sudo_sendlog utility will now use the full contents of the log.json file, if present. This makes it possible to send sudo-format I/O logs that use the newer log.json format to sudo_logsrvd without losing any information. * Fixed compilation of the arc4random_buf() replacement on systems with arc4random() but no arc4random_buf(). Bug #1008. * Sudo now uses its own getentropy() by default on Linux. The GNU libc version of getentropy() will fail on older kernels that don’t support the getrandom() system call. * It is now possible to build sudo with WolfSSL’s OpenSSL compatibility layer by using the --enable-wolfssl configure option. * Fixed a bug related to Daylight Saving Time when parsing timestamps in Generalized Time format. This affected the NOTBEFORE and NOTAFTER options in sudoers. Bug #1006. * Added the -O and -P options to visudo, which can be used to check or set the owner and permissions. This can be used in conjunction with the -c option to check that the sudoers file ownership and permissions are correct. Bug #1007. * It is now possible to set resource limits in the sudoers file itself. The special values default and “user” refer to the default system limit and invoking user limit respectively. The core dump size limit is now set to 0 by default unless overridden by the sudoers file. * The cvtsudoers utility can now merge multiple sudoers sources into a single, combined sudoers file. If there are conflicting entries, cvtsudoers will attempt to resolve them but manual intervention may be required. The merging of sudoers rules is currently fairly simplistic but will be improved in a future release. * Sudo was parsing but not applying the “deref” and “tls_reqcert” ldap.conf settings. This meant the options were effectively ignored which broke dereferencing of aliases in LDAP. Bug #1013. * Clarified in the sudo man page that the security policy may override the user’s PATH environment variable. Bug #1014. * When sudo is run in non-interactive mode (with the -n option), it will now attempt PAM authentication and only exit with an error if user interaction is required. This allows PAM modules that don’t interact with the user to succeed. Previously, sudo would not attempt authentication if the -n option was specified. Bug #956 and GitHub issue #83. * Fixed a regression introduced in version 1.9.1 when sudo is built with the --with-fqdn configure option. The local host name was being resolved before the sudoers file was processed, making it impossible to disable DNS lookups by negating the fqdn sudoers option. Bug #1016. * Added support for negated sudoUser attributes in the LDAP and SSSD sudoers back ends. A matching sudoUser that is negated will cause the sudoRole containing it to be ignored. * Fixed a bug where the stack resource limit could be set to a value smaller than that of the invoking user and not be reset before the command was run. Bug #1016. - sudo no longer ships schema for LDAP. - sudo-feature-negated-LDAP-users.patch dropped, included upstream - refreshed sudo-sudoers.patch - Restrict use of sudo -U other -l to people who have permission to run commands as that user (bsc#1181703, jsc#SLE-22569) * feature-upstream-restrict-sudo-U-other-l.patch - Add sudo-1.9.9-honor-T_opt.patch * the -T option of sudo does nothing even when 'Defaults user_command_timeouts' is present in the configuration. * [bsc#1193446] * Credit to Jaroslav Jindrak <dzejrou@gmail.com> - update to 1.9.10: * Added new log_passwords and passprompt_regex sudoers options. If log_passwords is disabled, sudo will attempt to prevent passwords from being logged. If sudo detects any of the regular expressions in the passprompt_regex list in the terminal output, sudo will log ‘*’ characters instead of the terminal input until a newline or carriage return is found in the input or an output character is received. * Added new log_passwords and passprompt_regex settings to sudo_logsrvd that operate like the sudoers options when logging terminal input. * Fixed several few bugs in the cvtsudoers utility when merging multiple sudoers sources. * Fixed a bug in sudo_logsrvd parsing the sudo_logsrvd.conf file, where the retry_interval in the [relay] section was not being recognized. * Restored the pre-1.9.9 behavior of not performing authentication when sudo’s -n option is specified. A new noninteractive_auth sudoers option has been added to enable PAM authentication in non-interactive mode. GitHub issue #131. * On systems with /proc, if the /proc/self/stat (Linux) or /proc/pid/psinfo (other systems) file is missing or invalid, sudo will now check file descriptors 0-2 to determine the user’s terminal. Bug #1020. * Fixed a compilation problem on Debian kFreeBSD. Bug #1021. * Fixed a crash in sudo_logsrvd when running in relay mode if an alert message is received. * Fixed an issue that resulting in “problem with defaults entries” email to be sent if a user ran sudo when the sudoers entry in the nsswitch.conf file includes “sss” but no sudo provider is configured in /etc/sssd/sssd.conf. * Updated the warning displayed when the invoking user is not allowed to run sudo. If sudo has been configured to send mail on failed attempts (see the mail_* flags in sudoers), it will now print “This incident has been reported to the administrator.” If the mailto or mailerpath sudoers settings are disabled, the message will not be printed and no mail will be sent. * Fixed a bug where the user-specified command timeout was not being honored if the sudoers rule did not also specify a timeout. * Added support for using POSIX extended regular expressions in sudoers rules. A command and/or arguments in sudoers are treated as a regular expression if they start with a ‘^’ character and end with a ‘$’. The command and arguments are matched separately, either one (or both) may be a regular expression. * A user may now only run sudo -U otheruser -l if they have a “sudo ALL” privilege where the RunAs user contains either root or otheruser. Previously, having “sudo ALL” was sufficient, regardless of the RunAs user. GitHub issue [#134]. * The sudo lecture is now displayed immediately before the password prompt. As a result, sudo will no longer display the lecture unless the user needs to enter a password. Authentication methods that don’t interact with the user via a terminal do not trigger the lecture. * Sudo now uses its own closefrom() emulation on Linux systems. The glibc version may not work in a chroot jail where /proc is not available. If close_range(2) is present, it will be used in preference to /proc/self/fd. - drop sudo-1.9.9-honor-T_opt.patch , feature-upstream-restrict-sudo-U-other-l.patch (upstream) - Use %_pam_vendordir macro - Fix errors around LICENSE.md (fixes building on SLE12 SP5 again) - Update to 1.9.11p3: * Changes in Sudo 1.9.11 * Fixed a crash in the Python module with Python 3.9.10 on some systems. Additionally, make check now passes for Python 3.9.10. * Error messages sent via email now include more details, including the file name and the line number and column of the error. Multiple errors are sent in a single message. Previously, only the first error was included. * Fixed logging of parse errors in JSON format. Previously, the JSON logger would not write entries unless the command and runuser were set. These may not be known at the time a parse error is encountered. * Fixed a potential crash parsing sudoers lines larger than twice the value of LINE_MAX on systems that lack the getdelim() function. * The tests run by make check now unset the LANGUAGE environment variable. Otherwise, localization strings will not match if LANGUAGE is set to a non-English locale. Bug #1025. * The “starttime” test now passed when run under Debian faketime. Bug #1026. * The Kerberos authentication module now honors the custom password prompt if one has been specified. * The embedded copy of zlib has been updated to version 1.2.12. * Updated the version of libtool used by sudo to version 2.4.7. * Sudo now defines _TIME_BITS to 64 on systems that define __TIMESIZE in the header files (currently only GNU libc). This is required to allow the use of 64-bit time values on some 32-bit systems. * Sudo’s intercept and log_subcmds options no longer force the command to run in its own pseudo-terminal. It is now also possible to intercept the system(3) function. * Fixed a bug in sudo_logsrvd when run in store-first relay mode where the commit point messages sent by the server were incorrect if the command was suspended or received a window size change event. * Fixed a potential crash in sudo_logsrvd when the tls_dhparams configuration setting was used. * The intercept and log_subcmds functionality can now use ptrace(2) on Linux systems that support seccomp(2) filtering. This has the advantage of working for both static and dynamic binaries and can work with sudo’s SELinux RBAC mode. The following architectures are currently supported: i386, x86_64, aarch64, arm, mips (log_subcmds only), powerpc, riscv, and s390x. The default is to use ptrace(2) where possible; the new intercept_type sudoers setting can be used to explicitly set the type. * New Georgian translation from translationproject.org. * Fixed creating packages on CentOS Stream. * Fixed a bug in the intercept and log_subcmds support where the execve(2) wrapper was using the current environment instead of the passed environment pointer. Bug #1030. * Added AppArmor integration for Linux. A sudoers rule can now specify an APPARMOR_PROFILE option to run a command confined by the named AppArmor profile. * Fixed parsing of the server_log setting in sudo_logsrvd.conf. Non-paths were being treated as paths and an actual path was treated as an error. * Changes in Sudo 1.9.11p1: * Correctly handle EAGAIN in the I/O read/right events. This fixes a hang seen on some systems when piping a large amount of data through sudo, such as via rsync. Bug #963. * Changes to avoid implementation or unspecified behavior when bit shifting signed values in the protobuf library. * Fixed a compilation error on Linux/aarch64. * Fixed the configure check for seccomp(2) support on Linux. * Corrected the EBNF specification for tags in the sudoers manual page. GitHub issue #153. * Changes in Sudo 1.9.11p2: * Fixed a compilation error on Linux/x86_64 with the x32 ABI. * Fixed a regression introduced in 1.9.11p1 that caused a warning when logging to sudo_logsrvd if the command returned no output. * Changes in Sudo 1.9.11p3: * Fixed “connection reset” errors on AIX when running shell scripts with the intercept or log_subcmds sudoers options enabled. Bug #1034. * Fixed very slow execution of shell scripts when the intercept or log_subcmds sudoers options are set on systems that enable Nagle’s algorithm on the loopback device, such as AIX. Bug #1034. * Modified sudo-sudoers.patch - Added sudo-1.9.10-update_sudouser_to_utf8.patch * [bsc#1197998] * Enable sudouser LDAP schema to use UTF-8 encodings. * Sourced from https://github.com/sudo-project/sudo/pull/163 * Credit to William Brown, william.brown@suse.com - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. - Update to 1.9.12: * Dropped sudo-1.9.10-update_sudouser_to_utf8.patch * Changes in Sudo 1.9.12: * Fixed a bug when logging the command’s exit status in intercept mode. The wrong command could be logged with the exit status. * For ptrace-based intercept mode, sudo will now attempt to verify that the command path name, arguments and environment have not changed from the time when they were authorized by the security policy. The new intercept_verify sudoers setting can be used to control this behavior. * Fixed running commands with a relative path (e.g. ./foo) in intercept mode. Previously, this would fail if sudo’s current working directory was different from that of the command. * Sudo now supports passing the execve(2) system call the NULL pointer for the argv and/or envp arguments when in intercept mode. Linux treats a NULL pointer like an empty array. * The sudoers LDAP schema now allows sudoUser, sudoRunasUser and sudoRunasGroup to include UTF-8 characters, not just 7-bit ASCII. * Fixed a problem with sudo -i on SELinux when the target user’s home directory is not searchable by sudo. GitHub issue #160. * Neovim has been added to the list of visudo editors that support passing the line number on the command line. * Fixed a bug in sudo’s SHA384 and SHA512 message digest padding. * Added a new -N (no-update) command line option to sudo which can be used to prevent sudo from updating the user’s cached credentials. It is now possible to determine whether or not a user’s cached credentials are currently valid by running: $ sudo -Nnv and checking the exit value. One use case for this is to indicate in a shell prompt that sudo is “active” for the user. * PAM approval modules are no longer invoked when running sub-commands in intercept mode unless the intercept_authenticate option is set. There is a substantial performance penalty for calling into PAM for each command run. PAM approval modules are still called for the initial command. * Intercept mode on Linux now uses process_vm_readv(2) and process_vm_writev(2) if available. * The XDG_CURRENT_DESKTOP environment variable is now preserved by default. This makes it possible for graphical applications to choose the correct theme when run via sudo. * On 64-bit systems, if sudo fails to load a sudoers group plugin, it will use system-specific heuristics to try to locate a 64-bit version of the plugin. * The cvtsudoers manual now documents the JSON and CSV output formats. GitHub issue #172. * Fixed a bug where sub-commands were not being logged to a remote log server when log_subcmds was enabled. GitHub issue #174. * The new log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings can be used to support more fine-grained I/O logging. The sudo front-end no longer allocates a pseudo-terminal when running a command if the I/O logging plugin requests logging of stdin, stdout, or stderr but not terminal input/output. * Quieted a libgcrypt run-time initialization warning. This fixes Debian bug #1019428 and Ubuntu bug #1397663. * Fixed a bug in visudo that caused literal backslashes to be removed from the EDITOR environment variable. GitHub issue #179. * The sudo Python plugin now implements the find_spec method instead of the the deprecated find_module. This fixes a test failure when a newer version of setuptools that doesn’t include find_module is found on the system. * Fixed a bug introduced in sudo 1.9.9 where sudo_logsrvd created the process ID file, usually /var/run/sudo/sudo_logsrvd.pid, as a directory instead of a plain file. The same bug could result in I/O log directories that end in six or more X’s being created literally in addition to the name being used as a template for the mkdtemp(3) function. * Fixed a long-standing bug where a sudoers rule with a command line argument of “”, which indicates the command may be run with no arguments, would also match a literal "" on the command line. GitHub issue #182. * Added the -I option to visudo which only edits the main sudoers file. Include files are not edited unless a syntax error is found. * Fixed sudo -l -U otheruser output when the runas list is empty. Previously, sudo would list the invoking user instead of the list user. GitHub issue #183. * Fixed the display of command tags and options in sudo -l output when the RunAs user or group changes. A new line is started for RunAs changes which means we need to display the command tags and options again. GitHub issue #184. * The sesh helper program now uses getopt_long(3) to parse the command line options. * The embedded copy of zlib has been updated to version 1.2.13. * Fixed a bug that prevented event log data from being sent to the log server when I/O logging was not enabled. This only affected systems without PAM or configurations where the pam_session and pam_setcred options were disabled in the sudoers file. * Fixed a bug where sudo -l output included a carriage return after the newline. This is only needed when displaying to a terminal in raw mode. Bug #1042. - Added sudo-CVE-2022-43995.patch * CVE-2022-43995 * bsc#1204986 * Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt() password backend. - Update to 1.9.12p1: * Changes in 1.9.12p1: - Sudo’s configure script now does a better job of detecting when the -fstack-clash-protection compiler option does not work. GitHub issue #191. - Fixed CVE-2022-43995, a potential out-of-bounds write for passwords smaller than 8 characters when passwd authentication is enabled. This does not affect configurations that use other authentication methods such as PAM, AIX authentication or BSD authentication. - Fixed a build error with some configurations compiling host_port.c. * Dropped sudo-CVE-2022-43995.patch - Added sudo-CVE-2023-22809.patch * CVE-2023-22809 * bsc#1207082 * Prevent '--' in the EDITOR environment variable which can allow users to edit sensitive files as root. - Added sudo-fix_NULL_deref_RunAs.patch * bsc#1206483 * Fix a situation where "sudo -U otheruser -l" would dereference a NULL pointer. - Added sudo-no-double-free.patch * bsc#1208595 CVE-2023-27320 * Fix a situation where per-command chroot sudoers rules can cause a double-free. - sudo-dont-enable-read-after-pty_finish.patch * bsc#1203201 * Do not re-enable the reader when flushing the buffers as part of pty_finish(). * While sudo-observe-SIGCHLD patch applied earlier prevents a race condition from happening, this fixes a related buffer hang. - Fix CVE-2023-28486, sudo does not escape control characters in log messages, (CVE-2023-28486, bsc#1209362) * Add sudo-CVE-2023-28486.patch - Fix CVE-2023-28487, sudo does not escape control characters in sudoreplay output (CVE-2023-28487, bsc#1209361) - Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465] * Try to make sudo less vulnerable to ROWHAMMER attacks. * Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch - Installing to /usr/sbin instead of /sbin (bsc#1191096) - Added shared memory as a log directory for emergency use (bsc#1190943) - getappcore identifies compressed core files (bsc#1191794) - Merged Include udev rules in /lib/udev/rules.d/ #113 - Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87 - Changes to version 3.1.19 + Removed chronyc DNS lookups with -n switch (bsc#1193732) - Changes to version 3.1.19 + Made /proc directory and network names spaces configurable (bsc#1193868) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Installing to /usr/sbin instead of /sbin (bsc#1191096) - Added shared memory as a log directory for emergency use (bsc#1190943) - getappcore identifies compressed core files (bsc#1191794) - Merged Include udev rules in /lib/udev/rules.d/ #113 - Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87 - Changes to version 3.1.19 + Removed chronyc DNS lookups with -n switch (bsc#1193732) - Changes to version 3.1.19 + Made /proc directory and network names spaces configurable (bsc#1193868) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes to version 3.1.19 + Removed chronyc DNS lookups with -n switch (bsc#1193732) - Changes to version 3.1.19 + Made /proc directory and network names spaces configurable (bsc#1193868) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.19 + Removed chronyc DNS lookups with -n switch (bsc#1193732) - Changes to version 3.1.19 + Made /proc directory and network names spaces configurable (bsc#1193868) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.19 + Made /proc directory and network names spaces configurable (bsc#1193868) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.29 + Extended scaling for performance (bsc#1214713) + Fixed kdumptool output error (bsc#1218632) + Corrected podman ID errors (bsc#1218812) + Duplicate non root podman entries removed (bsc#1218814) + Corrected get_sles_ver for SLE Micro (bsc#1219241) + Check nvidida-persistenced state (bsc#1219639) - Changes to version 3.1.19 + Made /proc directory and network names spaces configurable (bsc#1193868) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.29 + Extended scaling for performance (bsc#1214713) + Fixed kdumptool output error (bsc#1218632) + Corrected podman ID errors (bsc#1218812) + Duplicate non root podman entries removed (bsc#1218814) + Corrected get_sles_ver for SLE Micro (bsc#1219241) + Check nvidida-persistenced state (bsc#1219639) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.29 + Extended scaling for performance (bsc#1214713) + Fixed kdumptool output error (bsc#1218632) + Corrected podman ID errors (bsc#1218812) + Duplicate non root podman entries removed (bsc#1218814) + Corrected get_sles_ver for SLE Micro (bsc#1219241) + Check nvidida-persistenced state (bsc#1219639) - Changes in version 3.1.30 + Added -V key:value pair option (bsc#1222021, PED-8211) + Avoid getting duplicate kernel verifications in boot.text (pr#193) + Suppress file descriptor leak warnings from lvm commands (pr#192, bsc#1220082) + Includes container log timestamps (pr#197) - Changes to version 3.1.20 + Added command blkid #114 + Added s390x specific files and output #115 + Fix for invalid argument during updates (bsc#1193204) + Optimized conf_files, conf_files_text and log_cmd functions #118 + Fixed iscsi initiator name (bsc#1195797) + Added rpcinfo -p output #116 + Included /etc/sssd/conf.d configuration files #100 - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.29 + Extended scaling for performance (bsc#1214713) + Fixed kdumptool output error (bsc#1218632) + Corrected podman ID errors (bsc#1218812) + Duplicate non root podman entries removed (bsc#1218814) + Corrected get_sles_ver for SLE Micro (bsc#1219241) + Check nvidida-persistenced state (bsc#1219639) - Changes in version 3.1.30 + Added -V key:value pair option (bsc#1222021, PED-8211) + Avoid getting duplicate kernel verifications in boot.text (pr#193) + Suppress file descriptor leak warnings from lvm commands (pr#192, bsc#1220082) + Includes container log timestamps (pr#197) - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.29 + Extended scaling for performance (bsc#1214713) + Fixed kdumptool output error (bsc#1218632) + Corrected podman ID errors (bsc#1218812) + Duplicate non root podman entries removed (bsc#1218814) + Corrected get_sles_ver for SLE Micro (bsc#1219241) + Check nvidida-persistenced state (bsc#1219639) - Changes in version 3.1.30 + Added -V key:value pair option (bsc#1222021, PED-8211) + Avoid getting duplicate kernel verifications in boot.text (pr#193) + Suppress file descriptor leak warnings from lvm commands (pr#192, bsc#1220082) + Includes container log timestamps (pr#197) - Changes to version 3.2.8 + Avoid getting duplicate kernel verifications in boot.text (pr#190) + lvm: suppress file descriptor leak warnings from lvm commands (pr#191) + docker_info: Add timestamps to container logs (pr#196) + Key value pairs and container log timestamps (bsc#1222021 PED-8211, pr#198) + Update supportconfig get pam.d sorted (pr#199) + yast_files: Exclude .zcat (pr#201) + Sanitize grub bootloader (bsc#1227127, pr#203) + Sanitize regcodes (pr#204) + Improve product detection (pr#205) + Add read_values for s390x (bsc#1228265, pr#206) + hardware_info: Remove old alsa ver check (pr#209) + drbd_info: Fix incorrect escape of quotes (pr#210) - Spec file adjusted for usr-merge - Added a listing to /dev/mapper/. #129 - Changes to version 3.1.21 + Added type output with df command in fs-diskio.txt (issue#141) + Gather all files in /etc/security/limits.d/ (issue#142) + Fixed KVM virtualization detection on bare metal (bsc#1184689) + Added logging using journalctl (bsc#1200330) + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818) + Added system logging configuration and checking in messages_config.txt (issue#103) + If rsyslog not installed collect more from journalctl (issue#120) + Added systemd-status.txt for the status of all service units (issue#125) + autofs includes files in (+dir:<path>) (issue#111) + Get current sar data before collecting files (bsc#1192648) + Collects everything in /etc/multipath/ (bsc#1192252) + Collects power management information in hardware.txt (bsc#1197428) + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337) + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269) + Update to nvme_info and block_info #133 (bsc#1202417) + Added IO scheduler (issue#136) + Added includedir directories from /etc/sudoers (bsc#1188086) - Added lifecycle information (issue#140) - Changes to supportconfig version 3.1.11-46.3 + Added missed sanitation check on crash.txt (bsc#1203818) - Changes to supportconfig.rc version 3.1.11-30 + Added check to _sanitize_file + Using variable for replement text in _sanitize_file - Changes to getappcore version 1.53.02 + The location of chkbin was updated earlier. This documents that change (bsc#1205533, bsc#1204942) - Changes to supportconfig version 3.1.11-46.4 + Added plymouth_info - Changes to supportconfig.rc version 3.1.11-35 + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402) - Add dependency to `numactl` on ppc64le and `s390x`, this enforces that `numactl --hardware` data is provided in supportconfigs - Fixed missing status detail for apparmor (bsc#1196933) - Corrected invalid argument list in docker.txt (bsc#1206608) - Applies limit equally to sar data and text files (bsc#1207543) - Collects hwinfo hardware logs (bsc#1208928) - Collects lparnumascore logs (issue#148) - Changes for supportutils version 3.1.25 + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598) + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149) + powerpc: collect invscout logs (pr#150) + powerpc: collect RMC status logs (pr#151) + Added missing nvme nbft commands (bsc#1211599) + Fixed invalid nvme commands (bsc#1211598) + Added missing podman information (PED-1703, bsc#1181477) + Removed dependency on sysfstools + Check for systool use (bsc#1210015) + Added selinux checking (bsc#1209979) + Updated SLES_VER matrix - ha_info sle15 uses /var/log/pacemaker/ (pq#153) - Added run time detection (bsc#1213127) - Changes in version 3.1.26 + powerpc plugin to collect the slots and active memory (bsc#1210950) + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154 + supportconfig: collect BPF information (pr#154) + Added additional iscsi information (pr#155) - Changes in version 3.1.27 + Fixed podman display issue (bsc#1217287) + Added nvme-stas configuration to nvme.txt (bsc#1216049) + Added timed command to fs-files.txt (bsc#1216827) + Collects zypp history file issue#166 (bsc#1216522) + Changed -x OPTION to really be exclude only (issue#146) + Collect HA related rpm package versions in ha.txt (pr#169) - Changes in version 3.1.28 + Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250) + powerpc: collect rtas_errd.log and lp_diag.log files (pr#175) + Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2) + Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) + Added missing klp information to kernel-livepatch.txt (bsc#1216390) + Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) + Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) + Optimize lsof usage (bsc#1183663) + Added mokutil commands for secureboot (pr#179) + Collects chrony or ntp as needed (bsc#1196293) - Additional changes in version 3.1.28 + ipset - List entries for all sets + ipvsadm - Inspect the virtual server table (pr#185) + Correctly detects Xen Dom0 (bsc#1218201) + Fixed smart disk error (bsc#1218282) - Changes to version 3.1.29 + Extended scaling for performance (bsc#1214713) + Fixed kdumptool output error (bsc#1218632) + Corrected podman ID errors (bsc#1218812) + Duplicate non root podman entries removed (bsc#1218814) + Corrected get_sles_ver for SLE Micro (bsc#1219241) + Check nvidida-persistenced state (bsc#1219639) - Changes in version 3.1.30 + Added -V key:value pair option (bsc#1222021, PED-8211) + Avoid getting duplicate kernel verifications in boot.text (pr#193) + Suppress file descriptor leak warnings from lvm commands (pr#192, bsc#1220082) + Includes container log timestamps (pr#197) - Changes to version 3.2.8 + Avoid getting duplicate kernel verifications in boot.text (pr#190) + lvm: suppress file descriptor leak warnings from lvm commands (pr#191) + docker_info: Add timestamps to container logs (pr#196) + Key value pairs and container log timestamps (bsc#1222021 PED-8211, pr#198) + Update supportconfig get pam.d sorted (pr#199) + yast_files: Exclude .zcat (pr#201) + Sanitize grub bootloader (bsc#1227127, pr#203) + Sanitize regcodes (pr#204) + Improve product detection (pr#205) + Add read_values for s390x (bsc#1228265, pr#206) + hardware_info: Remove old alsa ver check (pr#209) + drbd_info: Fix incorrect escape of quotes (pr#210) - Initial build + Version 1.0.0 - Include in SLE 12 (FATE#320442, bsc#963690) - Include in SLE 11 (FATE#320441, bsc#963688) - Update to verion 1.0.1 (bsc#990887, bsc#990888) + Include information about instance initialization generated by the initialization code in the log - Update to version 1.0.2 (bsc#1053737, bsc#1053738) + Add additional package to the framework specific package queries - Update to version 1.0.3 (bsc#1174618, bsc#1170475, bsc#1170476) + Drop rc file name extension from rpm lists + Sanatize data + Use updated azuremetadata + Add /etc/os-release data + Check update infrastructure is reachable - Update to version 1.0.4 + Fix output redirection in registration info query - Update to version 1.0.5 (bsc#1175250, bsc#1175251) + Query for new GCE initialization code packages - Update to version 1.0.6 (bsc#1195095, bsc#1195096) + Include cloud-init logs whenever they are present + Update the packages we track in AWS, Azure, and Google + Include the ecs logs for AWS ECS instances - Update to version 1.0.7 (bsc#1209026) + Include information about the cached registration data + Collect the data that is sent to the update infrastructure during registration - Update to version 1.0.8 (bsc#1213951) + Capture CSP billing adapter config and log (issue#13) + Accept upper case Amazon string in DMI table (issue#12) - Update to version 1.0.9 (bsc#1218762, bsc#1218763) + Remove duplicate data collection for the plugin itself + Collect archive metering data when available + Query billing flavor status - Initial build + Version 1.0.0 - Include in SLE 12 (FATE#320442, bsc#963690) - Include in SLE 11 (FATE#320441, bsc#963688) - Update to verion 1.0.1 (bsc#990887, bsc#990888) + Include information about instance initialization generated by the initialization code in the log - Update to version 1.0.2 (bsc#1053737, bsc#1053738) + Add additional package to the framework specific package queries - Update to version 1.0.3 (bsc#1174618, bsc#1170475, bsc#1170476) + Drop rc file name extension from rpm lists + Sanatize data + Use updated azuremetadata + Add /etc/os-release data + Check update infrastructure is reachable - Update to version 1.0.4 + Fix output redirection in registration info query - Update to version 1.0.5 (bsc#1175250, bsc#1175251) + Query for new GCE initialization code packages - Update to version 1.0.6 (bsc#1195095, bsc#1195096) + Include cloud-init logs whenever they are present + Update the packages we track in AWS, Azure, and Google + Include the ecs logs for AWS ECS instances - Update to version 1.0.7 (bsc#1209026) + Include information about the cached registration data + Collect the data that is sent to the update infrastructure during registration - Update to version 1.0.8 (bsc#1213951) + Capture CSP billing adapter config and log (issue#13) + Accept upper case Amazon string in DMI table (issue#12) - Update to version 1.0.9 (bsc#1218762, bsc#1218763) + Remove duplicate data collection for the plugin itself + Collect archive metering data when available + Query billing flavor status - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - added future signing key for SLES (fate#314767) (bnc#801055) using 2048 bit rsa key - Merged over logic from openSUSE-build-key. - Got rid of default importing into roots keyring. - Removed some old keys. - Clarify that security@suse.de is a email only key - PTF key is supplied also as %doc, to not be default imported. - Keys currently inside: - pub 2048R/39DB7C82 SuSE Package Signing Key <build@suse.de> - pub 2048R/50A3DD1C SuSE Package Signing Key (reserve key) <build@suse.de> - pub 1024D/B37B98A9 SUSE PTF Signing Key <support@suse.com> - pub 2048R/3D25D3D9 SuSE Security Team <security@suse.de> - reverted to contain the fullkeyring build SLE12 Alpha. - also list the old sle11 build@suse.de key temporary - create suse-build-key.gpg during build. - Remove old keys from keyring. (fate#314767) Keys currently inside the RPM trusted keyring: - pub 2048R/39DB7C82 SuSE Package Signing Key <build@suse.de> - pub 2048R/50A3DD1C SuSE Package Signing Key (reserve key) <build@suse.de> - Various keys are moved to the documentation area (/usr/share/doc/packages/suse-build-key) - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key. if SUSE Linux Enterprise 11 packages need to be verified on a SUSE Linux Enterprise 12 system. - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs. - security_at_suse_de.asc: Use only for email encryption and verification purposes when contacting our security contact address security@suse.de - Went to new method again. - suse-build-key.gpg blob dropped - ship seperate files - renamed security_at_suse_de.asc to security_at_suse_de_old.asc - security_at_suse_de.asc: new 4096 bit RSA key. pub 4096R/317CD502 2014-10-02 SUSE Security Team <security@suse.de> bnc#899509 - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - Merged over logic from openSUSE-build-key. - Got rid of default importing into roots keyring. - Removed some old keys. - Clarify that security@suse.de is a email only key - PTF key is supplied also as %doc, to not be default imported. - Keys currently inside: - pub 2048R/39DB7C82 SuSE Package Signing Key <build@suse.de> - pub 2048R/50A3DD1C SuSE Package Signing Key (reserve key) <build@suse.de> - pub 1024D/B37B98A9 SUSE PTF Signing Key <support@suse.com> - pub 2048R/3D25D3D9 SuSE Security Team <security@suse.de> - reverted to contain the fullkeyring build SLE12 Alpha. - also list the old sle11 build@suse.de key temporary - create suse-build-key.gpg during build. - Remove old keys from keyring. (fate#314767) Keys currently inside the RPM trusted keyring: - pub 2048R/39DB7C82 SuSE Package Signing Key <build@suse.de> - pub 2048R/50A3DD1C SuSE Package Signing Key (reserve key) <build@suse.de> - Various keys are moved to the documentation area (/usr/share/doc/packages/suse-build-key) - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key. if SUSE Linux Enterprise 11 packages need to be verified on a SUSE Linux Enterprise 12 system. - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs. - security_at_suse_de.asc: Use only for email encryption and verification purposes when contacting our security contact address security@suse.de - Went to new method again. - suse-build-key.gpg blob dropped - ship seperate files - renamed security_at_suse_de.asc to security_at_suse_de_old.asc - security_at_suse_de.asc: new 4096 bit RSA key. pub 4096R/317CD502 2014-10-02 SUSE Security Team <security@suse.de> bnc#899509 - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - reverted to contain the fullkeyring build SLE12 Alpha. - also list the old sle11 build@suse.de key temporary - create suse-build-key.gpg during build. - Remove old keys from keyring. (fate#314767) Keys currently inside the RPM trusted keyring: - pub 2048R/39DB7C82 SuSE Package Signing Key <build@suse.de> - pub 2048R/50A3DD1C SuSE Package Signing Key (reserve key) <build@suse.de> - Various keys are moved to the documentation area (/usr/share/doc/packages/suse-build-key) - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key. if SUSE Linux Enterprise 11 packages need to be verified on a SUSE Linux Enterprise 12 system. - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs. - security_at_suse_de.asc: Use only for email encryption and verification purposes when contacting our security contact address security@suse.de - Went to new method again. - suse-build-key.gpg blob dropped - ship seperate files - renamed security_at_suse_de.asc to security_at_suse_de_old.asc - security_at_suse_de.asc: new 4096 bit RSA key. pub 4096R/317CD502 2014-10-02 SUSE Security Team <security@suse.de> bnc#899509 - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Went to new method again. - suse-build-key.gpg blob dropped - ship seperate files - renamed security_at_suse_de.asc to security_at_suse_de_old.asc - security_at_suse_de.asc: new 4096 bit RSA key. pub 4096R/317CD502 2014-10-02 SUSE Security Team <security@suse.de> bnc#899509 - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - renamed security_at_suse_de.asc to security_at_suse_de_old.asc - security_at_suse_de.asc: new 4096 bit RSA key. pub 4096R/317CD502 2014-10-02 SUSE Security Team <security@suse.de> bnc#899509 - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - added missing ; in shell script (bsc#1227681) - use dumpsigs script from openSUSE to merge code - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - added missing ; in shell script (bsc#1227681) - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - added missing ; in shell script (bsc#1227681) - extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339) - gpg-pubkey-39db7c82-5f68629b.asc + gpg-pubkey-39db7c82-66c5d91a.asc - extend the build@suse.de product key. (bsc#1014151) pub 2048R/39DB7C82 2013-01-31 [expires: 2020-12-06] uid SuSE Package Signing Key <build@suse.de> - created a new security@suse.de communication key. (bsc#1082022) - extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512) - include ptf key in the key directory to avoid it being stripped via %doc stripping. (bsc#1044232) - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - added missing ; in shell script (bsc#1227681) - extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339) - gpg-pubkey-39db7c82-5f68629b.asc + gpg-pubkey-39db7c82-66c5d91a.asc - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - added missing ; in shell script (bsc#1227681) - Also include the GPG key from the current build project to allow Staging testing without production keys. (bsc#1231829) - make the per-project inclusion optional, default off. - ensure key2rpmname is called using bash. - extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339) - gpg-pubkey-39db7c82-5f68629b.asc + gpg-pubkey-39db7c82-66c5d91a.asc - created a new security@suse.de communication key (bsc#1166334) - add a /usr/share/container-keys/ directory for GPG based Container verification. - Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347) - actually the container key is different from the build signing key. (PM-1845 bsc#1170347) - suse build key extended (bsc#1176759) gpg-pubkey-39db7c82-5847eb1f.asc -> gpg-pubkey-39db7c82-5f68629b.asc - extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc - added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494) - extended expiry of SUSE SLES11 key (bsc#1194845) - added SUSE Contaner signing key in PEM format for use e.g. by cosign. - SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495) - No longer install 1024bit keys by default. (bsc#1197293) - SLE11 key moved to documentation - old PTF (pre March 2022) moved to documentation only - still ship the old ptf key (was not added to documentation by mistake). (bsc#1198504) - added /usr/share/pki/containers directory for container pem keys (cosign/sigstore style), put our PEM key there too (bsc#1204706) - Establish multiple new 4096 RSA keys that we will switch to mid of 2023. (jsc#PED-2777) - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos). - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos). - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs. - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem: new RSA 4096 key for the SUSE registry registry.suse.com, installed as suse-container-key-2023.pem and suse-container-key-2023.asc - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem: New PTF container signing key for registry.suse.com/ptf/ space. - add and run a import-suse-build-key scripts, this will be ran after installation with libzypp based installers. (jsc#PED-2777) - replace libzypp-post-script based installation with a systemd timer and service. - suse-build-key-import.service - suse-build-key-import.timer - run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123 - run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123 - Switch container key to be default RSA 4096bit. (jsc#PED-2777) - Added new keys of the SLE Micro 6.0 / SLES 16 series, and auto import them. (bsc#1227429) gpg-pubkey-09d9ea69-645b99ce.asc: Main SLE Micro 6/SLES 16 key gpg-pubkey-73f03759-626bd414.asc: Backup SLE Micro 6/SLES 16 key. - added missing ; in shell script (bsc#1227681) - Also include the GPG key from the current build project to allow Staging testing without production keys. (bsc#1231829) - make the per-project inclusion optional, default off. - ensure key2rpmname is called using bash. - extended 2048 bit SUSE SLE 12, 15 GA-SP5 key until 2028. (bsc#1229339) - gpg-pubkey-39db7c82-5f68629b.asc + gpg-pubkey-39db7c82-66c5d91a.asc - Update to version 15.3.7: * Fix treatment of compressed modules (bsc#1187093) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.3.7: * Fix treatment of compressed modules (bsc#1187093) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.3.7: * Fix treatment of compressed modules (bsc#1187093) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.3.7: * Fix treatment of compressed modules (bsc#1187093) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.3.8: * modprobe.d: Remove dma=none setting for parport_pc (bsc#1177695) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.5.5: * Include unblacklist in initramfs (bsc#1224320) * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN (bsc#1223278) * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.5.5: * Include unblacklist in initramfs (bsc#1224320) * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN (bsc#1223278) * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.5.5: * Include unblacklist in initramfs (bsc#1224320) * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN (bsc#1223278) * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717) - Update to version 15.4.2 - Move config files to /lib/modprobe.d and /lib/depmod.d (jsc#SLE-20639) * "modprobe $FS" for a blacklisted file system now offers to unblacklist the module permanently * disabled automatic un-blacklisting of filesystem modules loaded at installation time - Replace mkinitrd with dracut everywhere (jsc#SLE-20348) - Add faster substitute for lsinitrd to speed up weak-modules2 (jsc#SLE-9078) - Enable f2fs - Add a "Supplements" dependency on dkms to the "legacy" submodule (dkms needs "weak-modules") - modprobe.d cleanups and fixes: * Unify ppc64 and ppc64le * Delete files for obsolete architectures * Remove obsolete SUSE_INITRD statements (bsc#1161343) * Remove dma=none setting for parport_pc (bsc#1177695) - Add README.md - Update to version 15.4.3: * fix problem that initrd may not be rebuilt after installing kernel-$flavor-extra (bsc#1189441) - Update to version 15.4.4: * Import kernel scriptlets from kernel-source (bsc#1189841, bsc#1190598) * Provide "suse-kernel-rpm-scriptlets" - Update to version 15.4.5: * inkmp-script(postun): don't pass existing files to weak-modules2 (boo#1191200) * kernel-scriptlets: skip cert scriptlet on non-UEFI systems (boo#1191260) - Update to version 15.4.6: * rpm-script: fix bad exit status in OpenQA (bsc#1191922) * cert-script: Deal with existing $cert.delete file (bsc#1191804). * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480). * cert-script: Only print mokutil output in verbose mode. - Update to version 15.4.7: * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)" - Update to version 15.4.8: * Same as Factory version 16.0.14 * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE). Both packages are now both obsoleted by suse-module-tools. (jsc#SLE-21032) * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices (jsc#SLE-21032, bsc#1192161) * 60-io-scheduler.rules: use "none" for multipath components (bsc#1192161) - Update to version 15.4.9: * same as Factory version 16.0.16 * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059) - Rather than shipping two large files with modprobe.d options (00-system.conf and 50-blacklist.conf), ship multiple small per-module files. This makes it easier for users to override distribution defaults. * blacklist isst_if_mbox_msr (bsc#1187196) * boot-sysctl: make sure file exists (fix for containers) * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718) - Update to version 15.4.10: * same as Factory version 16.0.17 * 60-io-scheduler.rules: add rules for virtual devices (boo#1193759) * 60-io-scheduler.rules: enforce "none" for loop devices (boo#1193759) * install some modprobe.d files only for relevant architectures (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974) - Update to version 15.4.11: * cdrom: Disable autoclose by default (boo#1165047). * Make regenerate-initrd-posttrans compatible with Dracut's UEFI mode (unified kernel image) - Update to version 15.4.12: * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051) * rpm-script: force-copy kernel to /boot (boo#1194501) - Update to version 15.4.13: * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423) - Update to version 15.4.14: * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423) - Update to version 15.4.15: Backport bug fixes from factory * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092) * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391) * driver-check.sh: avoid false positive error messages (boo#1200107) - Update to version 15.5.0: * version adapted, code is identical to 15.4.15 - Update to version 15.5.1: * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853) - Update to version 15.5.2: * rpm-script: update bootloader after creating initramfs (boo#1213822) * rpm-script: check for regenerate-initrd-posttrans in %posttrans (boo#1212957) * cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066) - Update to version 15.5.3: * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559) * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829) (note: this is not a full fix for that CVE) - Update to version 15.5.4: * rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775) - Update to version 15.5.5: * Include unblacklist in initramfs (bsc#1224320) * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN (bsc#1223278) * 60-io-scheduler.rules: test for "scheduler" sysfs attribute (boo#1216717) - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update version to 1.13: - Integrating uptime-tracker - Honor auto-import-gpg-keys flag on migration (bsc#1231328) - Only send labels if targetting SCC - Skip the docker auth generation on RMT (bsc#1231185) - Add --set-labels to register command to set labels at registration time on SCC - Add a new function to display suse-uptime-tracker version - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ ) - Add a command to show the info being gathered - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update version to 1.13: - Integrating uptime-tracker - Honor auto-import-gpg-keys flag on migration (bsc#1231328) - Only send labels if targetting SCC - Skip the docker auth generation on RMT (bsc#1231185) - Add --set-labels to register command to set labels at registration time on SCC - Add a new function to display suse-uptime-tracker version - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ ) - Add a command to show the info being gathered - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update version to 1.13: - Integrating uptime-tracker - Honor auto-import-gpg-keys flag on migration (bsc#1231328) - Only send labels if targetting SCC - Skip the docker auth generation on RMT (bsc#1231185) - Add --set-labels to register command to set labels at registration time on SCC - Add a new function to display suse-uptime-tracker version - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ ) - Add a command to show the info being gathered - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update version to 1.10.0 * Build zypper-migration and zypper-packages-search as standalone binaries rather then one single binary * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004) * Include /etc/products.d in directories whose content are backed up and restored if a zypper-migration rollback happens. (bsc#1219004) * Add the ability to upload the system uptime logs, produced by the suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report. (jsc#PED-7982) (jsc#PED-8018) * Add support for third party packages in SUSEConnect * Refactor existing system information collection implementation - Update version to 1.11 - Added uname as collector - Added SAP workload detection - Added detection of container runtimes - Multiple fixes on ARM64 detection - Use `read_values` for the CPU collector on Z - Fixed data collection for ppc64le - Grab the home directory from /etc/passwd if needed (bsc#1226128) - Update version to 1.12: - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014) - Update version to 1.13: - Integrating uptime-tracker - Honor auto-import-gpg-keys flag on migration (bsc#1231328) - Only send labels if targetting SCC - Skip the docker auth generation on RMT (bsc#1231185) - Add --set-labels to register command to set labels at registration time on SCC - Add a new function to display suse-uptime-tracker version - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ ) - Add a command to show the info being gathered - Update to version 0.0.6~git9.33e5847: * Delegate free() calls back to Go (bsc#1195729) * Pass "insecure" to zypper addservice * Workaround system cert reloading after import (bsc#1195220) * Extract setupHTTPClient for easier reuse * Exit with code 64 on connection refused like Ruby - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0~git0.b0f7c25bfdfa * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 0.0.6~git9.33e5847: * Delegate free() calls back to Go (bsc#1195729) * Pass "insecure" to zypper addservice * Workaround system cert reloading after import (bsc#1195220) * Extract setupHTTPClient for easier reuse * Exit with code 64 on connection refused like Ruby - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0~git0.b0f7c25bfdfa * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 0.0.6~git9.33e5847: * Delegate free() calls back to Go (bsc#1195729) * Pass "insecure" to zypper addservice * Workaround system cert reloading after import (bsc#1195220) * Extract setupHTTPClient for easier reuse * Exit with code 64 on connection refused like Ruby - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0~git0.b0f7c25bfdfa * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 0.0.6~git9.33e5847: * Delegate free() calls back to Go (bsc#1195729) * Pass "insecure" to zypper addservice * Workaround system cert reloading after import (bsc#1195220) * Extract setupHTTPClient for easier reuse * Exit with code 64 on connection refused like Ruby - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0~git0.b0f7c25bfdfa * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 0.0.7~git0.3ef988e: * Fix product tree traversal (bsc#1197398) * Revert "Remove self from LD_PRELOAD (bsc#1196326)" * Remove self from LD_PRELOAD (bsc#1196326) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 0.0.8~git0.16545bf: * Allow reloading CA certs pool (bsc#1195220) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0~git0.5338270 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0~git0.5338270 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0~git0.5338270 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 0.0.8~git2.368ea44: * go1.18 compatibility: BuildRequires:git - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0~git0.5338270 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 0.0.9~git5.75890b6: * Don't run keepalive on reboot * Use system-wide proxy settings (bsc#1200994) * Add customer information about keepalive calls * Add timer for SUSEConnect --keepalive (bsc#1196076) * Add --keepalive to manpage * Added support for the System-Token header * Add Keepalive command line option * Print nested zypper errors (bsc#1200803) * Fix migration json error with SMT (bsc#1198625) * Add option to run local scc tests * Switch to jenkins-hosted credentials * Fix "VCS stamping" problem * Add missing import * Remove redundant code + add comment - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Update to version 0.0.9~git8.f9adb71: * Use standard buildconditionals * Strip the binaries (saves ~ 30%) - Update to version 0.0.9~git10.de887da7231f: * Respect the PROXY_ENABLED environment variable - Update to version 0.0.10~git0.5f84106: * Fix System-Token support in ruby binding (bsc#1203341) * Added the PACKAGE.md file - Update to version 0.0.10~git2.ee561b8: * Drop .git from tar - Update to version 1.0.0~git0.60e48564a714 (bsc#1204821): * packaging: obsolete suseconnect < 1.0.0 * packaging: don't end the summary with a dot - Update to version v1.0~git0.32cac3fb5047: * packaging: 1.0.0 -> 1.0 - Update to version 1.0.0~git0.faee7c196dc1: * Revert "packaging: 1.0.0 -> 1.0" - Update to version 1.0.0~git14.17a7901: * Don't write system_token to service credentials files * Allow non-root users to use --version * Add: ExcludeArch: %ix86 s390 ppc64 to the .spec file, so we skip builds for unsupported architectures. * Update Dockerfile.yast * Use openssl go for SLE and Leap 15.5+ builds * Fix keepalive feature notice during installation * Fix requires for all rhel clone distributions like alma, rocky... - Update to version 1.0.0~git19.b225bc3: * Make keepalive on SUMA systems exit without error (bsc#1207876) * Update README.md * Add deactivate API to ruby bindings (bsc#1202705) - Update to version 1.0.0~git23.406b219ccc9e: * Added MemTotal detection for HwInfo * move 'ExcludeArch' out of the if block - Update to version 1.1.0~git0.e3c41e60892e: * Bump to v1.1.0 - Update to version 1.1.0~git2.f42b4b2a060e: * Keep keepalive timer states when replacing SUSEConnect (bsc#1211588) - Update to version 1.2.0~git0.abd0fec: * enhance docs for package testing * Fixed `provides` to work with yast2-registration on SLE15 < SP4 (bsc#1212799) * Improve error message if product set more than once - Update to version 1.3.0 * Track .changes file in git - Update to version 1.4.0 * Added EULA display for addons (bsc#1170267) * Fix zypper argument for auto-agreeing licenses (bsc#1214781) * Enable building on SLE12 SP5 (jsc#PED-3179) - Update to version 1.5.0 * Configure docker credentials for registry authentication * Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) * Add --json output option - Update to version 1.6.0 * Disable EULA display for addons (bsc#1218649 and bsc#1217961) - Update to version 1.7.0 * Allow SUSEConnect on read write transactional systems (bsc#1219425) - Update to version 1.8.0 * Allow "--rollback" flag to run on readonly filesystem (bsc#1220679) - Update to version 1.9.0 * Fix certificate import for Yast when using a registration proxy with self-signed SSL certificate (bsc#1223107) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - version 0.84.2 - spec: revert change to use _fillupdir in update hook from < 0.80 - merged fixes of the the fillup templates logic and macro in configure.ac by Marcus Meissner - Use %license instead of %doc [bsc#1082318] - version 0.84.3 - netconfig: change policy to permit non-NM settings (bsc#1079793) As requested and approved by NetworkManager maintainer, the 'auto' policy permits now also per interface settings provided by other services when NetworkManager is enabled. That is, the auto policy resolving has been changed from "STATIC_FALLBACK NetworkManager" to "STATIC_FALLBACK * NetworkManager". - version 0.85.0 - netconfig: change to write resolv.conf,yp.conf,forwarders.conf to files in /[var/]run/netconfig/ and link in /etc (fate#325872) - netconfig: add to update ntp servers in chrony (bsc#1099272) and cleaned up to use start-ntpd addserver to update ntpd servers. - Remove code to update from openSUSE older than 12.3, which is EOL (gh#openSUSE/sysconfig#19). - Move /var/adm/netconfig to /var/lib/netconfig to become more FHS conform (gh#openSUSE/sysconfig#18). - version 0.85.1 - removed modprobe.d/50-blacklist.conf, which will be provided by the suse-module-tools package instead (boo#1107611). See also: gh#openSUSE/suse-module-tools/pull/3 gh#openSUSE/sysconfig/pull/22 - HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch - version 0.85.2 - Fixed changes file to mention relevant github pull requests. - Removed remaining preun rpm hook from EOL openSUSE versions - Merged /var/adm/netconfig move revert from openSUSE:Factory causing to not find md5 sums from previous netconfig version due to incorrectly merged hook in spec file and trouble on transactional systems without writeable /var/lib/netconfig. Removed obsoletes revert-var-adm-lib-netconfig-move.patch. (bsc#1124152,bsc#1124340). - Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23) - version 0.85.3 - boo#1123699: Use systemd's tmpfile mechanism to create the symlink infrastructure for resolv.conf and yp.conf early during boot. - Mark /etc/yp.conf as %config(noreplace): this is the same as the file shipped by ypbind has as mode. In sysconfig we create a symlink, in ypbind, the file is actually only owned for reference. Having the same modes allows for the bots to do their work properly (boo#1159566). - version 0.85.4 - Add Upstream First openSUSE Build Service Policy to the spec - version 0.85.5 - spec: Fix Requires, use file requires (https://github.com/openSUSE/sysconfig/pull/25) - ntp: call chrony helper in background (bsc#1173391) - version 0.85.6 - netconfig: execute chrony/helper in /usr/libexec with fallback to it's previous location in /usr/lib (boo#1176285) - netconfig: only write files like /etc/resolv.conf on content change to avoid that e.g. dnsmasq (if running) re-reads the /etc/resolv.conf and re-initializes itself (bsc#1176325) - Also support service(network) provides - spec: Drop hard dependency on /sbin/ifup (jsc#SMO-84) - spec: Suggest instead of recommend wicked-service - spec: Mention that the .spec file is in git as well - version 0.85.7 - Link as Position Independent Executable (bsc#1184124). - version 0.85.8 - netconfig: revert NM default policy change change (boo#1185882) With the change to the default policy, netconfig with NetworkManager as network.service accepted settings from all services/programs directly instead only from NetworkManager, where plugins/services have to deliver their settings to apply them. - version 0.85.9 - spec: revert to recommend wicked-service on <= 15.4 - netconfig: remove sed dependency - netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093) - netconfig: cleanup /var/run leftovers (bsc#1194557) - netconfig: update ntp man page documentation, fix typos - spec: drop legacy migration (from sle11) and rpm-utils - Update to last SLE-15-SP2…5:Update sysconfig version preserving SLE-Micro specific spec file adjustments (jsc#MSC-784). - localboot.diff: -2 boots next disk (bnc #807157) - Add Source URL, see https://en.opensuse.org/SourceUrls - geometry.diff: Fix segfault caused by a bug in geometry handling (bnc#852856) - nostrip.diff: don't strip binaries - timeout.diff: fix timeout counter to work more accurate (bnc #691211) - syslinux-4.04-cache_fix.diff: fix memory corruption due to wrong fs cache initialisation (bnc #884181) - syslinux-4.04-mtime.diff: don't use timestamps to create a unique id (bnc #915950) - Do not use gcc-PIE here, lots of assembler (cpuid etc.) that would be hard to make ready for PIC. - drop hard dependency on mtools (bsc#943571) - syslinux-4.04-miniacc.diff: fixup broken conformance tests - create also s390x package (bsc#964471) - syslinux-4.04-align.diff: fix section alignment (bsc#948445) - added aarch64, ppc64le to baselibs.conf (bsc#982948) - Add syslinux-4.04-reproducible.patch to sort file lists to fix build-compare (boo#1041090) - syslinux-4.04-python3.diff: switch to python3 (bsc#1075769) - sysmacros.patch: include <sys/sysmacros.h> for major/minor - Add remove-note-gnu-section.patch: strip a newly added section in order to fulfil ELF size limits expected. - syslinux-4.04-lzo.diff: fix lzo memory aliasing issue (bsc#1125616) - syslinux-4.04-gcc10.diff: fix gcc10 related issues (bsc#1166605) * -fno-common is now the default * provide missing strlen() implementation - Add syslinux-4.04-reproducible-isohybrid.patch to allow for deterministic iso image creation (boo#1062303) - syslinux-4.04-mtime.diff: don't use timestamps to create a unique id (bnc #915950) - Do not use gcc-PIE here, lots of assembler (cpuid etc.) that would be hard to make ready for PIC. - drop hard dependency on mtools (bsc#943571) - syslinux-4.04-miniacc.diff: fixup broken conformance tests - create also s390x package (bsc#964471) - syslinux-4.04-align.diff: fix section alignment (bsc#948445) - added aarch64, ppc64le to baselibs.conf (bsc#982948) - Add syslinux-4.04-reproducible.patch to sort file lists to fix build-compare (boo#1041090) - syslinux-4.04-python3.diff: switch to python3 (bsc#1075769) - sysmacros.patch: include <sys/sysmacros.h> for major/minor - Add remove-note-gnu-section.patch: strip a newly added section in order to fulfil ELF size limits expected. - syslinux-4.04-lzo.diff: fix lzo memory aliasing issue (bsc#1125616) - syslinux-4.04-gcc10.diff: fix gcc10 related issues (bsc#1166605) * -fno-common is now the default * provide missing strlen() implementation - Add syslinux-4.04-reproducible-isohybrid.patch to allow for deterministic iso image creation (boo#1062303) - Properly specify you want to be started by multi-user.target bsc#1031674 - Update to version 11.6.1 * See provided CHANGES for detailed list of changes - Refresh patches: * sysstat-8.0.4-pagesize.diff * sysstat-8.0.4-sysconfdir.diff * sysstat-8.1.6-sa1sa2lock.diff - Drop no longer needed * sysstat-8.0.4-sysconfdir.diff - Remove Requires on update-desktop-files on subpackage, it is useless. - Version update to 11.6.3: * A possible crash related to the new binary format used by sar, which could happen when buffers needed to be reallocated to accomodate more devices added to the system, * The %CPU value displayed by pidstat for processes using more than 100% of a core. - Version update to 11.6.4: * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat), * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf. - Update to 11.6.5: * sadf: SVG: Display graphs for swap utilization in packed mode. * sadf: SVG: Don't take into account activities with no graphs when calculating canvas height. * sadf: SVG: Don't insert a gap in SVG output if an activity is not displayed. * sadf: SVG: Fix possible negative value in graphs coordinates. - Version update to 12.0.1: * sadf: SVG: Remove id tag from individual graphs. Use activities identification numbers for id tags. * sadf: SVG: Add new option "showtoc", which can be used to display the list of activities for which there are graphs ("table of contents"). * sadf: SVG: Improve output for softnet activity: Add a discontinuity in graph when corresponding CPU is marked offline. * sadf: SVG: Improve function used to assess SVG canvas height. * sadf: SVG: Fix core dumped on buffers reallocation. * sar/sadf: Devices list management code refactoring. * sa_conv.c: Use write_all() function instead of write() to handle possible signal interruptions. * spec file updated: No longer create a debug package. * Remove many warnings from gcc v7/v8. * README file updated. * Manual pages updated. - Up to 12.0.2: (fate#326576, bsc#1089883) * This version mainly includes bugfixes - Dropped patches for SLE-12, fixed upstream: * sysstat-10.2.1-iostat-sar-util.patch * sysstat-10.2.1-sar-ifutil.patch * sysstat-10.2.6-fix-json-with-file-utc-time.patch - Security fixes: * The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call [CVE-2018-19416, bsc#1117001] * The remap_struct function in sa_common.c has an out-of-bounds read during a memset call [CVE-2018-19517, bsc#1117260] * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch - Fix scaling issue with mtab symlinks and automounter [bsc#1138767] * Added sysstat-mtab-symlinks-and-automounter.patch - Remove deprecated Require gettext and require gettext-runtime only during build [bsc#1142470] - Security fix: [bsc#1150114, CVE-2019-16167] * Memory corruption due to an Integer Overflow in remap_struct() in sa_common.c * Added sysstat-CVE-2019-16167.patch - Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958] - Security fix: [bsc#1159104, CVE-2019-19725] * Double free in check_file_actlst in sa_common.c - Add sysstat-CVE-2019-19725.patch - Fix average iowait output of sar [bsc#1174227] * The iowait value reported by the kernel can also decrement as a result of inaccurate iowait tracking. Waiting on IO can be first accounted as iowait but then instead as idle. Therefore if the idle value during the same period did not decrease then consider this is a problem with the iowait reporting and correct the previous value according to the new reading. Otherwise, treat this as CPU coming back online. - Add patch sysstat-iowait-decr.patch - Don't hard require systemd, it works without,too. (bsc#1186827) - Fix iostat -y switch results [bsc#1177747] - Add sysstat-12.1.6-iostat-y-option.diff - Fix possible segfault in read_task_stats() [bsc#1194679] - Add sysstat-fix-segfault-in-read_task_stats.patch - Sysstat requires cron in SLE [related to bsc#1202473] - Add missing patches related to CVE-2022-39377 and CVE-2023-33204 (bsc#1211507). * Add sysstat-CVE-2022-39377.patch * Add sysstat-CVE-2023-33204.patch - Properly specify you want to be started by multi-user.target bsc#1031674 - Update to version 11.6.1 * See provided CHANGES for detailed list of changes - Refresh patches: * sysstat-8.0.4-pagesize.diff * sysstat-8.0.4-sysconfdir.diff * sysstat-8.1.6-sa1sa2lock.diff - Drop no longer needed * sysstat-8.0.4-sysconfdir.diff - Remove Requires on update-desktop-files on subpackage, it is useless. - Version update to 11.6.3: * A possible crash related to the new binary format used by sar, which could happen when buffers needed to be reallocated to accomodate more devices added to the system, * The %CPU value displayed by pidstat for processes using more than 100% of a core. - Version update to 11.6.4: * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat), * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf. - Update to 11.6.5: * sadf: SVG: Display graphs for swap utilization in packed mode. * sadf: SVG: Don't take into account activities with no graphs when calculating canvas height. * sadf: SVG: Don't insert a gap in SVG output if an activity is not displayed. * sadf: SVG: Fix possible negative value in graphs coordinates. - Version update to 12.0.1: * sadf: SVG: Remove id tag from individual graphs. Use activities identification numbers for id tags. * sadf: SVG: Add new option "showtoc", which can be used to display the list of activities for which there are graphs ("table of contents"). * sadf: SVG: Improve output for softnet activity: Add a discontinuity in graph when corresponding CPU is marked offline. * sadf: SVG: Improve function used to assess SVG canvas height. * sadf: SVG: Fix core dumped on buffers reallocation. * sar/sadf: Devices list management code refactoring. * sa_conv.c: Use write_all() function instead of write() to handle possible signal interruptions. * spec file updated: No longer create a debug package. * Remove many warnings from gcc v7/v8. * README file updated. * Manual pages updated. - Up to 12.0.2: (fate#326576, bsc#1089883) * This version mainly includes bugfixes - Dropped patches for SLE-12, fixed upstream: * sysstat-10.2.1-iostat-sar-util.patch * sysstat-10.2.1-sar-ifutil.patch * sysstat-10.2.6-fix-json-with-file-utc-time.patch - Security fixes: * The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call [CVE-2018-19416, bsc#1117001] * The remap_struct function in sa_common.c has an out-of-bounds read during a memset call [CVE-2018-19517, bsc#1117260] * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch - Fix scaling issue with mtab symlinks and automounter [bsc#1138767] * Added sysstat-mtab-symlinks-and-automounter.patch - Remove deprecated Require gettext and require gettext-runtime only during build [bsc#1142470] - Security fix: [bsc#1150114, CVE-2019-16167] * Memory corruption due to an Integer Overflow in remap_struct() in sa_common.c * Added sysstat-CVE-2019-16167.patch - Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958] - Security fix: [bsc#1159104, CVE-2019-19725] * Double free in check_file_actlst in sa_common.c - Add sysstat-CVE-2019-19725.patch - Fix average iowait output of sar [bsc#1174227] * The iowait value reported by the kernel can also decrement as a result of inaccurate iowait tracking. Waiting on IO can be first accounted as iowait but then instead as idle. Therefore if the idle value during the same period did not decrease then consider this is a problem with the iowait reporting and correct the previous value according to the new reading. Otherwise, treat this as CPU coming back online. - Add patch sysstat-iowait-decr.patch - Don't hard require systemd, it works without,too. (bsc#1186827) - Fix iostat -y switch results [bsc#1177747] - Add sysstat-12.1.6-iostat-y-option.diff - Fix possible segfault in read_task_stats() [bsc#1194679] - Add sysstat-fix-segfault-in-read_task_stats.patch - Sysstat requires cron in SLE [related to bsc#1202473] - Add missing patches related to CVE-2022-39377 and CVE-2023-33204 (bsc#1211507). * Add sysstat-CVE-2022-39377.patch * Add sysstat-CVE-2023-33204.patch - Properly specify you want to be started by multi-user.target bsc#1031674 - Update to version 11.6.1 * See provided CHANGES for detailed list of changes - Refresh patches: * sysstat-8.0.4-pagesize.diff * sysstat-8.0.4-sysconfdir.diff * sysstat-8.1.6-sa1sa2lock.diff - Drop no longer needed * sysstat-8.0.4-sysconfdir.diff - Remove Requires on update-desktop-files on subpackage, it is useless. - Version update to 11.6.3: * A possible crash related to the new binary format used by sar, which could happen when buffers needed to be reallocated to accomodate more devices added to the system, * The %CPU value displayed by pidstat for processes using more than 100% of a core. - Version update to 11.6.4: * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat), * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf. - Update to 11.6.5: * sadf: SVG: Display graphs for swap utilization in packed mode. * sadf: SVG: Don't take into account activities with no graphs when calculating canvas height. * sadf: SVG: Don't insert a gap in SVG output if an activity is not displayed. * sadf: SVG: Fix possible negative value in graphs coordinates. - Version update to 12.0.1: * sadf: SVG: Remove id tag from individual graphs. Use activities identification numbers for id tags. * sadf: SVG: Add new option "showtoc", which can be used to display the list of activities for which there are graphs ("table of contents"). * sadf: SVG: Improve output for softnet activity: Add a discontinuity in graph when corresponding CPU is marked offline. * sadf: SVG: Improve function used to assess SVG canvas height. * sadf: SVG: Fix core dumped on buffers reallocation. * sar/sadf: Devices list management code refactoring. * sa_conv.c: Use write_all() function instead of write() to handle possible signal interruptions. * spec file updated: No longer create a debug package. * Remove many warnings from gcc v7/v8. * README file updated. * Manual pages updated. - Up to 12.0.2: (fate#326576, bsc#1089883) * This version mainly includes bugfixes - Dropped patches for SLE-12, fixed upstream: * sysstat-10.2.1-iostat-sar-util.patch * sysstat-10.2.1-sar-ifutil.patch * sysstat-10.2.6-fix-json-with-file-utc-time.patch - Security fixes: * The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call [CVE-2018-19416, bsc#1117001] * The remap_struct function in sa_common.c has an out-of-bounds read during a memset call [CVE-2018-19517, bsc#1117260] * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch - Fix scaling issue with mtab symlinks and automounter [bsc#1138767] * Added sysstat-mtab-symlinks-and-automounter.patch - Remove deprecated Require gettext and require gettext-runtime only during build [bsc#1142470] - Security fix: [bsc#1150114, CVE-2019-16167] * Memory corruption due to an Integer Overflow in remap_struct() in sa_common.c * Added sysstat-CVE-2019-16167.patch - Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958] - Security fix: [bsc#1159104, CVE-2019-19725] * Double free in check_file_actlst in sa_common.c - Add sysstat-CVE-2019-19725.patch - Fix average iowait output of sar [bsc#1174227] * The iowait value reported by the kernel can also decrement as a result of inaccurate iowait tracking. Waiting on IO can be first accounted as iowait but then instead as idle. Therefore if the idle value during the same period did not decrease then consider this is a problem with the iowait reporting and correct the previous value according to the new reading. Otherwise, treat this as CPU coming back online. - Add patch sysstat-iowait-decr.patch - Don't hard require systemd, it works without,too. (bsc#1186827) - Fix iostat -y switch results [bsc#1177747] - Add sysstat-12.1.6-iostat-y-option.diff - Fix possible segfault in read_task_stats() [bsc#1194679] - Add sysstat-fix-segfault-in-read_task_stats.patch - Sysstat requires cron in SLE [related to bsc#1202473] - Add missing patches related to CVE-2022-39377 and CVE-2023-33204 (bsc#1211507). * Add sysstat-CVE-2022-39377.patch * Add sysstat-CVE-2023-33204.patch - Properly specify you want to be started by multi-user.target bsc#1031674 - Update to version 11.6.1 * See provided CHANGES for detailed list of changes - Refresh patches: * sysstat-8.0.4-pagesize.diff * sysstat-8.0.4-sysconfdir.diff * sysstat-8.1.6-sa1sa2lock.diff - Drop no longer needed * sysstat-8.0.4-sysconfdir.diff - Remove Requires on update-desktop-files on subpackage, it is useless. - Version update to 11.6.3: * A possible crash related to the new binary format used by sar, which could happen when buffers needed to be reallocated to accomodate more devices added to the system, * The %CPU value displayed by pidstat for processes using more than 100% of a core. - Version update to 11.6.4: * The number of decimal places used by sysstat commands (sar, cifsiostat, iostat, mpstat and pidstat), * The network interfaces, block devices and filesystems for which statistics shall be displayed by sar or sadf. - Update to 11.6.5: * sadf: SVG: Display graphs for swap utilization in packed mode. * sadf: SVG: Don't take into account activities with no graphs when calculating canvas height. * sadf: SVG: Don't insert a gap in SVG output if an activity is not displayed. * sadf: SVG: Fix possible negative value in graphs coordinates. - Version update to 12.0.1: * sadf: SVG: Remove id tag from individual graphs. Use activities identification numbers for id tags. * sadf: SVG: Add new option "showtoc", which can be used to display the list of activities for which there are graphs ("table of contents"). * sadf: SVG: Improve output for softnet activity: Add a discontinuity in graph when corresponding CPU is marked offline. * sadf: SVG: Improve function used to assess SVG canvas height. * sadf: SVG: Fix core dumped on buffers reallocation. * sar/sadf: Devices list management code refactoring. * sa_conv.c: Use write_all() function instead of write() to handle possible signal interruptions. * spec file updated: No longer create a debug package. * Remove many warnings from gcc v7/v8. * README file updated. * Manual pages updated. - Up to 12.0.2: (fate#326576, bsc#1089883) * This version mainly includes bugfixes - Dropped patches for SLE-12, fixed upstream: * sysstat-10.2.1-iostat-sar-util.patch * sysstat-10.2.1-sar-ifutil.patch * sysstat-10.2.6-fix-json-with-file-utc-time.patch - Security fixes: * The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call [CVE-2018-19416, bsc#1117001] * The remap_struct function in sa_common.c has an out-of-bounds read during a memset call [CVE-2018-19517, bsc#1117260] * Added patch sysstat-12.0.2-CVE-2018-19416-and-CVE-2018-19517.patch - Fix scaling issue with mtab symlinks and automounter [bsc#1138767] * Added sysstat-mtab-symlinks-and-automounter.patch - Remove deprecated Require gettext and require gettext-runtime only during build [bsc#1142470] - Security fix: [bsc#1150114, CVE-2019-16167] * Memory corruption due to an Integer Overflow in remap_struct() in sa_common.c * Added sysstat-CVE-2019-16167.patch - Enable log information on service start/stop [bsc#1144923, jsc#SLE-5958] - Security fix: [bsc#1159104, CVE-2019-19725] * Double free in check_file_actlst in sa_common.c - Add sysstat-CVE-2019-19725.patch - Fix average iowait output of sar [bsc#1174227] * The iowait value reported by the kernel can also decrement as a result of inaccurate iowait tracking. Waiting on IO can be first accounted as iowait but then instead as idle. Therefore if the idle value during the same period did not decrease then consider this is a problem with the iowait reporting and correct the previous value according to the new reading. Otherwise, treat this as CPU coming back online. - Add patch sysstat-iowait-decr.patch - Don't hard require systemd, it works without,too. (bsc#1186827) - Fix iostat -y switch results [bsc#1177747] - Add sysstat-12.1.6-iostat-y-option.diff - Fix possible segfault in read_task_stats() [bsc#1194679] - Add sysstat-fix-segfault-in-read_task_stats.patch - Sysstat requires cron in SLE [related to bsc#1202473] - Add missing patches related to CVE-2022-39377 and CVE-2023-33204 (bsc#1211507). * Add sysstat-CVE-2022-39377.patch * Add sysstat-CVE-2023-33204.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - Enable Aarch64 processor support. (bsc#1179515 bsc#1179806) - Create new "audit" group for read access to logs (bsc#1178154) * add change-default-log_group.patch * update audit-secondary.spec - Do not explicitly provide group(audit) in system-users-audit: this is automatically handled by rpm/providers. - Adjust audit.spec and audit-secondary.spec to support new version - Include fix for libev * add libev-werror.patch - Update to version 3.0.2 - In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen) - Optionally interpret auid in auditctl -l - Update some syscall argument interpretations - In auditd, do not allow spaces in the hostname name format - Big documentation cleanup (MIZUTA Takeshi) - Update syscall table to the 5.12 kernel - Update the auparse normalizer for new event types - Fix compiler warnings in ids subsystem - Block a couple signals from flush & reconfigure threads - In auditd, don't wait on flush thread when exiting - Output error message if the path of input files are too long ausearch/report Included fixes from 3.0.1 - Update syscall table to the 5.11 kernel - Add new --eoe-timeout option to ausearch and aureport (Burn Alting) - Only enable periodic timers when listening on the network - Upgrade libev to 4.33 - Add auparse_new_buffer function to auparse library - Use the select libev backend unless aggregating events - Add sudoers to some base audit rules - Update the auparse normalizer for some new syscalls and event types Included fixes from 3.0 - Generate checkpoint file even when no results are returned (Burn Alting) - Fix log file creation when file logging is disabled entirely (Vlad Glagolev) - Convert auparse_test to run with python3 (Tomáš Chvátal) - Drop support for prelude - Adjust backlog_wait_time in rules to the kernel default (#1482848) - Remove ids key syntax checking of rules in auditctl - Use SIGCONT to dump auditd internal state (#1504251) - Fix parsing of virtual timestamp fields in ausearch_expression (#1515903) - Fix parsing of uid & success for ausearch - Add support for not equal operator in audit by executable (Ondrej Mosnacek) - Hide lru symbols in auparse - Add systemd process protections - Fix aureport summary time range reporting - Allow unlimited retries on startup for remote logging - Add queue_depth to remote logging stats and increase default queue_depth size - Fix segfault on shutdown - Merge auditd and audispd code - Close on execute init_pipe fd (#1587995) - Breakout audisp syslog plugin to be standalone program - Create a common internal library to reduce code - Move all audispd config files under /etc/audit/ - Move audispd.conf settings into auditd.conf - Add queue depth statistics to internal state dump report - Add network statistics to internal state dump report - SIGUSR now also restarts queue processing if its suspended - Update lookup tables for the 4.18 kernel - Add auparse_normalizer support for SOFTWARE_UPDATE event - Add 30-ospp-v42.rules to meet new Common Criteria requirements - Deprecate enable_krb and replace with transport config opt for remote logging - Mark netlabel events as simple events so that get processed quicker - When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833) - In aureport, fix segfault in file report - Add auparse_normalizer support for labeled networking events - Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194) - In ausearch/auparse, event aging is off by a second - In ausearch/auparse, correct event ordering to process oldest first - Migrate auparse python test to python3 - auparse_reset was not clearing everything it should - Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events - In ausearch/report, lightly parse selinux portion of USER_AVC events - Add bpf syscall command argument interpretation to auparse - In ausearch/report, limit record size when malformed - Port af_unix plugin to libev - In auditd, fix extract_type function for network originating events - In auditd, calculate right size and location for network originating events - Make legacy script wait for auditd to terminate (#1643567) - Treat all network originating events as VER2 so dispatcher doesn't format it - If an event has a node name make it VER2 so dispatcher doesnt format it - In audisp-remote do an initial connection attempt (#1625156) - In auditd, allow expression of space left as a percentage (#1650670) - On PPC64LE systems, only allow 64 bit rules (#1462178) - Make some parts of auditd state report optional based on config - Update to libev-4.25 - Fix ausearch when checkpointing a single file (Burn Alting) - Fix scripting in 31-privileged.rules wrt filecap (#1662516) - In ausearch, do not checkpt if stdin is input source - In libev, remove __cold__ attribute for functions to allow proper hardening - Add tests to configure.ac for openldap support - Make systemd support files use /run rather than /var/run (Christian Hesse) - Fix minor memory leak in auditd kerberos credentials code - Allow exclude and user filter by executable name (Ondrej Mosnacek) - Fix auditd regression where keep_logs is limited by rotate_logs 2 file test - In ausearch/report fix --end to use midnight time instead of now (#1671338) - Add substitue functions for strndupa & rawmemchr - Fix memleak in auparse caused by corrected event ordering - Fix legacy reload script to reload audit rules when daemon is reloaded - Support for unescaping in trusted messages (Dmitry Voronin) - In auditd, use standard template for DEAMON events (Richard Guy Briggs) - In aureport, fix segfault for malformed USER_CMD events - Add exe field to audit_log_user_command in libaudit - In auditctl support filter on socket address families (Richard Guy Briggs) - Deprecate support for Alpha & IA64 processors - If space_left_action is rotate, allow it every time (#1718444) - In auparse, drop standalone EOE events - Add milliseconds column for ausearch extra time csv format - Fix aureport first event reporting when no start given - In audisp-remote, add new config item for startup connection errors - Remove dependency on chkconfig - Install rules to /usr/share/audit/sample-rules/ - Split up ospp rules to make SCAP scanning easier (#1746018) - In audisp-syslog, support interpreting records (#1497279) - Audit USER events now sends msg as name value pair - Add support for AUDIT_BPF event - Auditd should not process AUDIT_REPLACE events - Update syscall tables to the 5.5 kernel - Improve personality interpretation by using PERS_MASK - Speedup ausearch/report parsing RAW logging format by caching uid/name lookup - Change auparse python bindings to shared object (Issue #121) - Add error messages for watch permissions - If audit rules file doesn't exist log error message instead of info message - Revise error message for unmatched options in auditctl - In audisp-remote, fixup remote endpoint disappearin in ascii format - Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander) - In auditctl, add support for sending a signal to auditd - Removes audit-fno-common.patch: fixed in upstream - Removes audit-python3.patch: fixed in upstream - Update to version 3.0.3: * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids * Change auparse_feed_has_data in auparse to include incomplete events * Auditd, stop linking against -lrt * Add ProtectHome and RestrictRealtime to auditd.service * In auditd, read up to 3 netlink packets in a row * In auditd, do not validate path to plugin unless active * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists - use https source urls - harden_auditd.service.patch: automatic hardening applied to systemd services - Change default log_format from ENRICHED to RAW (bsc#1190500): * add change-default-log_format.patch (SUSE-specific patch) - Update to version 3.0.5: * In auditd, flush uid/gid caches when user/group added/deleted/modified * Fixed various issues when dealing with corrupted logs * In auditd, check if log_file is valid before closing handle - Include fixed from 3.0.4: * Apply performance speedups to auparse library * Optimize rule loading in auditctl * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath * Update syscall table to the 5.14 kernel * Fixed various issues when dealing with corrupted logs - Fix hardened auditd.service (bsc#1181400) * add fix-hardened-service.patch Make /etc/audit read-write from the service. Remove PrivateDevices=true to expose /dev/* to auditd.service. - Enable stop rules for audit.service (cf. bsc#1190227) * add enable-stop-rules.patch - Create separate service for augenrules (bsc#1191614, bsc#1181400) * add create-augenrules-service.patch Remove ReadWritePaths=/etc/audit from auditd.service, also removes augenrules call from ExecStartPost. Create augenrules.service with the ReadWritePaths directive above. This makes /etc/audit only accessible by augenrules.service and let auditd.service (and daemon) to be sandboxed again. - Update audit-secondary.spec to accomodate the new service file. - Add CONFIG parameter to %sysusers_generate_pre - Update to version 3.0.6: * fixes a segfault on some SELINUX_ERR records * makes IPX packet interpretation dependent on the ipx header file existing * adds b32/b64 support to ausyscall * adds support for armv8l * fixes auditctl list of syscalls on PPC * auditd.service now restarts auditd under some conditions - Use %autosetup - Don't include sample rules as %doc, they're already installed as normal files - Fix create-augenrules-service.patch: * auditd.service needs to require augenrules.service, not the other way around - Fix documentation for enable-stop-rules.patch - add audit-userspace-517-compat.patch - Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645) * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch - Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517) * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch - Fix buildrequire for openldap2-devel - audit doesn't require the (outdated) C++ binding, but the C headers that happen to be pulled in by buildrequiring the C++ devel package - Drop buildrequire on C++ compiler. - Modernize specfile constructs. - Check for AF_UNIX unnamed sockets (bsc#1210004) * add check-for-AF_UNIX-unnamed-sockets.patch - Fix rules not loaded when restarting auditd.service(bsc#1204844) - Update audit-secondary.spec: create symbolic link from /sbin/audisp-syslog to /usr/sbin/audisp-syslog (bsc#1201519). - Fix plugin termination when using systemd service units (bsc#1215377) * add auditd.service-fix-plugin-termination.patch - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - user nobody: move usermod to %post, else it will be executed before the user is created. - Add system-user-uuidd.conf (boo#1057937#c3). - udev needs groups kvm and lp: [bsc#1058703] - Add group kvm to system-group-hardware - Move group lp from system-user-lp to system-group-hardware - uuidd does not need group daemon, Copy&Paste error. - Change home directory of user man to /var/lib/empty. Home directories below /var/cache are by definition insecure and a bad idea. - Add "render" group in system-group-hardware (bsc#1085847) "uaccess" tag has been dropped from /dev/dri/renderD* and these devices now have 0666 permsions by default is owned by the render group. - Add cpacfstats, ts-shell, and zkeyadm groups for s390-tools (bsc#1123730) - Add system-user-tftp subpackage with tftp user and group and /srv/tftpboot as home directory [bsc#1143454]. - Remove s390 groups again. The s390-tools maintainer wants to add groups in s390-tools manually. - Add tss user for TPM tools (boo#1162360). - Align /var/lib/tss permissions with trousers (boo#1162360). - Call usermod only if installed - Use test -x instead of -f - Don't add group nogroup to user nobody, as many daemons misuse 'nogroup' as own group - Add system account and groups for kvm, qemu, and libvirt (jsc#SLE-11629) New files: system-group-kvm.conf, system-group-libvirt.conf, system-user-qemu.conf - Add qemu user to kvm group - Remove kvm group from hardware subpackage, since kvm is in its own subpackage (jsc#SLE-11629). - Add default hardware group for 'sgx' enclave access Since udev v248, a default rule for /dev/sgx_enclave is provided to give rw access to the new group hopefully making 'sgx' the standard group name for such devices. [bsc#1190572] - system-user-tss.conf: Remove group entry, not needed and did contain syntax errors (bsc#1190401). - Buildrequire the updated sysuser-tools which supports busybox-adduser as well - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Initial revision - Introduce "upstream" branding sub-package Installing this branding sub-package is supposed to restore upstream defaults by uninstalling all custom drop-ins installed by other branding sub-packages. - Import 0.2 cc4e951 timesyncd: add default ntp servers for SUSE and openSUSE distros - Import 0.3 d299248 List drop-in directories in SUSE.list exclusively e4651a7 Disable memory accounting by default for all distros (jsc#PM-2229 jsc#PM-2230) - Make sure the release number between the main and the branding packages match - Import 0.4 a97bb54 Makefile: don't generate the rpm file lists anymore 5473da6 Makefile: introduce 'archive' target - Import 0.5 0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125) cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374) 7e332a6 Add a header in all each drop-ins 465e1c7 Makefile: simplify 'archive' target - Issue a daemon-reload in %post of the main package - Fix typo introduced by the previous change (bsc#1179183) - Import 0.6 d3fab7c Introduce SLE-Micro branding - Import 0.7 2a61f77 Convert our configuration file dropins into 'early' ones - Import commit 6b8dde1d4f867aff713af6d6830510a84fad58d2 6b8dde1 Convert more drop-ins into early ones - Import 0.8 f34372f User priority '26' for SLE-Micro c8b6f0a Revert "Convert more drop-ins into early ones" - The usage of drop-ins is now the official way for configuring systemd and its various daemons on Factory/ALP. Hence the early drop-ins SUSE specific "feature" has been abandoned. - Import 0.9 bb859bf user@.service: Disable controllers by default (jsc#PED-2276) - Import 0.10 5088997 SLE: Disable pids controller limit under user instances (jsc#SLE-10123) - Initial revision - Introduce "upstream" branding sub-package Installing this branding sub-package is supposed to restore upstream defaults by uninstalling all custom drop-ins installed by other branding sub-packages. - Import 0.2 cc4e951 timesyncd: add default ntp servers for SUSE and openSUSE distros - Import 0.3 d299248 List drop-in directories in SUSE.list exclusively e4651a7 Disable memory accounting by default for all distros (jsc#PM-2229 jsc#PM-2230) - Make sure the release number between the main and the branding packages match - Import 0.4 a97bb54 Makefile: don't generate the rpm file lists anymore 5473da6 Makefile: introduce 'archive' target - Import 0.5 0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125) cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374) 7e332a6 Add a header in all each drop-ins 465e1c7 Makefile: simplify 'archive' target - Issue a daemon-reload in %post of the main package - Fix typo introduced by the previous change (bsc#1179183) - Import 0.6 d3fab7c Introduce SLE-Micro branding - Import 0.7 2a61f77 Convert our configuration file dropins into 'early' ones - Import commit 6b8dde1d4f867aff713af6d6830510a84fad58d2 6b8dde1 Convert more drop-ins into early ones - Import 0.8 f34372f User priority '26' for SLE-Micro c8b6f0a Revert "Convert more drop-ins into early ones" - The usage of drop-ins is now the official way for configuring systemd and its various daemons on Factory/ALP. Hence the early drop-ins SUSE specific "feature" has been abandoned. - Import 0.9 bb859bf user@.service: Disable controllers by default (jsc#PED-2276) - Import 0.10 5088997 SLE: Disable pids controller limit under user instances (jsc#SLE-10123) - Initial revision - Introduce "upstream" branding sub-package Installing this branding sub-package is supposed to restore upstream defaults by uninstalling all custom drop-ins installed by other branding sub-packages. - Import 0.2 cc4e951 timesyncd: add default ntp servers for SUSE and openSUSE distros - Import 0.3 d299248 List drop-in directories in SUSE.list exclusively e4651a7 Disable memory accounting by default for all distros (jsc#PM-2229 jsc#PM-2230) - Make sure the release number between the main and the branding packages match - Import 0.4 a97bb54 Makefile: don't generate the rpm file lists anymore 5473da6 Makefile: introduce 'archive' target - Import 0.5 0c5e241 SLE: turn off RemoveIPC by default for logind (fate#320125) cb6914f SLE: restore ProtectHostname=no for udevd (bsc#1178374) 7e332a6 Add a header in all each drop-ins 465e1c7 Makefile: simplify 'archive' target - Issue a daemon-reload in %post of the main package - Fix typo introduced by the previous change (bsc#1179183) - Import 0.6 d3fab7c Introduce SLE-Micro branding - Import 0.7 2a61f77 Convert our configuration file dropins into 'early' ones - Import commit 6b8dde1d4f867aff713af6d6830510a84fad58d2 6b8dde1 Convert more drop-ins into early ones - Import 0.8 f34372f User priority '26' for SLE-Micro c8b6f0a Revert "Convert more drop-ins into early ones" - The usage of drop-ins is now the official way for configuring systemd and its various daemons on Factory/ALP. Hence the early drop-ins SUSE specific "feature" has been abandoned. - Import 0.9 bb859bf user@.service: Disable controllers by default (jsc#PED-2276) - Import 0.10 5088997 SLE: Disable pids controller limit under user instances (jsc#SLE-10123) - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - initial version based on openSUSE MicroOS - enable the sshd service by default - enable wicked.service (jsc#SMO-8) - enable transactional-update-cleanup.timer (required by transactional-update 4.0.0) - disable the AppArmor systemd service (bsc#1197368) - enable NetworiManager by default (jsc#SMO-84) - preserve wicked enabled during upgrade if it was enabled before (NM is default only for new installs) (bsc#1228522) - initial version based on openSUSE MicroOS - enable the sshd service by default - enable wicked.service (jsc#SMO-8) - enable transactional-update-cleanup.timer (required by transactional-update 4.0.0) - disable the AppArmor systemd service (bsc#1197368) - enable NetworiManager by default (jsc#SMO-84) - preserve wicked enabled during upgrade if it was enabled before (NM is default only for new installs) (bsc#1228522) - Enable dnf-makecache.timer - Enable btrfsmaintenance-refresh.path and disable btrfsmaintenance-refresh.service to avoid needless refresh on boot (boo#1165780) - Enable user services pipewire.socket and pipewire-pulse.socket (boo#1183012). - Enable user service pipewire-media-session.service (used with pipewire >= 0.3.23). - Enable hcn-init.service for HNV on POWER (bsc#1184136 ltc#192155). - When installing the systemd-presets-common-SUSE package for the first time in a new system, it might happen that some services are installed before systemd so the %systemd_pre/post macros would not work. This is handled by enabling all preset services in this package's %posttrans section but it wasn't enabling user services, just system services. Now it enables also the user services installed before this package, thus fixing boo#1186561 - To make update of package man work with its new upstream timer and service units both called man-db enable also man-db.timer - Haveged as a daemon is no longer required since kernel 5.6 do not enable by default. - Replace the pipewire-media-session preset with a wireplumber user service preset to enable it by default (bsc#1200485). - enable vgauthd service for VMWare by default (bsc#1195251) - Enable appstream-sync-cache.service by default(bsc#1197684). - enable ignition-delete-config by default (bsc#1199524) - Modify branding-preset-states to fix systemd-presets-common-SUSE not enabling new user systemd service preset configuration just as it handles system service presets. By passing an (optional) second parameter "user", the save/apply-changes commands now work with user services instead of system ones (boo#1200485) - enable user side autostart of drkonqi socket (bsc#1203493). - Enable systemd-pstore.service by default (jsc#PED-2663) - Enable spice-vdagent.service and xdg-user-dirs.service by default (boo#1201728) - Add wtmpdb-update-boot.service and wtmpdb-rotate.timer to enable wtmpdb as Y2038 safe wtmp replacement - Don't call systemctl list-unit-files with an empty argument, this will break enabling of system unit files [bsc#1212496] - Fix another case of systemctl being called with an empty argument. This if a preemptive fix for a similar issue to bsc#1212496. - Split hcn-init.service to hcn-init-NetworkManager and hcn-init-wicked (bsc#1200731 ltc#198485 https://github.com/ibm-power-utilities/powerpc-utils/pull/84) Support both the old and new service to avoid complex version interdependency. - Enable dnf-makecache.timer - Enable btrfsmaintenance-refresh.path and disable btrfsmaintenance-refresh.service to avoid needless refresh on boot (boo#1165780) - Enable user services pipewire.socket and pipewire-pulse.socket (boo#1183012). - Enable user service pipewire-media-session.service (used with pipewire >= 0.3.23). - Enable hcn-init.service for HNV on POWER (bsc#1184136 ltc#192155). - When installing the systemd-presets-common-SUSE package for the first time in a new system, it might happen that some services are installed before systemd so the %systemd_pre/post macros would not work. This is handled by enabling all preset services in this package's %posttrans section but it wasn't enabling user services, just system services. Now it enables also the user services installed before this package, thus fixing boo#1186561 - To make update of package man work with its new upstream timer and service units both called man-db enable also man-db.timer - Haveged as a daemon is no longer required since kernel 5.6 do not enable by default. - Replace the pipewire-media-session preset with a wireplumber user service preset to enable it by default (bsc#1200485). - enable vgauthd service for VMWare by default (bsc#1195251) - Enable appstream-sync-cache.service by default(bsc#1197684). - enable ignition-delete-config by default (bsc#1199524) - Modify branding-preset-states to fix systemd-presets-common-SUSE not enabling new user systemd service preset configuration just as it handles system service presets. By passing an (optional) second parameter "user", the save/apply-changes commands now work with user services instead of system ones (boo#1200485) - enable user side autostart of drkonqi socket (bsc#1203493). - Enable systemd-pstore.service by default (jsc#PED-2663) - Enable spice-vdagent.service and xdg-user-dirs.service by default (boo#1201728) - Add wtmpdb-update-boot.service and wtmpdb-rotate.timer to enable wtmpdb as Y2038 safe wtmp replacement - Don't call systemctl list-unit-files with an empty argument, this will break enabling of system unit files [bsc#1212496] - Fix another case of systemctl being called with an empty argument. This if a preemptive fix for a similar issue to bsc#1212496. - Split hcn-init.service to hcn-init-NetworkManager and hcn-init-wicked (bsc#1200731 ltc#198485 https://github.com/ibm-power-utilities/powerpc-utils/pull/84) Support both the old and new service to avoid complex version interdependency. - Add a %systemd_user_pre macro (boo#1183051, boo#1183012) It creates a /run/systemd/rpm/needs-user-preset/$service file for each new service being installed so %systemd_user_post can call `systemctl --global preset $service` properly for newly installed user services (even when it's introduced via a package update). - Don't pass -f to rm to make sure that rm failures will be logged But also make sure to not abort the scriptlet prematurely if rm fails. - Remove confusing --user before --global in %systemd_user_preun It's actually a backport of upstream commit 28d36da64a7a23a55e8d0a139f2620384fd058b3 - Update a few comments - Bump to version 7 - %sysusers_create_inline: use here-docs instead of echo (bsc#1186282) Upstream commit dd2490ae12ad1e1795ecbf8f8944b950da9c8d06. - Introduce %sysusers_create_package %sysusers_create and %sysusers_create_inline are now deprecated and the new macro should be used instead. Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba. - Make use of "Suggests:" in %systemd_ordering Until libzypp supports "OrderWithRequires:", we need to specify a similar ordering constraint that can be understood by the dep solver as well. Hence the use of "Suggests:" in %systemd_ordering (workaround for bsc#1187332). - Bump to version 8 - Introduce %_systemd_util_dir It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82. - Bump version to 9 - %sysusers_create_inline was wrongly marked as deprecated - %sysusers_create can be useful in certain cases and won't go away until we'll move to file triggers. So don't mark it as deprecated too - Bump version to 10 - Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406) Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d... - Bump version to 11 - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not present as it's expected (bsc#1208079). - Bump version to 12 - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from a chroot (bsc#1211272) - Bump version to 13 - Switch to `systemd-hwdb` tool when updating the HW database. It's been introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`. - Bump version to 14 - Add a %systemd_user_pre macro (boo#1183051, boo#1183012) It creates a /run/systemd/rpm/needs-user-preset/$service file for each new service being installed so %systemd_user_post can call `systemctl --global preset $service` properly for newly installed user services (even when it's introduced via a package update). - Don't pass -f to rm to make sure that rm failures will be logged But also make sure to not abort the scriptlet prematurely if rm fails. - Remove confusing --user before --global in %systemd_user_preun It's actually a backport of upstream commit 28d36da64a7a23a55e8d0a139f2620384fd058b3 - Update a few comments - Bump to version 7 - %sysusers_create_inline: use here-docs instead of echo (bsc#1186282) Upstream commit dd2490ae12ad1e1795ecbf8f8944b950da9c8d06. - Introduce %sysusers_create_package %sysusers_create and %sysusers_create_inline are now deprecated and the new macro should be used instead. Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba. - Make use of "Suggests:" in %systemd_ordering Until libzypp supports "OrderWithRequires:", we need to specify a similar ordering constraint that can be understood by the dep solver as well. Hence the use of "Suggests:" in %systemd_ordering (workaround for bsc#1187332). - Bump to version 8 - Introduce %_systemd_util_dir It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82. - Bump version to 9 - %sysusers_create_inline was wrongly marked as deprecated - %sysusers_create can be useful in certain cases and won't go away until we'll move to file triggers. So don't mark it as deprecated too - Bump version to 10 - Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406) Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d... - Bump version to 11 - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not present as it's expected (bsc#1208079). - Bump version to 12 - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from a chroot (bsc#1211272) - Bump version to 13 - Switch to `systemd-hwdb` tool when updating the HW database. It's been introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`. - Bump version to 14 - Remove confusing --user before --global in %systemd_user_preun It's actually a backport of upstream commit 28d36da64a7a23a55e8d0a139f2620384fd058b3 - Update a few comments - Bump to version 7 - %sysusers_create_inline: use here-docs instead of echo (bsc#1186282) Upstream commit dd2490ae12ad1e1795ecbf8f8944b950da9c8d06. - Introduce %sysusers_create_package %sysusers_create and %sysusers_create_inline are now deprecated and the new macro should be used instead. Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba. - Make use of "Suggests:" in %systemd_ordering Until libzypp supports "OrderWithRequires:", we need to specify a similar ordering constraint that can be understood by the dep solver as well. Hence the use of "Suggests:" in %systemd_ordering (workaround for bsc#1187332). - Bump to version 8 - Introduce %_systemd_util_dir It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82. - Bump version to 9 - %sysusers_create_inline was wrongly marked as deprecated - %sysusers_create can be useful in certain cases and won't go away until we'll move to file triggers. So don't mark it as deprecated too - Bump version to 10 - Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406) Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d... - Bump version to 11 - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not present as it's expected (bsc#1208079). - Bump version to 12 - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from a chroot (bsc#1211272) - Bump version to 13 - Switch to `systemd-hwdb` tool when updating the HW database. It's been introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`. - Bump version to 14 - Order packages that requires systemd after systemd-sysvcompat when this part of the transaction (bsc#1217964) systemd-sysvcompat has been introduced recently and contains the compatibility scripts used to support SysV init scripts. Make sure that the packages ordered after systemd are also ordered after systemd-sysvcompat so theirs rpm scriptlets can still rely on the compat scripts. On distributions where systemd-sysvcompat doesn't exist, the new ordering constraint should be a nop. - Bump version to 15 - Remove confusing --user before --global in %systemd_user_preun It's actually a backport of upstream commit 28d36da64a7a23a55e8d0a139f2620384fd058b3 - Update a few comments - Bump to version 7 - %sysusers_create_inline: use here-docs instead of echo (bsc#1186282) Upstream commit dd2490ae12ad1e1795ecbf8f8944b950da9c8d06. - Introduce %sysusers_create_package %sysusers_create and %sysusers_create_inline are now deprecated and the new macro should be used instead. Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba. - Make use of "Suggests:" in %systemd_ordering Until libzypp supports "OrderWithRequires:", we need to specify a similar ordering constraint that can be understood by the dep solver as well. Hence the use of "Suggests:" in %systemd_ordering (workaround for bsc#1187332). - Bump to version 8 - Introduce %_systemd_util_dir It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82. - Bump version to 9 - %sysusers_create_inline was wrongly marked as deprecated - %sysusers_create can be useful in certain cases and won't go away until we'll move to file triggers. So don't mark it as deprecated too - Bump version to 10 - Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406) Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d... - Bump version to 11 - Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not present as it's expected (bsc#1208079). - Bump version to 12 - Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from a chroot (bsc#1211272) - Bump version to 13 - Switch to `systemd-hwdb` tool when updating the HW database. It's been introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`. - Bump version to 14 - Order packages that requires systemd after systemd-sysvcompat when this part of the transaction (bsc#1217964) systemd-sysvcompat has been introduced recently and contains the compatibility scripts used to support SysV init scripts. Make sure that the packages ordered after systemd are also ordered after systemd-sysvcompat so theirs rpm scriptlets can still rely on the compat scripts. On distributions where systemd-sysvcompat doesn't exist, the new ordering constraint should be a nop. - Bump version to 15 - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - add tar-1.30-tests-difflink.patch to fix difflink.at test (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html) - Use %license instead of %doc [bsc#1082318] - add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and dirrem02 tests that were passing/failing randomly because of that - run spec-cleaner - renumber patches - update to version 1.31 * Fix heap-buffer-overrun with --one-top-level, bug introduced with the addition of that option in 1.28 * Support for zstd compression * New option '--zstd' instructs tar to use zstd as compression program. When listing, extractng and comparing, zstd compressed archives are recognized automatically. When '-a' option is in effect, zstd compression is selected if the destination archive name ends in '.zst' or '.tzst'. * The -K option interacts properly with member names given in the command line. Names of members to extract can be specified along with the "-K NAME" option. In this case, tar will extract NAME and those of named members that appear in the archive after it, which is consistent with the semantics of the option. Previous versions of tar extracted NAME, those of named members that appeared before it, and everything after it. * Fix CVE-2018-20482 - When creating archives with the --sparse option, previous versions of tar would loop endlessly if a sparse file had been truncated while being archived. - remove the following patches (upstreamed) * tar-1.30-tests-difflink.patch * tar-1.30-tests_dirrem_race.patch - refresh add_readme-tests.patch - add tar-1.31-tests_dirrem.patch to fix expected output in dirrem tests - add tar-1.31-racy_compress_tests.patch to fix compression tests - Remove libattr-devel from buildrequires, tar no longer uses it but finds xattr functions in libc. - update to version 1.32 * Fix the use of --checkpoint without explicit --checkpoint-action * Fix extraction with the -U option * Fix iconv usage on BSD-based systems * Fix possible NULL dereference (savannah bug #55369) [bsc#1130496] [CVE-2019-9923] * Improve the testsuite - remove tar-1.31-tests_dirrem.patch and tar-1.31-racy_compress_tests.patch that are no longer needed (applied usptream) - No longer recommend -lang: supplements are in use. - Drop Requires(pre) info in the preamble: the main package does not contain any info files, and has not even a pre script. The - doc subpackage already has the correct deps. - prepare usrmerge (boo#1029961) - GNU tar 1.33: * POSIX extended format headers do not include PID by default * --delay-directory-restore works for archives with reversed member ordering * Fix extraction of a symbolic link hardlinked to another symbolic link * Wildcards in exclude-vcs-ignore mode don't match slash * Fix the --no-overwrite-dir option * Fix handling of chained renames in incremental backups * Link counting works for file names supplied with -T * Accept only position-sensitive (file-selection) options in file list files - remove deprecated texinfo packaging macros - GNU tar 1.34: * Fix extraction over pipe * Fix memory leak in read_header * Fix extraction when . and .. are unreadable * Gracefully handle duplicate symlinks when extracting * Re-initialize supplementary groups when switching to user privileges - Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable (bsc#1184124). + tar-PIE.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: * bsc#1181131, CVE-2021-20193 * bsc#1120610 - tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test 'tests/time01.at' on platforms with 32-bit time_t for now. - tar.spec: Reference it. (%check): Output the testsuite.log in case the testsuite failed. - Fix race condition while creating intermediate subdirectories, bsc#1200657 * bsc1200657.patch - bsc1200657.patch was previously incomplete leading to deadlocks * bsc#1202436 * bsc1200657.patch updated - Fix unexpected inconsistency when making directory, bsc#1203600 * tar-avoid-overflow-in-symlinks-tests.patch * tar-fix-extract-unlink.patch - Update race condition fix, bsc#1200657 * tar-fix-race-condition.patch - Refresh bsc1200657.patch - Fix hang when unpacking test tarball, bsc#1202436 * bsc1202436.patch - Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump (CVE-2022-48303, bsc#1207753) * fix-CVE-2022-48303.patch - Fix hang when unpacking test tarball, bsc#1202436 * remove bsc1202436.patch * bsc1202436-1.patch * bsc1202436-1.patch - Fix CVE-2023-39804, Incorrectly handled extension attributes in PAX archives can lead to a crash, bsc#1217969 * fix-CVE-2023-39804.patch - add tar-1.30-tests-difflink.patch to fix difflink.at test (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html) - Use %license instead of %doc [bsc#1082318] - add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and dirrem02 tests that were passing/failing randomly because of that - run spec-cleaner - renumber patches - update to version 1.31 * Fix heap-buffer-overrun with --one-top-level, bug introduced with the addition of that option in 1.28 * Support for zstd compression * New option '--zstd' instructs tar to use zstd as compression program. When listing, extractng and comparing, zstd compressed archives are recognized automatically. When '-a' option is in effect, zstd compression is selected if the destination archive name ends in '.zst' or '.tzst'. * The -K option interacts properly with member names given in the command line. Names of members to extract can be specified along with the "-K NAME" option. In this case, tar will extract NAME and those of named members that appear in the archive after it, which is consistent with the semantics of the option. Previous versions of tar extracted NAME, those of named members that appeared before it, and everything after it. * Fix CVE-2018-20482 - When creating archives with the --sparse option, previous versions of tar would loop endlessly if a sparse file had been truncated while being archived. - remove the following patches (upstreamed) * tar-1.30-tests-difflink.patch * tar-1.30-tests_dirrem_race.patch - refresh add_readme-tests.patch - add tar-1.31-tests_dirrem.patch to fix expected output in dirrem tests - add tar-1.31-racy_compress_tests.patch to fix compression tests - Remove libattr-devel from buildrequires, tar no longer uses it but finds xattr functions in libc. - update to version 1.32 * Fix the use of --checkpoint without explicit --checkpoint-action * Fix extraction with the -U option * Fix iconv usage on BSD-based systems * Fix possible NULL dereference (savannah bug #55369) [bsc#1130496] [CVE-2019-9923] * Improve the testsuite - remove tar-1.31-tests_dirrem.patch and tar-1.31-racy_compress_tests.patch that are no longer needed (applied usptream) - No longer recommend -lang: supplements are in use. - Drop Requires(pre) info in the preamble: the main package does not contain any info files, and has not even a pre script. The - doc subpackage already has the correct deps. - prepare usrmerge (boo#1029961) - GNU tar 1.33: * POSIX extended format headers do not include PID by default * --delay-directory-restore works for archives with reversed member ordering * Fix extraction of a symbolic link hardlinked to another symbolic link * Wildcards in exclude-vcs-ignore mode don't match slash * Fix the --no-overwrite-dir option * Fix handling of chained renames in incremental backups * Link counting works for file names supplied with -T * Accept only position-sensitive (file-selection) options in file list files - remove deprecated texinfo packaging macros - GNU tar 1.34: * Fix extraction over pipe * Fix memory leak in read_header * Fix extraction when . and .. are unreadable * Gracefully handle duplicate symlinks when extracting * Re-initialize supplementary groups when switching to user privileges - Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable (bsc#1184124). + tar-PIE.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: * bsc#1181131, CVE-2021-20193 * bsc#1120610 - tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test 'tests/time01.at' on platforms with 32-bit time_t for now. - tar.spec: Reference it. (%check): Output the testsuite.log in case the testsuite failed. - Fix race condition while creating intermediate subdirectories, bsc#1200657 * bsc1200657.patch - bsc1200657.patch was previously incomplete leading to deadlocks * bsc#1202436 * bsc1200657.patch updated - Fix unexpected inconsistency when making directory, bsc#1203600 * tar-avoid-overflow-in-symlinks-tests.patch * tar-fix-extract-unlink.patch - Update race condition fix, bsc#1200657 * tar-fix-race-condition.patch - Refresh bsc1200657.patch - Fix hang when unpacking test tarball, bsc#1202436 * bsc1202436.patch - Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump (CVE-2022-48303, bsc#1207753) * fix-CVE-2022-48303.patch - Fix hang when unpacking test tarball, bsc#1202436 * remove bsc1202436.patch * bsc1202436-1.patch * bsc1202436-1.patch - Fix CVE-2023-39804, Incorrectly handled extension attributes in PAX archives can lead to a crash, bsc#1217969 * fix-CVE-2023-39804.patch - add tar-1.30-tests-difflink.patch to fix difflink.at test (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html) - Use %license instead of %doc [bsc#1082318] - add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and dirrem02 tests that were passing/failing randomly because of that - run spec-cleaner - renumber patches - update to version 1.31 * Fix heap-buffer-overrun with --one-top-level, bug introduced with the addition of that option in 1.28 * Support for zstd compression * New option '--zstd' instructs tar to use zstd as compression program. When listing, extractng and comparing, zstd compressed archives are recognized automatically. When '-a' option is in effect, zstd compression is selected if the destination archive name ends in '.zst' or '.tzst'. * The -K option interacts properly with member names given in the command line. Names of members to extract can be specified along with the "-K NAME" option. In this case, tar will extract NAME and those of named members that appear in the archive after it, which is consistent with the semantics of the option. Previous versions of tar extracted NAME, those of named members that appeared before it, and everything after it. * Fix CVE-2018-20482 - When creating archives with the --sparse option, previous versions of tar would loop endlessly if a sparse file had been truncated while being archived. - remove the following patches (upstreamed) * tar-1.30-tests-difflink.patch * tar-1.30-tests_dirrem_race.patch - refresh add_readme-tests.patch - add tar-1.31-tests_dirrem.patch to fix expected output in dirrem tests - add tar-1.31-racy_compress_tests.patch to fix compression tests - Remove libattr-devel from buildrequires, tar no longer uses it but finds xattr functions in libc. - update to version 1.32 * Fix the use of --checkpoint without explicit --checkpoint-action * Fix extraction with the -U option * Fix iconv usage on BSD-based systems * Fix possible NULL dereference (savannah bug #55369) [bsc#1130496] [CVE-2019-9923] * Improve the testsuite - remove tar-1.31-tests_dirrem.patch and tar-1.31-racy_compress_tests.patch that are no longer needed (applied usptream) - No longer recommend -lang: supplements are in use. - Drop Requires(pre) info in the preamble: the main package does not contain any info files, and has not even a pre script. The - doc subpackage already has the correct deps. - prepare usrmerge (boo#1029961) - GNU tar 1.33: * POSIX extended format headers do not include PID by default * --delay-directory-restore works for archives with reversed member ordering * Fix extraction of a symbolic link hardlinked to another symbolic link * Wildcards in exclude-vcs-ignore mode don't match slash * Fix the --no-overwrite-dir option * Fix handling of chained renames in incremental backups * Link counting works for file names supplied with -T * Accept only position-sensitive (file-selection) options in file list files - remove deprecated texinfo packaging macros - GNU tar 1.34: * Fix extraction over pipe * Fix memory leak in read_header * Fix extraction when . and .. are unreadable * Gracefully handle duplicate symlinks when extracting * Re-initialize supplementary groups when switching to user privileges - Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable (bsc#1184124). + tar-PIE.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: * bsc#1181131, CVE-2021-20193 * bsc#1120610 - tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test 'tests/time01.at' on platforms with 32-bit time_t for now. - tar.spec: Reference it. (%check): Output the testsuite.log in case the testsuite failed. - Fix race condition while creating intermediate subdirectories, bsc#1200657 * bsc1200657.patch - bsc1200657.patch was previously incomplete leading to deadlocks * bsc#1202436 * bsc1200657.patch updated - Fix unexpected inconsistency when making directory, bsc#1203600 * tar-avoid-overflow-in-symlinks-tests.patch * tar-fix-extract-unlink.patch - Update race condition fix, bsc#1200657 * tar-fix-race-condition.patch - Refresh bsc1200657.patch - Fix hang when unpacking test tarball, bsc#1202436 * bsc1202436.patch - Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump (CVE-2022-48303, bsc#1207753) * fix-CVE-2022-48303.patch - Fix hang when unpacking test tarball, bsc#1202436 * remove bsc1202436.patch * bsc1202436-1.patch * bsc1202436-1.patch - Fix CVE-2023-39804, Incorrectly handled extension attributes in PAX archives can lead to a crash, bsc#1217969 * fix-CVE-2023-39804.patch - add tar-1.30-tests-difflink.patch to fix difflink.at test (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html) - Use %license instead of %doc [bsc#1082318] - add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and dirrem02 tests that were passing/failing randomly because of that - run spec-cleaner - renumber patches - update to version 1.31 * Fix heap-buffer-overrun with --one-top-level, bug introduced with the addition of that option in 1.28 * Support for zstd compression * New option '--zstd' instructs tar to use zstd as compression program. When listing, extractng and comparing, zstd compressed archives are recognized automatically. When '-a' option is in effect, zstd compression is selected if the destination archive name ends in '.zst' or '.tzst'. * The -K option interacts properly with member names given in the command line. Names of members to extract can be specified along with the "-K NAME" option. In this case, tar will extract NAME and those of named members that appear in the archive after it, which is consistent with the semantics of the option. Previous versions of tar extracted NAME, those of named members that appeared before it, and everything after it. * Fix CVE-2018-20482 - When creating archives with the --sparse option, previous versions of tar would loop endlessly if a sparse file had been truncated while being archived. - remove the following patches (upstreamed) * tar-1.30-tests-difflink.patch * tar-1.30-tests_dirrem_race.patch - refresh add_readme-tests.patch - add tar-1.31-tests_dirrem.patch to fix expected output in dirrem tests - add tar-1.31-racy_compress_tests.patch to fix compression tests - Remove libattr-devel from buildrequires, tar no longer uses it but finds xattr functions in libc. - update to version 1.32 * Fix the use of --checkpoint without explicit --checkpoint-action * Fix extraction with the -U option * Fix iconv usage on BSD-based systems * Fix possible NULL dereference (savannah bug #55369) [bsc#1130496] [CVE-2019-9923] * Improve the testsuite - remove tar-1.31-tests_dirrem.patch and tar-1.31-racy_compress_tests.patch that are no longer needed (applied usptream) - No longer recommend -lang: supplements are in use. - Drop Requires(pre) info in the preamble: the main package does not contain any info files, and has not even a pre script. The - doc subpackage already has the correct deps. - prepare usrmerge (boo#1029961) - GNU tar 1.33: * POSIX extended format headers do not include PID by default * --delay-directory-restore works for archives with reversed member ordering * Fix extraction of a symbolic link hardlinked to another symbolic link * Wildcards in exclude-vcs-ignore mode don't match slash * Fix the --no-overwrite-dir option * Fix handling of chained renames in incremental backups * Link counting works for file names supplied with -T * Accept only position-sensitive (file-selection) options in file list files - remove deprecated texinfo packaging macros - GNU tar 1.34: * Fix extraction over pipe * Fix memory leak in read_header * Fix extraction when . and .. are unreadable * Gracefully handle duplicate symlinks when extracting * Re-initialize supplementary groups when switching to user privileges - Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable (bsc#1184124). + tar-PIE.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: * bsc#1181131, CVE-2021-20193 * bsc#1120610 - tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test 'tests/time01.at' on platforms with 32-bit time_t for now. - tar.spec: Reference it. (%check): Output the testsuite.log in case the testsuite failed. - Fix race condition while creating intermediate subdirectories, bsc#1200657 * bsc1200657.patch - bsc1200657.patch was previously incomplete leading to deadlocks * bsc#1202436 * bsc1200657.patch updated - Fix unexpected inconsistency when making directory, bsc#1203600 * tar-avoid-overflow-in-symlinks-tests.patch * tar-fix-extract-unlink.patch - Update race condition fix, bsc#1200657 * tar-fix-race-condition.patch - Refresh bsc1200657.patch - Fix hang when unpacking test tarball, bsc#1202436 * bsc1202436.patch - Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump (CVE-2022-48303, bsc#1207753) * fix-CVE-2022-48303.patch - Fix hang when unpacking test tarball, bsc#1202436 * remove bsc1202436.patch * bsc1202436-1.patch * bsc1202436-1.patch - Fix CVE-2023-39804, Incorrectly handled extension attributes in PAX archives can lead to a crash, bsc#1217969 * fix-CVE-2023-39804.patch - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Correct include path for wide chraracter header files for ABI 6.1 - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180129 + update "VERSION" file, used in shared-library naming. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - Add ncurses patch 6.1-20180203 + minor fixes to test/*.h to make them idempotent. + add/use test/parse_rgb.h to show how the "RGB" capability works. + add a clarification in user_caps.5 regarding "RGB" capability. + add extended_slk_color{,_sp} symbols to the appropriate package/*.{map,sym} files (report by Sven Joachim, cf: 20170401). - Add ncurses patch 6.1-20180210 + modify misc/Makefile.in to install/uninstall explicit list in case the build-directory happens to have no ".pc" files when an uninstall is performed (report by Jeffrey Walton). + deprecate safe-sprintf, since the vsnprintf function, which does what was needed, was standardized long ago. + add several development/experimental options to development packages. + minor reordering of options in configure script to make the threaded and reentrant options distinct from the other extensions which are normally enabled. - Make reentrant libs opaque - Add ncurses patch 6.1-20180217 + remove incorrect free() from 20170617 changes (report by David Macek). + correct type for "U8" in user_caps.5; it is a number not boolean. + add a null-pointer check in safe_sprintf.c (report by Steven Noonan). + improve fix for Debian #882620 by reusing limit2 variable (report Julien Cristau, Sven Joachim). - Add ncurses patch 6.1-20180224 + modify _nc_resolve_uses2() to detect incompatible types when merging a "use=" clause of extended capabilities. The problem was seen in a defective terminfo integrated from simpleterm sources in 20171111, compounded by repair in 20180121. + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD + fix remaining flash capabilities with trailing mandatory delays -TD + correct cut/paste in NEWS (report by Sven Joachim). - Add patch ncurses-6.1-weakpthreads.dif + Be aware that libtinfo/libtinfw is also used without libpthread (boo#1058509) - Use expect to run at least two test for normal and wide character version of newdemo from test suite - Switch back to shared libtinfo only but provide an auxiliary shared library libtinfow to avoid a rebuild of third party programs (bsc#1082772) + Add sanity check if new 32bit API is included in libtinfo - Add ncurses patch 6.1-20180303 + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to avoid expansion of "CUR" in trace. + improve a few lintian warnings in test-packages. + modify lib_setup to avoid calling pthread_self() without first verifying that the address is valid, i.e., for weak symbols (report/patch by Werner Fink). + modify generated terminfo.5 to not use "expand" and related width on the last column of tables, making layout on wide terminals look better (adapted from patch by Kir Kolyshkin). + add a category to report_offsets, e.g., "w" for wide-character, "t" for threads to make the report more readable. Reorganized the structures reported to make the categories more apparent. + simplify some ifdef's for extended-colors. + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show how similar the different tinfo configurations are. - Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772) - Make expect build check less fragile on timing - Avoid opaque libraries for Leap 15 and SLES 15 - No tests on Leap 15 and SLES 15 - Add ncurses patch 6.1-20180317 + fix a check in infotocap which may not have detected a problem when it should have. + add a check in tic for the case where setf/setb are given using different strings, but provide identical results to setaf/setab. + further improve fix for terminfo.5 (patch by Kir Kolyshkin). + reorder loop-limit checks in winsnstr() in case the string has no terminating null and only the number of characters is used (patch by Gyorgy Jeney). - Change baselibs.conf to avoid mixed version requirements (bsc#1082744) - Add patch ncurses-5.9-bsc1115929.patch * For bug bsc#1115929 port back null pointer checks to catch e.g. the crash in _nc_parse_entry(), belongs to CVE-2018-19211 - Remove screen.xterm from terminfo data base (boo#1103320) as with this screen uses fallback TERM=screen - Add patches CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c - Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for CVE-2021-39537: ncurses: heap-based buffer overflow in _nc_captoinfo in captoinfo.c - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read - Modify patch ncurses-6.1.dif * Secure writing terminfo entries by setfs[gu]id in s[gu]id (boo#1210434, CVE-2023-29491) * Reading is done since 2000/01/17 - Add patch boo1201384.patch * Do not fully reset serial lines - Add patch bsc1218014-cve-2023-50495.patch * Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry() (bsc#1218014) - Add patch ncurses-6.1-bsc1220061.patch (bsc#1220061, CVE-2023-45918) * Backport from ncurses-6.4-20230615.patch improve checks in convert_string() for corrupt terminfo entry - Add patch ncurses-6.1-boo1229028.patch (boo#1229028) * Allow that terminal description based on static fallback entries can be freed. - change ownership of /srv/tftpboot to tftp:tftp, otherwise tftp daemon can't write there (bnc#813226) - drop tftp-hpa-0.43_old-autoconf.diff not needed for any product still in active maintenance. - Use correct systemd macros in %pre, %post.. - config.h must be included *everywhere* (tftp-config_h.patch) - tftp.service: * This service needs to be started after network.target * Use PrivateDevices=yes - tftp-hpa-0.48-macros-crash.patch: prevent buffer overflow in handling of \x macro (bnc#793883) - tftp-hpa-0.48-macros-v6mapped.patch: for \i and \x, expand v6-mapped addresses as native IPv4 (bnc#793883) - patches come from Michal Kubecek - respond from the destination address taken from the first udp message's ancillary data (bnc#928283) * added tftp-multi-addresses.patch - add a sysconfig file to allow passing parameters to the service (requested in bsc#951591) * added tftp.sysconfig - Removed xinetd service - Changed permissions of /srv/tftpboot to be readable [bsc#940608] - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add tftp.socket requirement to the service unit section [bsc#1153625] - Allow enabling the service via `systemctl enable tftp` to create the tftp.socket symlink [bsc#1215520] - change ownership of /srv/tftpboot to tftp:tftp, otherwise tftp daemon can't write there (bnc#813226) - drop tftp-hpa-0.43_old-autoconf.diff not needed for any product still in active maintenance. - Use correct systemd macros in %pre, %post.. - config.h must be included *everywhere* (tftp-config_h.patch) - tftp.service: * This service needs to be started after network.target * Use PrivateDevices=yes - tftp-hpa-0.48-macros-crash.patch: prevent buffer overflow in handling of \x macro (bnc#793883) - tftp-hpa-0.48-macros-v6mapped.patch: for \i and \x, expand v6-mapped addresses as native IPv4 (bnc#793883) - patches come from Michal Kubecek - respond from the destination address taken from the first udp message's ancillary data (bnc#928283) * added tftp-multi-addresses.patch - add a sysconfig file to allow passing parameters to the service (requested in bsc#951591) * added tftp.sysconfig - Removed xinetd service - Changed permissions of /srv/tftpboot to be readable [bsc#940608] - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add tftp.socket requirement to the service unit section [bsc#1153625] - Allow enabling the service via `systemctl enable tftp` to create the tftp.socket symlink [bsc#1215520] - update to version 5.0 * Try to on platforms with getaddrinfo() without AI_ADDRCONFIG or AI_CANONNAME. * Implement the "rollover" option, for clients which want block number to rollover to anything other than zero. * Correctly disable PMTU in standalone mode. * Add IPv6 support. Patch by Karsten Keil. * Support systems with editline instead of readline. * Support long options in the server. - drop tftp-hpa-0.43_readline.diff (not needed) - drop tftp-hpa-0.46_libedit.patch (solved in upstream) - build with readline support - clean up specfile - fix spec o added missing path /srv/tftpboot in files section - update to version-5.1 - Add -P option to write a PID file. Patch by Ferenc Wagner. - Bounce the syslog socket in standalone mode, in case the syslog daemon has been restarted. Patch by Ferenc Wagner. - Build fixes. - Fix handling of block number wraparound after a successful options negotiation. - Fix a buffer overflow in option parsing. - fixes bnc#699714, CVE-2011-2199 - unbreak tftp by changing to user to run as in tftpd itself, not via xinetd (bnc#682340) - added missing PreReq: pwdutils - added rules for SuSEfirewall2 (bnc#729793) thanks to Lukas Ocilka - add autoconf as buildrequire to avoid implicit dependency - update to 5.2 - fixes a breakage with recent Linux kernel versions when a single interface has multiple IP addresses (bnc#774861) - Add systemd socket activation units. - Change inet-daemon to be recommended only, as we can now also activate by means of systemd sockets. - create capabilites provided by both tftp and atftp (bnc#801481 or bnc#725378) - change ownership of /srv/tftpboot to tftp:tftp, otherwise tftp daemon can't write there (bnc#813226) - drop tftp-hpa-0.43_old-autoconf.diff not needed for any product still in active maintenance. - Use correct systemd macros in %pre, %post.. - config.h must be included *everywhere* (tftp-config_h.patch) - tftp.service: * This service needs to be started after network.target * Use PrivateDevices=yes - tftp-hpa-0.48-macros-crash.patch: prevent buffer overflow in handling of \x macro (bnc#793883) - tftp-hpa-0.48-macros-v6mapped.patch: for \i and \x, expand v6-mapped addresses as native IPv4 (bnc#793883) - patches come from Michal Kubecek - respond from the destination address taken from the first udp message's ancillary data (bnc#928283) * added tftp-multi-addresses.patch - add a sysconfig file to allow passing parameters to the service (requested in bsc#951591) * added tftp.sysconfig - Removed xinetd service - Changed permissions of /srv/tftpboot to be readable [bsc#940608] - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add tftp.socket requirement to the service unit section [bsc#1153625] - Allow enabling the service via `systemctl enable tftp` to create the tftp.socket symlink [bsc#1215520] - change ownership of /srv/tftpboot to tftp:tftp, otherwise tftp daemon can't write there (bnc#813226) - drop tftp-hpa-0.43_old-autoconf.diff not needed for any product still in active maintenance. - Use correct systemd macros in %pre, %post.. - config.h must be included *everywhere* (tftp-config_h.patch) - tftp.service: * This service needs to be started after network.target * Use PrivateDevices=yes - tftp-hpa-0.48-macros-crash.patch: prevent buffer overflow in handling of \x macro (bnc#793883) - tftp-hpa-0.48-macros-v6mapped.patch: for \i and \x, expand v6-mapped addresses as native IPv4 (bnc#793883) - patches come from Michal Kubecek - respond from the destination address taken from the first udp message's ancillary data (bnc#928283) * added tftp-multi-addresses.patch - add a sysconfig file to allow passing parameters to the service (requested in bsc#951591) * added tftp.sysconfig - Removed xinetd service - Changed permissions of /srv/tftpboot to be readable [bsc#940608] - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Add tftp.socket requirement to the service unit section [bsc#1153625] - Allow enabling the service via `systemctl enable tftp` to create the tftp.socket symlink [bsc#1215520] - asan_build: build ASAN included - debug_build: build more suitable for debugging - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update * CVE-2018-18661 [bsc#1113672] + tiff-CVE-2018-18661.patch * CVE-2018-18557 [bsc#1113094] + tiff-CVE-2018-18557.patch * CVE-2018-12900 [bsc#1099257] + tiff-CVE-2018-12900.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update * CVE-2018-19210 [bsc#1115717] + tiff-CVE-2018-19210.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - extend tiff-CVE-2018-19210.patch and rename it to tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11] * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606] - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update * CVE-2019-6128 [bsc#1121626] + tiff-CVE-2019-6128.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update * CVE-2019-7663 [bsc#1125113] + tiff-CVE-2019-7663.patch - security update: Fix integer overflow in _TIFFCheckMalloc() * CVE-2019-14973 [bsc#1146608] + tiff-CVE-2019-14973.patch - security update: amend patch to fix test - modified patches % tiff-CVE-2019-14973.patch (refreshed) - security update: Fix buffer overwrite * CVE-2019-17546[bsc#1154365] + tiff-CVE-2019-17546.patch - security update: Fix heap based buffer overflow in pal2rgb * CVE-2017-17095[bsc#1071031] + tiff-CVE-2017-17095.patch - security update: Fix OOB in _TIFFmemcpy * CVE-2022-22844[bsc#1194539] + tiff-CVE-2022-22844.patch - security update: Fix memory allocation failure in tif_read.c * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809] + tiff-CVE-2020-35521,CVE-2020-35522.patch - security update: Fix DOS via invertImage() * CVE-2020-19131[bsc#1190312] + tiff-CVE-2020-19131.patch - security update: Fix heap-based buffer overflow in TIFF2PDF tool * CVE-2020-35524[bsc#1182812] + tiff-CVE-2020-35524.patch - security update: Fix integer overflow in tif_getimage * CVE-2020-35523 [bsc#1182811] + tiff-CVE-2020-35523.patch - security update * CVE-2022-1056 [bsc#1197631] * CVE-2022-0891 [bsc#1197068] + tiff-CVE-2022-1056,CVE-2022-0891.patch - security update * CVE-2022-0561 [bsc#1195964] + tiff-CVE-2022-0561.patch * CVE-2022-0562 [bsc#1195965] + tiff-CVE-2022-0562.patch * CVE-2022-0865 [bsc#1197066] + tiff-CVE-2022-0865.patch * CVE-2022-0909 [bsc#1197072] + tiff-CVE-2022-0909.patch * CVE-2022-0924 [bsc#1197073] + tiff-CVE-2022-0924.patch * CVE-2022-0908 [bsc#1197074] + tiff-CVE-2022-0908.patch - security update * CVE-2022-2056 [bsc#1201176] * CVE-2022-2057 [bsc#1201175] * CVE-2022-2058 [bsc#1201174] + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch - security update: * CVE-2022-34526 [bsc#1202026] + tiff-CVE-2022-34526.patch - CVE-2022-34266 [bsc#1201971] and [bsc#1201723]: Rename tiff-CVE-2022-0561.patch to tiff-CVE-2022-0561,CVE-2022-34266.patch This CVE is actually a duplicate. - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch * CVE-2022-2867 [bsc#1202466] * CVE-2022-2868 [bsc#1202467] * CVE-2022-2869 [bsc#1202468] + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch - security update: * CVE-2022-3597 [bsc#1204641] * CVE-2022-3626 [bsc#1204644] * CVE-2022-3627 [bsc#1204645] + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch * CVE-2022-3599 [bsc#1204643] + tiff-CVE-2022-3599.patch * CVE-2022-3970 [bsc#1205392] + tiff-CVE-2022-3970.patch - security update: * CVE-2022-3570 [bsc#1205422] * CVE-2022-3598 [bsc#1204642] + tiff-CVE-2022-3598,3570.patch - security update: * CVE-2022-48281 [bsc#1207413] + tiff-CVE-2022-48281.patch - security update: * CVE-2023-0795 [bsc#1208226] * CVE-2023-0796 [bsc#1208227] * CVE-2023-0797 [bsc#1208228] * CVE-2023-0798 [bsc#1208229] * CVE-2023-0799 [bsc#1208230] * CVE-2023-25433 [bsc#1212883] + tiff-CVE-2023-0795,CVE-2023-0796,CVE-2023-0797,CVE-2023-0798,CVE-2023-0799.patch * CVE-2023-0800 [bsc#1208231] * CVE-2023-0801 [bsc#1208232] * CVE-2023-0802 [bsc#1208233] * CVE-2023-0803 [bsc#1208234] * CVE-2023-0804 [bsc#1208236] + tiff-CVE-2023-0800,CVE-2023-0801,CVE-2023-0802,CVE-2023-0803,CVE-2023-0804.patch - security update: * CVE-2023-38289 [bsc#1213589] + tiff-CVE-2023-38289.patch * CVE-2023-38288 [bsc#1213590] + tiff-CVE-2023-38288.patch * CVE-2023-3576 [bsc#1213273] + tiff-CVE-2023-3576.patch * CVE-2020-18768 [bsc#1214574] + tiff-CVE-2020-18768.patch * CVE-2023-26966 [bsc#1212881] + tiff-CVE-2023-26966.patch * CVE-2023-3618 [bsc#1213274] + tiff-CVE-2023-3618.patch * CVE-2023-2908 [bsc#1212888] + tiff-CVE-2023-2908.patch * CVE-2023-3316 [bsc#1212535] + tiff-CVE-2023-3316.patch - security update: * CVE-2023-2731 [bsc#1211478] Fix null pointer deference in LZWDecode() This patch also contains a required commit which is marked to fix CVE-2022-1622 [bsc#1199483] but we are not vulnerable to that CVE because relevant code is not present. + tiff-CVE-2023-2731.patch * CVE-2023-26965 [bsc#1212398] Fix heap-based use after free in loadImage() + tiff-CVE-2023-26965.patch * CVE-2022-40090 [bsc#1214680] Fix infinite loop in TIFFReadDirectory() + tiff-CVE-2022-40090.patch * CVE-2023-1916 [bsc#1210231] Fix out-of-bounds read in extractImageSection() + tiff-CVE-2023-1916.patch - security update: * CVE-2023-52356 [bsc#1219213] Fix segfault in TIFFReadRGBATileExt() + tiff-CVE-2023-52356.patch - security update: * CVE-2023-40745[bsc#1214687] CVE-2023-41175[bsc#1214686] [bsc#1221187] CVE-2023-38288[bsc#1213590] Fix potential int overflow in raw2tiff.c and tiffcp.c Rename tiff-CVE-2023-38288.patch into tiff-CVE-2023-38288,CVE-2023-40745,CVE-2023-41175.patch - security update: * CVE-2023-3164 [bsc#1212233] Fix heap buffer overflow in tiffcrop + tiff-CVE-2023-3164.patch - security update: * CVE-2024-7006 [bsc#1228924] Fix pointer deref in tif_dirinfo.c + tiff-CVE-2024-7006.patch - timezone update 2019c (bsc#1150451) * Fiji observes DST from 2019-11-10 to 2020-01-12. * Norfolk Island starts observing Australian-style DST. - timezone update 2020a (bsc#1169582) * Morocco springs forward on 2020-05-31, not 2020-05-24. * Canada's Yukon advanced to -07 year-round on 2020-03-08. * America/Nuuk renamed from America/Godthab. * zic now supports expiration dates for leap second lists. - zdump --version reported "unknown" (boo#1172055) - timezone update 2020b (bsc#1177460) * Revised predictions for Morocco's changes starting in 2023. * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08. * Macquarie Island has stayed in sync with Tasmania since 2011. * Casey, Antarctica is at +08 in winter and +11 in summer. * zic no longer supports -y, nor the TYPE field of Rules. - Rebased timezone-2018f-bsc1112310.patch - timezone update 2020c (bsc#1177460) * Fiji starts DST later than usual, on 2020-12-20. - timezone update 2020d (bsc#1177460) * Palestine ends DST earlier than predicted, on 2020-10-24. - Add fat.patch to generate "fat" timezone files (was default before 2020b) bsc#1178346 - timezone update 2020e (bsc#1177460) * Volgograd switches to Moscow time on 2020-12-27 at 02:00. - timezone update 2020f (bsc#1177460) * 'make rearguard_tarballs' no longer generates a bad rearguard.zi, fixing a 2020e bug. - timezone update 2021a (bsc#1177460) * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00. - Install tzdata.zi (bsc#1188127) - timezone update 2021e (bsc#1177460): * Palestine will fall back 10-29 (not 10-30) at 01:00 - timezone update 2021d: * Fiji suspends DST for the 2021/2022 season * 'zic -r' marks unspecified timestamps with "-00" - timezone update 2021c: * Revert almost all of 2021b's changes to the 'backward' file * Fix a bug in 'zic -b fat' that caused old timestamps to be mishandled in 32-bit-only readers - timezone update 2021b: * Jordan now starts DST on February's last Thursday. * Samoa no longer observes DST. * Move some backward-compatibility links to 'backward'. * Rename Pacific/Enderbury to Pacific/Kanton. * Correct many pre-1993 transitions in Malawi, Portugal, etc. * zic now creates each output file or link atomically. * zic -L no longer omits the POSIX TZ string in its output. * zic fixes for truncation and leap second table expiration. * zic now follows POSIX for TZ strings using all-year DST. * Fix some localtime crashes and bugs in obscure cases. * zdump -v now outputs more-useful boundary cases. * tzfile.5 better matches a draft successor to RFC 8536. - Refresh tzdata-china.patch - timezone update 2022a (bsc#1177460): * Palestine will spring forward on 2022-03-27, not -03-26* * zdump -v now outputs better failure indications * Bug fixes for code that reads corrupted TZif data - Update to reflect new Chile DST change, bsc#1202310 * bsc1202310.patch - timezone update 2022e (bsc#1177460): * Jordan and Syria switch from +02/+03 with DST to year-round +03 - timezone update 2022d: * Palestine transitions are now Saturdays at 02:00 * Simplify three Ukraine zones into one - timezone update 2022c: * Work around awk bug * Improve tzselect on intercontinental Zones - timezone update 2022b: * Chile's DST is delayed by a week in September 2022 boo#1202324 * Iran no longer observes DST after 2022 * Rename Europe/Kiev to Europe/Kyiv * New zic -R option * Vanguard form now uses %z * Finish moving duplicate-since-1970 zones to 'backzone' - Refresh tzdata-china.diff - Remove upstreamed bsc1202310.patch - timezone update 2022f (bsc#1177460): * Mexico will no longer observe DST except near the US border * Chihuahua moves to year-round -06 on 2022-10-30 * Fiji no longer observes DST * Move links to 'backward' * In vanguard form, GMT is now a Zone and Etc/GMT a link * zic now supports links to links, and vanguard form uses this * Simplify four Ontario zones * Fix a Y2438 bug when reading TZif data * Enable 64-bit time_t on 32-bit glibc platforms * Omit large-file support when no longer needed * In C code, use some C23 features if available * Remove no-longer-needed workaround for Qt bug 53071 - Refreshed patches: * fat.patch * tzdata-china.diff - timezone update 2022g (bsc#1177460): * In the Mexican state of Chihuahua, the border strip near the US will change to agree with nearby US locations on 2022-11-30. The strip's western part, represented by Ciudad Juárez, switches from -06 all year to -07/-06 with US DST rules, like El Paso, TX. The eastern part, represented by Ojinaga, will observe US DST next year, like Presidio, TX. A new Zone America/Ciudad_Juarez splits from America/Ojinaga. * Much of Greenland, represented by America/Nuuk, stops observing winter time after March 2023, so its daylight saving time becomes standard time. * Changes for pre-1996 northern Canada * Update to past DST transition in Colombia (1993), Singapore (1981) * timegm is now supported by default - timezone update 2023c: * Revert changes made in 2023b - timezone update 2023b: * Lebanon delays the start of DST this year. - timezone update 2023a: * Egypt now uses DST again, from April through October. * This year Morocco springs forward April 23, not April 30. * Palestine delays the start of DST this year. * Much of Greenland still uses DST from 2024 on. * America/Yellowknife now links to America/Edmonton. * tzselect can now use current time to help infer timezone. * The code now defaults to C99 or later. - Refresh tzdata-china.diff - update to 2023d: * Ittoqqortoormiit, Greenland changes time zones on 2024-03-31. * Vostok, Antarctica changed time zones on 2023-12-18. * Casey, Antarctica changed time zones five times since 2020. * Code and data fixes for Palestine timestamps starting in 2072. * A new data file zonenow.tab for timestamps starting now. * Fix predictions for DST transitions in Palestine in 2072-2075, correcting a typo introduced in 2023a. * Vostok, Antarctica changed to +05 on 2023-12-18. It had been at +07 (not +06) for years. * Change data for Casey, Antarctica to agree with timeanddate.com, by adding five time zone changes since 2020. Casey is now at +08 instead of +11. * Much of Greenland, represented by America/Nuuk, changed its standard time from -03 to -02 on 2023-03-25, not on 2023-10-28. * localtime.c no longer mishandles TZif files that contain a single transition into a DST regime. Previously, it incorrectly assumed DST was in effect before the transition too. * tzselect no longer creates temporary files. * tzselect no longer mishandles the following: * Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. * TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/. * ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments. * Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension. * zic no longer mishandles data for Palestine after the year 2075. - Refresh tzdata-china.diff - update to 2024a: * Kazakhstan unifies on UTC+5. This affects Asia/Almaty and Asia/Qostanay which together represent the eastern portion of the country that will transition from UTC+6 on 2024-03-01 at 00:00 to join the western portion. (Thanks to Zhanbolat Raimbekov.) * Palestine springs forward a week later than previously predicted in 2024 and 2025. (Thanks to Heba Hamad.) Change spring-forward predictions to the second Saturday after Ramadan, not the first; this also affects other predictions starting in 2039. * Asia/Ho_Chi_Minh's 1955-07-01 transition occurred at 01:00 not 00:00. (Thanks to Đoàn Trần Công Danh.) * From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00. (Thanks to Chris Walton.) * In 1911 Miquelon adopted standard time on June 15, not May 15. * The FROM and TO columns of Rule lines can no longer be "minimum" or an abbreviation of "minimum", because TZif files do not support DST rules that extend into the indefinite past - although these rules were supported when TZif files had only 32-bit data, this stopped working when 64-bit TZif files were introduced in 1995. This should not be a problem for realistic data, since DST was first used in the 20th century. As a transition aid, FROM columns like "minimum" are now diagnosed and then treated as if they were the year 1900; this should suffice for TZif files on old systems with only 32-bit time_t, and it is more compatible with bugs in 2023c-and-earlier localtime.c. (Problem reported by Yoshito Umaoka.) * localtime and related functions no longer mishandle some timestamps that occur about 400 years after a switch to a time zone with a DST schedule. In 2023d data this problem was visible for some timestamps in November 2422, November 2822, etc. in America/Ciudad_Juarez. (Problem reported by Gilmore Davidson.) * strftime %s now uses tm_gmtoff if available. (Problem and draft patch reported by Dag-Erling Smørgrav.) * The strftime man page documents which struct tm members affect which conversion specs, and that tzset is called. (Problems reported by Robert Elz and Steve Summit.) - timezone update 2019c (bsc#1150451) * Fiji observes DST from 2019-11-10 to 2020-01-12. * Norfolk Island starts observing Australian-style DST. - timezone update 2020a (bsc#1169582) * Morocco springs forward on 2020-05-31, not 2020-05-24. * Canada's Yukon advanced to -07 year-round on 2020-03-08. * America/Nuuk renamed from America/Godthab. * zic now supports expiration dates for leap second lists. - zdump --version reported "unknown" (boo#1172055) - timezone update 2020b (bsc#1177460) * Revised predictions for Morocco's changes starting in 2023. * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08. * Macquarie Island has stayed in sync with Tasmania since 2011. * Casey, Antarctica is at +08 in winter and +11 in summer. * zic no longer supports -y, nor the TYPE field of Rules. - Rebased timezone-2018f-bsc1112310.patch - timezone update 2020c (bsc#1177460) * Fiji starts DST later than usual, on 2020-12-20. - timezone update 2020d (bsc#1177460) * Palestine ends DST earlier than predicted, on 2020-10-24. - Add fat.patch to generate "fat" timezone files (was default before 2020b) bsc#1178346 - timezone update 2020e (bsc#1177460) * Volgograd switches to Moscow time on 2020-12-27 at 02:00. - timezone update 2020f (bsc#1177460) * 'make rearguard_tarballs' no longer generates a bad rearguard.zi, fixing a 2020e bug. - timezone update 2021a (bsc#1177460) * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00. - Install tzdata.zi (bsc#1188127) - timezone update 2021e (bsc#1177460): * Palestine will fall back 10-29 (not 10-30) at 01:00 - timezone update 2021d: * Fiji suspends DST for the 2021/2022 season * 'zic -r' marks unspecified timestamps with "-00" - timezone update 2021c: * Revert almost all of 2021b's changes to the 'backward' file * Fix a bug in 'zic -b fat' that caused old timestamps to be mishandled in 32-bit-only readers - timezone update 2021b: * Jordan now starts DST on February's last Thursday. * Samoa no longer observes DST. * Move some backward-compatibility links to 'backward'. * Rename Pacific/Enderbury to Pacific/Kanton. * Correct many pre-1993 transitions in Malawi, Portugal, etc. * zic now creates each output file or link atomically. * zic -L no longer omits the POSIX TZ string in its output. * zic fixes for truncation and leap second table expiration. * zic now follows POSIX for TZ strings using all-year DST. * Fix some localtime crashes and bugs in obscure cases. * zdump -v now outputs more-useful boundary cases. * tzfile.5 better matches a draft successor to RFC 8536. - Refresh tzdata-china.patch - timezone update 2022a (bsc#1177460): * Palestine will spring forward on 2022-03-27, not -03-26* * zdump -v now outputs better failure indications * Bug fixes for code that reads corrupted TZif data - Update to reflect new Chile DST change, bsc#1202310 * bsc1202310.patch - timezone update 2022e (bsc#1177460): * Jordan and Syria switch from +02/+03 with DST to year-round +03 - timezone update 2022d: * Palestine transitions are now Saturdays at 02:00 * Simplify three Ukraine zones into one - timezone update 2022c: * Work around awk bug * Improve tzselect on intercontinental Zones - timezone update 2022b: * Chile's DST is delayed by a week in September 2022 boo#1202324 * Iran no longer observes DST after 2022 * Rename Europe/Kiev to Europe/Kyiv * New zic -R option * Vanguard form now uses %z * Finish moving duplicate-since-1970 zones to 'backzone' - Refresh tzdata-china.diff - Remove upstreamed bsc1202310.patch - timezone update 2022f (bsc#1177460): * Mexico will no longer observe DST except near the US border * Chihuahua moves to year-round -06 on 2022-10-30 * Fiji no longer observes DST * Move links to 'backward' * In vanguard form, GMT is now a Zone and Etc/GMT a link * zic now supports links to links, and vanguard form uses this * Simplify four Ontario zones * Fix a Y2438 bug when reading TZif data * Enable 64-bit time_t on 32-bit glibc platforms * Omit large-file support when no longer needed * In C code, use some C23 features if available * Remove no-longer-needed workaround for Qt bug 53071 - Refreshed patches: * fat.patch * tzdata-china.diff - timezone update 2022g (bsc#1177460): * In the Mexican state of Chihuahua, the border strip near the US will change to agree with nearby US locations on 2022-11-30. The strip's western part, represented by Ciudad Juárez, switches from -06 all year to -07/-06 with US DST rules, like El Paso, TX. The eastern part, represented by Ojinaga, will observe US DST next year, like Presidio, TX. A new Zone America/Ciudad_Juarez splits from America/Ojinaga. * Much of Greenland, represented by America/Nuuk, stops observing winter time after March 2023, so its daylight saving time becomes standard time. * Changes for pre-1996 northern Canada * Update to past DST transition in Colombia (1993), Singapore (1981) * timegm is now supported by default - timezone update 2023c: * Revert changes made in 2023b - timezone update 2023b: * Lebanon delays the start of DST this year. - timezone update 2023a: * Egypt now uses DST again, from April through October. * This year Morocco springs forward April 23, not April 30. * Palestine delays the start of DST this year. * Much of Greenland still uses DST from 2024 on. * America/Yellowknife now links to America/Edmonton. * tzselect can now use current time to help infer timezone. * The code now defaults to C99 or later. - Refresh tzdata-china.diff - update to 2023d: * Ittoqqortoormiit, Greenland changes time zones on 2024-03-31. * Vostok, Antarctica changed time zones on 2023-12-18. * Casey, Antarctica changed time zones five times since 2020. * Code and data fixes for Palestine timestamps starting in 2072. * A new data file zonenow.tab for timestamps starting now. * Fix predictions for DST transitions in Palestine in 2072-2075, correcting a typo introduced in 2023a. * Vostok, Antarctica changed to +05 on 2023-12-18. It had been at +07 (not +06) for years. * Change data for Casey, Antarctica to agree with timeanddate.com, by adding five time zone changes since 2020. Casey is now at +08 instead of +11. * Much of Greenland, represented by America/Nuuk, changed its standard time from -03 to -02 on 2023-03-25, not on 2023-10-28. * localtime.c no longer mishandles TZif files that contain a single transition into a DST regime. Previously, it incorrectly assumed DST was in effect before the transition too. * tzselect no longer creates temporary files. * tzselect no longer mishandles the following: * Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. * TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/. * ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments. * Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension. * zic no longer mishandles data for Palestine after the year 2075. - Refresh tzdata-china.diff - update to 2024a: * Kazakhstan unifies on UTC+5. This affects Asia/Almaty and Asia/Qostanay which together represent the eastern portion of the country that will transition from UTC+6 on 2024-03-01 at 00:00 to join the western portion. (Thanks to Zhanbolat Raimbekov.) * Palestine springs forward a week later than previously predicted in 2024 and 2025. (Thanks to Heba Hamad.) Change spring-forward predictions to the second Saturday after Ramadan, not the first; this also affects other predictions starting in 2039. * Asia/Ho_Chi_Minh's 1955-07-01 transition occurred at 01:00 not 00:00. (Thanks to Đoàn Trần Công Danh.) * From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00. (Thanks to Chris Walton.) * In 1911 Miquelon adopted standard time on June 15, not May 15. * The FROM and TO columns of Rule lines can no longer be "minimum" or an abbreviation of "minimum", because TZif files do not support DST rules that extend into the indefinite past - although these rules were supported when TZif files had only 32-bit data, this stopped working when 64-bit TZif files were introduced in 1995. This should not be a problem for realistic data, since DST was first used in the 20th century. As a transition aid, FROM columns like "minimum" are now diagnosed and then treated as if they were the year 1900; this should suffice for TZif files on old systems with only 32-bit time_t, and it is more compatible with bugs in 2023c-and-earlier localtime.c. (Problem reported by Yoshito Umaoka.) * localtime and related functions no longer mishandle some timestamps that occur about 400 years after a switch to a time zone with a DST schedule. In 2023d data this problem was visible for some timestamps in November 2422, November 2822, etc. in America/Ciudad_Juarez. (Problem reported by Gilmore Davidson.) * strftime %s now uses tm_gmtoff if available. (Problem and draft patch reported by Dag-Erling Smørgrav.) * The strftime man page documents which struct tm members affect which conversion specs, and that tzset is called. (Problems reported by Robert Elz and Steve Summit.) - timezone update 2019c (bsc#1150451) * Fiji observes DST from 2019-11-10 to 2020-01-12. * Norfolk Island starts observing Australian-style DST. - timezone update 2020a (bsc#1169582) * Morocco springs forward on 2020-05-31, not 2020-05-24. * Canada's Yukon advanced to -07 year-round on 2020-03-08. * America/Nuuk renamed from America/Godthab. * zic now supports expiration dates for leap second lists. - zdump --version reported "unknown" (boo#1172055) - timezone update 2020b (bsc#1177460) * Revised predictions for Morocco's changes starting in 2023. * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08. * Macquarie Island has stayed in sync with Tasmania since 2011. * Casey, Antarctica is at +08 in winter and +11 in summer. * zic no longer supports -y, nor the TYPE field of Rules. - Rebased timezone-2018f-bsc1112310.patch - timezone update 2020c (bsc#1177460) * Fiji starts DST later than usual, on 2020-12-20. - timezone update 2020d (bsc#1177460) * Palestine ends DST earlier than predicted, on 2020-10-24. - Add fat.patch to generate "fat" timezone files (was default before 2020b) bsc#1178346 - timezone update 2020e (bsc#1177460) * Volgograd switches to Moscow time on 2020-12-27 at 02:00. - timezone update 2020f (bsc#1177460) * 'make rearguard_tarballs' no longer generates a bad rearguard.zi, fixing a 2020e bug. - timezone update 2021a (bsc#1177460) * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00. - Install tzdata.zi (bsc#1188127) - timezone update 2021e (bsc#1177460): * Palestine will fall back 10-29 (not 10-30) at 01:00 - timezone update 2021d: * Fiji suspends DST for the 2021/2022 season * 'zic -r' marks unspecified timestamps with "-00" - timezone update 2021c: * Revert almost all of 2021b's changes to the 'backward' file * Fix a bug in 'zic -b fat' that caused old timestamps to be mishandled in 32-bit-only readers - timezone update 2021b: * Jordan now starts DST on February's last Thursday. * Samoa no longer observes DST. * Move some backward-compatibility links to 'backward'. * Rename Pacific/Enderbury to Pacific/Kanton. * Correct many pre-1993 transitions in Malawi, Portugal, etc. * zic now creates each output file or link atomically. * zic -L no longer omits the POSIX TZ string in its output. * zic fixes for truncation and leap second table expiration. * zic now follows POSIX for TZ strings using all-year DST. * Fix some localtime crashes and bugs in obscure cases. * zdump -v now outputs more-useful boundary cases. * tzfile.5 better matches a draft successor to RFC 8536. - Refresh tzdata-china.patch - timezone update 2022a (bsc#1177460): * Palestine will spring forward on 2022-03-27, not -03-26* * zdump -v now outputs better failure indications * Bug fixes for code that reads corrupted TZif data - Update to reflect new Chile DST change, bsc#1202310 * bsc1202310.patch - timezone update 2022e (bsc#1177460): * Jordan and Syria switch from +02/+03 with DST to year-round +03 - timezone update 2022d: * Palestine transitions are now Saturdays at 02:00 * Simplify three Ukraine zones into one - timezone update 2022c: * Work around awk bug * Improve tzselect on intercontinental Zones - timezone update 2022b: * Chile's DST is delayed by a week in September 2022 boo#1202324 * Iran no longer observes DST after 2022 * Rename Europe/Kiev to Europe/Kyiv * New zic -R option * Vanguard form now uses %z * Finish moving duplicate-since-1970 zones to 'backzone' - Refresh tzdata-china.diff - Remove upstreamed bsc1202310.patch - timezone update 2022f (bsc#1177460): * Mexico will no longer observe DST except near the US border * Chihuahua moves to year-round -06 on 2022-10-30 * Fiji no longer observes DST * Move links to 'backward' * In vanguard form, GMT is now a Zone and Etc/GMT a link * zic now supports links to links, and vanguard form uses this * Simplify four Ontario zones * Fix a Y2438 bug when reading TZif data * Enable 64-bit time_t on 32-bit glibc platforms * Omit large-file support when no longer needed * In C code, use some C23 features if available * Remove no-longer-needed workaround for Qt bug 53071 - Refreshed patches: * fat.patch * tzdata-china.diff - timezone update 2022g (bsc#1177460): * In the Mexican state of Chihuahua, the border strip near the US will change to agree with nearby US locations on 2022-11-30. The strip's western part, represented by Ciudad Juárez, switches from -06 all year to -07/-06 with US DST rules, like El Paso, TX. The eastern part, represented by Ojinaga, will observe US DST next year, like Presidio, TX. A new Zone America/Ciudad_Juarez splits from America/Ojinaga. * Much of Greenland, represented by America/Nuuk, stops observing winter time after March 2023, so its daylight saving time becomes standard time. * Changes for pre-1996 northern Canada * Update to past DST transition in Colombia (1993), Singapore (1981) * timegm is now supported by default - timezone update 2023c: * Revert changes made in 2023b - timezone update 2023b: * Lebanon delays the start of DST this year. - timezone update 2023a: * Egypt now uses DST again, from April through October. * This year Morocco springs forward April 23, not April 30. * Palestine delays the start of DST this year. * Much of Greenland still uses DST from 2024 on. * America/Yellowknife now links to America/Edmonton. * tzselect can now use current time to help infer timezone. * The code now defaults to C99 or later. - Refresh tzdata-china.diff - update to 2023d: * Ittoqqortoormiit, Greenland changes time zones on 2024-03-31. * Vostok, Antarctica changed time zones on 2023-12-18. * Casey, Antarctica changed time zones five times since 2020. * Code and data fixes for Palestine timestamps starting in 2072. * A new data file zonenow.tab for timestamps starting now. * Fix predictions for DST transitions in Palestine in 2072-2075, correcting a typo introduced in 2023a. * Vostok, Antarctica changed to +05 on 2023-12-18. It had been at +07 (not +06) for years. * Change data for Casey, Antarctica to agree with timeanddate.com, by adding five time zone changes since 2020. Casey is now at +08 instead of +11. * Much of Greenland, represented by America/Nuuk, changed its standard time from -03 to -02 on 2023-03-25, not on 2023-10-28. * localtime.c no longer mishandles TZif files that contain a single transition into a DST regime. Previously, it incorrectly assumed DST was in effect before the transition too. * tzselect no longer creates temporary files. * tzselect no longer mishandles the following: * Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. * TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/. * ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments. * Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension. * zic no longer mishandles data for Palestine after the year 2075. - Refresh tzdata-china.diff - update to 2024a: * Kazakhstan unifies on UTC+5. This affects Asia/Almaty and Asia/Qostanay which together represent the eastern portion of the country that will transition from UTC+6 on 2024-03-01 at 00:00 to join the western portion. (Thanks to Zhanbolat Raimbekov.) * Palestine springs forward a week later than previously predicted in 2024 and 2025. (Thanks to Heba Hamad.) Change spring-forward predictions to the second Saturday after Ramadan, not the first; this also affects other predictions starting in 2039. * Asia/Ho_Chi_Minh's 1955-07-01 transition occurred at 01:00 not 00:00. (Thanks to Đoàn Trần Công Danh.) * From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00. (Thanks to Chris Walton.) * In 1911 Miquelon adopted standard time on June 15, not May 15. * The FROM and TO columns of Rule lines can no longer be "minimum" or an abbreviation of "minimum", because TZif files do not support DST rules that extend into the indefinite past - although these rules were supported when TZif files had only 32-bit data, this stopped working when 64-bit TZif files were introduced in 1995. This should not be a problem for realistic data, since DST was first used in the 20th century. As a transition aid, FROM columns like "minimum" are now diagnosed and then treated as if they were the year 1900; this should suffice for TZif files on old systems with only 32-bit time_t, and it is more compatible with bugs in 2023c-and-earlier localtime.c. (Problem reported by Yoshito Umaoka.) * localtime and related functions no longer mishandle some timestamps that occur about 400 years after a switch to a time zone with a DST schedule. In 2023d data this problem was visible for some timestamps in November 2422, November 2822, etc. in America/Ciudad_Juarez. (Problem reported by Gilmore Davidson.) * strftime %s now uses tm_gmtoff if available. (Problem and draft patch reported by Dag-Erling Smørgrav.) * The strftime man page documents which struct tm members affect which conversion specs, and that tzset is called. (Problems reported by Robert Elz and Steve Summit.) - timezone update 2019c (bsc#1150451) * Fiji observes DST from 2019-11-10 to 2020-01-12. * Norfolk Island starts observing Australian-style DST. - timezone update 2020a (bsc#1169582) * Morocco springs forward on 2020-05-31, not 2020-05-24. * Canada's Yukon advanced to -07 year-round on 2020-03-08. * America/Nuuk renamed from America/Godthab. * zic now supports expiration dates for leap second lists. - zdump --version reported "unknown" (boo#1172055) - timezone update 2020b (bsc#1177460) * Revised predictions for Morocco's changes starting in 2023. * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08. * Macquarie Island has stayed in sync with Tasmania since 2011. * Casey, Antarctica is at +08 in winter and +11 in summer. * zic no longer supports -y, nor the TYPE field of Rules. - Rebased timezone-2018f-bsc1112310.patch - timezone update 2020c (bsc#1177460) * Fiji starts DST later than usual, on 2020-12-20. - timezone update 2020d (bsc#1177460) * Palestine ends DST earlier than predicted, on 2020-10-24. - Add fat.patch to generate "fat" timezone files (was default before 2020b) bsc#1178346 - timezone update 2020e (bsc#1177460) * Volgograd switches to Moscow time on 2020-12-27 at 02:00. - timezone update 2020f (bsc#1177460) * 'make rearguard_tarballs' no longer generates a bad rearguard.zi, fixing a 2020e bug. - timezone update 2021a (bsc#1177460) * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00. - Install tzdata.zi (bsc#1188127) - timezone update 2021e (bsc#1177460): * Palestine will fall back 10-29 (not 10-30) at 01:00 - timezone update 2021d: * Fiji suspends DST for the 2021/2022 season * 'zic -r' marks unspecified timestamps with "-00" - timezone update 2021c: * Revert almost all of 2021b's changes to the 'backward' file * Fix a bug in 'zic -b fat' that caused old timestamps to be mishandled in 32-bit-only readers - timezone update 2021b: * Jordan now starts DST on February's last Thursday. * Samoa no longer observes DST. * Move some backward-compatibility links to 'backward'. * Rename Pacific/Enderbury to Pacific/Kanton. * Correct many pre-1993 transitions in Malawi, Portugal, etc. * zic now creates each output file or link atomically. * zic -L no longer omits the POSIX TZ string in its output. * zic fixes for truncation and leap second table expiration. * zic now follows POSIX for TZ strings using all-year DST. * Fix some localtime crashes and bugs in obscure cases. * zdump -v now outputs more-useful boundary cases. * tzfile.5 better matches a draft successor to RFC 8536. - Refresh tzdata-china.patch - timezone update 2022a (bsc#1177460): * Palestine will spring forward on 2022-03-27, not -03-26* * zdump -v now outputs better failure indications * Bug fixes for code that reads corrupted TZif data - Update to reflect new Chile DST change, bsc#1202310 * bsc1202310.patch - timezone update 2022e (bsc#1177460): * Jordan and Syria switch from +02/+03 with DST to year-round +03 - timezone update 2022d: * Palestine transitions are now Saturdays at 02:00 * Simplify three Ukraine zones into one - timezone update 2022c: * Work around awk bug * Improve tzselect on intercontinental Zones - timezone update 2022b: * Chile's DST is delayed by a week in September 2022 boo#1202324 * Iran no longer observes DST after 2022 * Rename Europe/Kiev to Europe/Kyiv * New zic -R option * Vanguard form now uses %z * Finish moving duplicate-since-1970 zones to 'backzone' - Refresh tzdata-china.diff - Remove upstreamed bsc1202310.patch - timezone update 2022f (bsc#1177460): * Mexico will no longer observe DST except near the US border * Chihuahua moves to year-round -06 on 2022-10-30 * Fiji no longer observes DST * Move links to 'backward' * In vanguard form, GMT is now a Zone and Etc/GMT a link * zic now supports links to links, and vanguard form uses this * Simplify four Ontario zones * Fix a Y2438 bug when reading TZif data * Enable 64-bit time_t on 32-bit glibc platforms * Omit large-file support when no longer needed * In C code, use some C23 features if available * Remove no-longer-needed workaround for Qt bug 53071 - Refreshed patches: * fat.patch * tzdata-china.diff - timezone update 2022g (bsc#1177460): * In the Mexican state of Chihuahua, the border strip near the US will change to agree with nearby US locations on 2022-11-30. The strip's western part, represented by Ciudad Juárez, switches from -06 all year to -07/-06 with US DST rules, like El Paso, TX. The eastern part, represented by Ojinaga, will observe US DST next year, like Presidio, TX. A new Zone America/Ciudad_Juarez splits from America/Ojinaga. * Much of Greenland, represented by America/Nuuk, stops observing winter time after March 2023, so its daylight saving time becomes standard time. * Changes for pre-1996 northern Canada * Update to past DST transition in Colombia (1993), Singapore (1981) * timegm is now supported by default - timezone update 2023c: * Revert changes made in 2023b - timezone update 2023b: * Lebanon delays the start of DST this year. - timezone update 2023a: * Egypt now uses DST again, from April through October. * This year Morocco springs forward April 23, not April 30. * Palestine delays the start of DST this year. * Much of Greenland still uses DST from 2024 on. * America/Yellowknife now links to America/Edmonton. * tzselect can now use current time to help infer timezone. * The code now defaults to C99 or later. - Refresh tzdata-china.diff - update to 2023d: * Ittoqqortoormiit, Greenland changes time zones on 2024-03-31. * Vostok, Antarctica changed time zones on 2023-12-18. * Casey, Antarctica changed time zones five times since 2020. * Code and data fixes for Palestine timestamps starting in 2072. * A new data file zonenow.tab for timestamps starting now. * Fix predictions for DST transitions in Palestine in 2072-2075, correcting a typo introduced in 2023a. * Vostok, Antarctica changed to +05 on 2023-12-18. It had been at +07 (not +06) for years. * Change data for Casey, Antarctica to agree with timeanddate.com, by adding five time zone changes since 2020. Casey is now at +08 instead of +11. * Much of Greenland, represented by America/Nuuk, changed its standard time from -03 to -02 on 2023-03-25, not on 2023-10-28. * localtime.c no longer mishandles TZif files that contain a single transition into a DST regime. Previously, it incorrectly assumed DST was in effect before the transition too. * tzselect no longer creates temporary files. * tzselect no longer mishandles the following: * Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. * TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/. * ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments. * Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension. * zic no longer mishandles data for Palestine after the year 2075. - Refresh tzdata-china.diff - update to 2024a: * Kazakhstan unifies on UTC+5. This affects Asia/Almaty and Asia/Qostanay which together represent the eastern portion of the country that will transition from UTC+6 on 2024-03-01 at 00:00 to join the western portion. (Thanks to Zhanbolat Raimbekov.) * Palestine springs forward a week later than previously predicted in 2024 and 2025. (Thanks to Heba Hamad.) Change spring-forward predictions to the second Saturday after Ramadan, not the first; this also affects other predictions starting in 2039. * Asia/Ho_Chi_Minh's 1955-07-01 transition occurred at 01:00 not 00:00. (Thanks to Đoàn Trần Công Danh.) * From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00. (Thanks to Chris Walton.) * In 1911 Miquelon adopted standard time on June 15, not May 15. * The FROM and TO columns of Rule lines can no longer be "minimum" or an abbreviation of "minimum", because TZif files do not support DST rules that extend into the indefinite past - although these rules were supported when TZif files had only 32-bit data, this stopped working when 64-bit TZif files were introduced in 1995. This should not be a problem for realistic data, since DST was first used in the 20th century. As a transition aid, FROM columns like "minimum" are now diagnosed and then treated as if they were the year 1900; this should suffice for TZif files on old systems with only 32-bit time_t, and it is more compatible with bugs in 2023c-and-earlier localtime.c. (Problem reported by Yoshito Umaoka.) * localtime and related functions no longer mishandle some timestamps that occur about 400 years after a switch to a time zone with a DST schedule. In 2023d data this problem was visible for some timestamps in November 2422, November 2822, etc. in America/Ciudad_Juarez. (Problem reported by Gilmore Davidson.) * strftime %s now uses tm_gmtoff if available. (Problem and draft patch reported by Dag-Erling Smørgrav.) * The strftime man page documents which struct tm members affect which conversion specs, and that tzset is called. (Problems reported by Robert Elz and Steve Summit.) - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - added all librares to baselibs.conf to satisfy 32-bit dependencies of esys0 and sys0 - also process udev triggers for tpmrm subsystem, otherwise /dev/tpmrm0 isn't properly updated (at least on SLES-12-SP4) - update to upstream version 2.0.1 (FATE#324477): - Fixed problems with doxygan failing make distcheck - Fixed conversion of gcrypt mpi numbers to binary data - Fixed an error in parsing socket address in MSSIM TCTI - Fixed compilation error with --disable-tcti-mssim - Added initialization function for gcrypt to suppress warning - Fixed invalid type base type while marshaling TPMI_ECC_CURVE in Tss2_Sys_ECC_Parameters - Fixed invalid RSA encryption with exponent equal to 0 - Fixed checking of return codes in ESAPI commands - Added checks for programs required by the test harness @ configure time - Fixed warning on TPM2_RC_INITIALIZE rc after a Startup in Esys_Startup - Checked for 1.2 TPM type response - Changed constants values in esys header file to unsigned - update to upstream version 2.2.1: - changes from version 2.2.0: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - Added support for QNX build - Added support for partial reads in device TCTI - changes from version 2.1.1: - Fixed leak of hkey on success in iesys_cryptossl_hmac_start - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - changes from version 2.1.0: - Fixed handling of the default TCTI - Changed logging to be ISO-C99 compatible - Fixed leak of dlopen handle - Fixed logging of a response header tag in Tss2_Sys_Execute - Fixed marshaling of TPM2B parameters in SAPI commands - Fixed unnecessary warning in Esys_Startup - Fixed warnings in doxygen documentation - Added Esys_Free wrapper function for systems using different C runtime libraries - Added Windows TBS TCTI - Added non-blocking mode of operation in tcti-device - Added tests for Esys_HMAC and Esys_Hash - Enabled integration tests on physical TPM device - Added openssl libcrypto backend - Added Doxygen documentation to integration tests - Refactored SetDecryptParam - Enabled OpenSSL crypto backend by default - changes from 2.0.2: - Fixed NULL ptr issues in Esys_HMAC_Start, Esys_HierarchyChangeAuth and Esys_NV_ChangeAuth - Fixed NULL ptr issue in sequenceHandleNode - Fixed NULL ptr auth handling in Esys_TR_SetAuth - Fixed NULL auth handling in iesys_compute_session_value - Fixed marshaling of TPM2Bs with sub types. - Fixed NULL ptr session handling in Esys_TRSess_SetAttributes - Fixed the way size of the hmac value of a session without authorization - Added missing MU functions for TPM2_NT type - Added missing MU functions for TPMA_ID_OBJECT type - Added missing type TPM2_NT into tss2_tpm2_types.h - Fixed wrong typename _ID_OBJECT in tss2_tpm2_types.h - Fixed build breakage when --with-maxloglevel is not 'trace' - Fixed build breakage in generated configure script when CFLAGS is set - Fixed configure scritp ERROR_IF_NO_PROG macro - Changed TPM2B type unmarshal to use sizeof of the dest buffer instead of dest - Fixed unmarshaling of the TPM2B type with invalid size - Removed dead code defect detected by coverity from Esys_TRSess_GetNonceTPM - introduce _service file for syncing with upstream tags - bsc#1130588: Require shadow instead of old pwdutils - update to upstream version 2.2.3: - changes in version 2.2.3: * Fix computation of session name * Fixed PolicyPassword handling of session Attributes * Fixed windows build from dist ball * Fixed default tcti configure option * Fixed nonce size calculation in ESYS sessions - changes in version 2.2.2: * Fixed wrong encryption flag in EncryptDecrypt * Fixing openssl engine invocation - update to upstream version 2.3.0: - changes in version 2.3.0: - tss2-tctildr: A new library that helps with tcti initialization Recommend to use this in place of custom tcti loading code now ! - tss2-rc: A new library that provides textual representations for return codes - Option to disable NIST-deprecated crypto (--disable-weak-crypto) - Support Esys_TR_FromTPMPublic on sessions (for use in Esys_FlushContext) - map-files with correct symbol lists for tss2-sys and tss2-esys This may lead to unresolved symbols in linked applications - Support to call Tss2_Sys_Execute repeatedly on certain errors - Reduced RAM consumption in Esys due to Tss2_Sys_Execute change - Automated session attribution clearing for esys (decrypt and encrypt) per cmd - Removed libtss2-mu from "Requires" field of libtss2-esys.pc Needs to be added explicitely now - All fixes from 2.2.1, 2.2.2 and 2.2.3 - Fixed SPDX License Identifiers - Fixed Null-pointer problems in tcti-tbs - Fixed Default locality for tcti-mssim set to LOC_0 - Fixed coverity and valgrind leaks detected in test programs (not library code) - update to upstream version 2.3.2: - changes since version 2.3.0: - Fix unit tests on S390 architectures - Fixed HMAC generation for policy sessions - BuildRequire pkgconfig(udev) instead of udev: allow OBS to shortcut through the -mini flavor. - Use system-users for tss user creation (boo#1162360). - Update to version 2.3.3 * Fixed mixing salted and unsalted sessions in the same ESAPI context * Removed use of VLAs from TPML marshal code * Added check for object node before calling compute_session_value function * Fixed auth calculation in Esys_StartAuthSession called with optional parameters * Fixed compute_encrypted_salt error handling in Esys_StartAuthSession * Fixed exported symbols map for libtss2-mu - Update to 3.0.1, changelog at: https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md - Update libtss2-sys0 to libtss2-sys1 - Add new libs: * libtss2-fapi1 * libtss2-tcti-cmd0 * libtss2-tcti-swtpm0 - move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package. - improve the descriptions of new libraries (fapi1, cmd0, swtpm0) - adjust baselibs.conf to match new library versions and added libraries - update to 3.0.3: - changes in 3.0.3: * Fix Regression in Fapi_List * Fix memory leak in policy calculation - changes in 3.0.2: * FAPI: Fix setting of the system flag of NV objects * This will let NV object metadata be created system-wide always instead of * locally in the user. Existing metadata will remain in the user directory. * It can be moved to the corresponding systemstore manually if needed. * FAPI: Fix policy searching, when a policyRef was provided * FAPI: Accept EK-Certs without CRL dist point * FAPI: Fix return codes of Fapi_List * FAPI: Fix memleak in policy execution * FAPI: Fix coverity NULL-pointer check * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands * FAPI: Fix deleting of policy files. * FAPI: Fix wrong file loading during object search. * Fapi: Fix memory leak * Fapi: Fix potential NULL-Dereference * Fapi: Remove superfluous NULL check * Fix a memory leak in async keystore load. - small services fixes and comments - Clean spec file - Add new library libtss2-tcti-pcap0 - Update to 3.1.0: * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455) * Fixed possible access outside the array in ifapi_calculate_tree * Added pcap TCTI * Added GlobalSign TPM Root CA certs to FAPI cert store * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59 * Added two new TPM commands TPM2_CC_CertifyX509, and TPM2_CC_ACT_SetTimeout - Remove conflicting sysusers.d file - Version 3.1.0 includes: + cover update to 2.4.5 (jsc#SLE-17366) + cover update to 2.3.0 (jsc#SLE-9515) + fix policy session for TPM2_PolicyAuthValue (bsc#1160736) - Add version the configuration file tpm2-tss-fapi.conf - add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large RC values passed to the TSS2 function could lead to memory overread or memory overread. - add 0001-FAPI-Fix-check-of-magic-number-in-verify-quote.patch: fixes CVE-2024-29040 (bsc#1223690): Missing verification of the magic number in Fapi_VerifyQuote(), which might allow an attacker to generate arbitrary quote data, which would not be detected by Fapi_VerifyQuote(). - update to minor version 3.1.2 (FATE#326270): - Revert the change to use user supplied object attributes exclusively. This is an inappropriate behavioural change for a MINOR version number increment. - Fix inclusion of object attribute specifiers section in tpm2_create and tpm2_createprimary man pages. - Use better object attribute defaults for authentication, preventing an empty password being used for authentication when a policy is set. - update to minor version 3.1.3: - Restore support for the TPM2TOOLS_* env vars for TCTI configuration, in addition to supporting the new unified TPM2TOOLS_ENV_TCTI - Fix tpm2_getcap to print properties with the TPM_PT prefix, rather than TPM2_PT - Make test_tpm2_activecredential Python 3 compatible - Fix tpm2_takeownership to only attempt to change the specified hierarchies - use a _service file to sync with upstream tags - update to minor version 3.1.4: * Fix various man pages * tpm2_getmanufec: fix OSSL build warnings * Fix broken -T option * Various build compatibility fixes * Fix some unit tests * Update build for recent autoconf-archive versions * Install m4 files - update to major version 4.1: - changes in version 4.1: * tpm2_certifycreation: New tool enabling command TPM2_CertifyCreation. * tpm2_checkquote: - Fix YAML output bug. - -g option for specifying hash algorithm is optional and defaults to sha256. * tpm2_changeeps: A new tool for changing the Endorsement hierarchy primary seed. * tpm2_changepps: A new tool for changing the Platform hierarchy primary seed. * tpm2_clockrateadjust: Add a new tool for modifying the period on the TPM. * tpm2_create: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_createprimary: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_evictcontrol: - Fix bug in automatic persistent handle selection when hierarchy is platform. - Fix bug in YAML key action where action was wrong when using ESYS_TR. * tpm2_getcap: clean up remanenats of -c option in manpages and tool output. * tpm2_gettime: Add a new tool for retrieving a signed timestamp from a TPM. * tpm2_nvcertify: Add a new tool for certifying the contents of an NV index. * tpm2_nvdefine: - Support default set of attributes so -a is not mandatory. - Support searching for free index if an index isn't specified. * tpm2_nvextend: Add a new tool for extending an NV index similair to a PCR. * tpm2_nvreadpublic: - Support specifying nv index to read public data from as argument. * tpm2_nvsetbits: Add a new tool for setting the values of PCR with type "bits". * tpm2_nvundefine: Add support for deleting NV indices with attribute `TPMA_NV_POLICY_DELETE` set using NV Undefine Special command. * tpm2_nvwritelock: Add a new tool for setting a write lock on an NV index or globally locking nv indices with TPMA_NV_GLOBALLOCK. * tpm2_policyauthorizenv: New tool enabling signed, revocable policies. * tpm2_policyauthvalue: New tool enabling authorization to be bound to the authorization of another object. * tpm2_policycountertimer: Add a new tool for enabling policy bound to TPM clock or timer values. * tpm2_policynamehash: Add a new tool for specifying policy based on object name. * tpm2_policynv: Add a new tool for specifying policy based on NV contents. * tpm2_nvwritten: Add a new tool for specifying policy based on whether or not an NV index was written to. * tpm2_policysecret: Add tool options for specifying - --expiration or -t - --ticket - --timeout - --nonce-tpm or -x - --qualification or -q * tpm2_policysigned: New tool enabling policy command TPM2_PolicySigned. * tpm2_policytemplate: New tool enabling policy command TPM2_PolicyTemplate. * tpm2_policyticket: New tool enabling policy command TPM2_PolicyTicket. * tpm2_readclock: Add a new tool for reading the TPM clock. * tpm2_setclock: Add a new tool for setting the TPM clock. * tpm2_setprimarypolicy: New tool setting policy on hierarchies. * tpm2_shutdown: Add a new tool for issuing a TPM shutdown command. * misc: - Support "tpmt" as a public key output format that only saves the TPMT structure. - Qualifying data or extra data in many tools can be hex array string or binary file. - Add support for specifying NV index type when specifying NV attributes. - Support added for tools to run on FreeBSD. - Skip and notify of action that man pages will not install if the package pandoc is missing. - Fix precedence issue with bitwise operator order int tpm2_getcap - travis: bump abrmd version 2.3.0 - tpm2_util.c: Fix an issue int variable size was checked against uint - pcr.c: Fix buffer length issue to support all defined hash algorithm - changes in version 4.0.1: * tpm2_checkquote: Fix YAML output bug. - changes in version 4.0: * tpm2_activatecredential: - --context is now --credentialedkey-context. - --key-context is now --credentialkey-context. - --Password is now --credentialedkey-auth. - --endorse-passwd is now --credentialkey-auth. - --in-file is now --credential-secret. - --out-file is now --certinfo-data. - -f becomes -i. - -k becomes -C. - -e becomes -E. * tpm2_certify: - --halg is now --hash-algorithm. - --obj-context is now --certifiedkey-context. - --key-context is now --signingkey-context. - --pwdo is now --certifiedkey-auth. - --pwdk is now --signingkey-auth. - -a becomes -o. - -k becomes -p. - -c becomes -C. - -k becomes -K. * tpm2_changeauth: - New tool for changing the authorization values of: - Hierarchies - NV - Objects - Replaces tpm2_takeownership with more generic functionality. * tpm2_checkquote: - --halg is now --hash-algorithm. - --pcr-input-file is now --pcr. - --pubfile is now --public. - --qualify-data is now --qualification. - -f becomes -F. - -F becomes -f. - -G becomes -g. * tpm2_clear: - --lockout-passwd is now --auth-lockout. * tpm2_clearcontrol: - New tool for enabling or disabling tpm2_clear commands. * tpm2_create - --object-attributes is now --attributes. - --pwdp is now --parent-auth. - --pwdo is now --key-auth. - --in-file is now --sealing-input. - --policy-file is now --policy. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -o becomes -c. - -K becomes -p. - -A becomes -b. - -I becomes -i. - -g becomes an optional option. - -G becomes an optional option. - Supports TPM command CreateLoaded via -c. * tpm2_createak: - Renamed from tpm2_getpubak * tpm2_createek: - renamed from tpm2_getpubek * tpm2_createpolicy: - --out-policy-file is now --policy. - --policy-digest-alg is now --policy-algorithm. - --auth-policy-session is now --policy-session. - -L becomes -l. - -F becomes -f. - -f becomes -o. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - Removed short option a for specifying auth session. Use long option --policy-session. - Removed short option -P for specifying pcr policy. Use long option --policy-pcr. * tpm2_createprimary: - --object-attributes is now --attributes. - -o is now -c - --pwdp is now --hierarchy-auth. - --pwdk is now --key-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - --context-object is now --key-context. - --policy-file is now --policy. - support for unique field when creating objects via -u - saves a context file for the generated primary's handle to disk via -c. - -A becomes -a. - -K becomes -p. - -H becomes -C. - -g becomes optional. - -G becomes optional. * tpm2_dictionarylockout: - --lockout-passwd is now --auth. - -P becomes -p. * tpm2_duplicate: - New tool for duplicating TPM objects. * tpm2_encryptdecrypt: - --pwdk is now --auth. - --out-file is now --output. - -D becomes -d. - -I becomes an argument. - -P becomes -p. - Support IVs via -t or --iv. - Support modes via -G. - Support padding via -e or --pad. - Supports input and output to stdin and stdout respectively. * tpm2_evictcontrol: - --auth is now --hierarchy. - --context is now --object-context. - --pwda is now --auth. - --persistent with short option -S is now an argument. - -A becomes -C. - Added option --output -o to serialize handle to disk. - Removed option --handle with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -i. - Authorization session is now part of password mini language. * tpm2_getcap: - -c becomes an argument. - Most instances of value replaced with raw in YAML output. - TPM2_PT_MANUFACTURER displays string value and raw value. - Supports --pcr option for listing hash algorithms and bank numbers. * tpm2_getekcertificate: - Renamed from tpm2_getmanufec * tpm2_getmanufec: - Renamed the tool to tpm2_getekcertificate. - Removed ek key creation and management logic. - Added option for getting ek cert for offline platform via -x. - Support for ECC keys. - --ec-cert is now --ek-certificate, - --untrusted is now --allow-unverified, - --output is now --ek-public, - -U is now -X. - -O is now -x. - -f becomes -o. - Removed option -P or --endorse-passwd. - Removed option -p or --ek-passwd. - Removed option -w or --owner-passwd. - Removed option -H or --persistent-handle. - Removed option -G or --key-algorithm. - Removed option -N or --non-persistent. - Removed option -O or --offline. * tpm2_getpubak: - renamed to tpm2_createak. - -f becomes -p and -f is used for format of public key output. - --auth-endorse is now --eh-auth. - --auth-ak is now --ak-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -e becomes -P. - -P becomes -p. - -D becomes -g. - -p becomes -u. - --context becomes --ak-context. - --algorithm becomes --kalg. - --digest-alg becomes --halg. - --privfile becomes --private. - remove -k persistant option. Use tpm2_evictcontrol. - Fix -o option to -w. - now saves a context file for the generated primary's handle to disk. - -E becomes -e. - -g changes to -G. - support for non-persistent AK generation. * tpm2_getpubek: - renamed to tpm2_createek - --endorse-passwd is now --eh-auth. - --owner-passwd is now --owner-auth. - --ek-passwd is now --ek-auth. - --file is now --public. - --context is now --ek-context. - --algorithm is now --key-algorithm. - -e is now -P. - -P is now -p. - -p is now -u. - -o is now -w. - -g is now -G. - Support for saving a context file for the generated primary keys handle to disk. - support for non-persistent EK generation. - -f is now -p. - -f support for format of public key output. * tpm2_getrandom: - change default output to binary. - add --hex option for output to hex format. - --out-file is now --output. - bound input request on max hash size per spec, allow -f to override this. * tpm_gettestresult: - new tool for getting test results. * tpm2_hash: - add --hex for specifying hex output. - default output of hash to stdout. - default output of hash as binary. - remove output of ticket to stdout. - --halg is now --hash-algorithm. - --out-file is now --output. - -a is now -C. - -H is now -a. * tpm2_hmac: - add -t option for specifying ticket result. - --out-file is now --output. - --auth-key is now --auth. - --algorithm is now --hash-algorithm. - --pwdk is now --auth-key. - -C is now -c. - -P is now -p. * tpm2_hierarchycontrol: - new tool added for enabling or disabling the use of a hierarchy and its associated NV storage. * tpm2_import: - --object-attributes is now --attributes. - --auth-parent is now --parent-auth. - --auth-key is now --key-auth. - --algorithm is now --key-algorithm. - --in-file is now --input. - --parent-key is now --parent-context. - --privfile is now --private. - --pubfile is now --public. - --halg is now --hash-algorithm. - --policy-file is now --policy. - --sym-alg-file is now --encryption-key. - -A is now -b. - -k is now -i. - support OSSL style -passin argument as --passin for PEM file passwords. - support additional import key types: - RSA1024/2048. - AES128/192/256. - -q changes to -u to align with tpm2_loads public/private output arguments. - Supports setting object name algorithm via -g. - support specifying parent key with a context file. - --parent-key-handle/-H becomes --parent-key/-C - Parent public data option is optional and changes from `-K` to `-U`. - Supports importing external RSA 2048 keys via pem files. - Supports ECC Parent keys. * tpm2_incrementalselftest: - Add tool to test support of specific algorithms. * tpm2_listpersistent: - deleted as tpm2_getcap and tpm2_readpublic can be used instead. * tpm2_load: - -o is now -c. - --context-parent is now --parent-context. - --auth-parent is now --auth. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - now saves a context file for the generated primary's handle to disk. - Option `--pwdp` changes to `--auth-parent`. * tpm2_loadexternal: - --object-attributes is now --attributes. - -o is now -c - --key-alg is now --key-algorithm. - --pubfile is now --public. - --privfile is now --private. - --auth-key is now --auth. - --policy-file is now --policy. - --halg is now --hash-algorithm. - --out-context is now --key-context. - Remove unused -P option. - -H is now -a. - Fix -A option to -b for attributes. - now saves a context file for the generated primary's handle to disk. - support OSSL style -passin argument as --passin for PEM file passwords. - name output to file and stdout. Changes YAML stdout output. - ECC Public and Private PEM support. - AES Public and Private "raw file" support. - RSA Public and Private PEM support. - Object Attribute support. - Object authorization support. - Default hierarchy changes to the *null* hierarchy. * tpm2_makecredential: - --out-file is now --credential-blob - --enckey is now --encryption-key. - Option `--sec` changes to `--secret`. * tpm2_nvdefine: - --handle-passwd is now --hierarchy-auth. - --index-passwd is now --index-auth. - --policy-file is now --policy. - --auth-handle is now --hierarchy. - -a becomes -C. - -t becomes -a. - -I becomes -p. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvincrement: - New tool to increment value of a Non-Volatile (NV) index setup as a counter. * tpm2_nvlist: - tpm2_nvlist is now tpm2_nvreadpublic. * tpm2_nvread: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - fix a buffer overflow. * tpm2_nvreadlock: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvwrite: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_nvrelease: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvundefine: - Renamed from tpm2_nvrelease. * tpm2_pcrallocate: - New tool for changing the allocated PCRs of a TPM. * tpm2_pcrevent: - --password is now --auth. - Removed option --pcr-index with short option -i. - PCR index is now specified as an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_pcrlist: - -gls options go away with -g and -l becoming a single argument. * tpm2_pcrread: - Renamed from tpm2_pcrlist. * tpm2_print: - New tool that decodes a TPM data structure and prints enclosed elements to stdout as YAML. * tpm2_policyauthorize: - New tool that allows for policies to change by associating the policy to a signing authority essentially allowing the auth policy to change. * tpm2_policycommandcode: - New tool to restricts TPM object authorization to specific TPM commands. * tpm2_policyduplicationselect: - New tool for creating a policy to restrict duplication to a new parent and or duplicable object. * tpm2_policylocality: - New tool for creating a policy restricted to a locality. * tpm2_policypcr: - New tool to generate a pcr policy event that bounds auth to specific PCR values in user defined pcr banks and indices. * tpm2_policyor: - New tool to compound multiple policies in a logical OR fashion to allow multiple auth methods using a policy session. * tpm2_policypassword: - New tool to mandate specifying of the object password in clear using a policy session. * tpm2_policysecret: - New tool to associate auth of a reference object as the auth of the new object using a policy session. * tpm2_quote: - --ak-context is now --key-context. - --ak-password is now --auth. - --sel-list is now --pcr-list. - --qualify-data is now --qualification-data. - --pcrs is now --pcr. - --sig-hash-algorithm is now --hash-algorithm. - -P becomes -p - -L becomes -l. - -p becomes -o. - -G becomes -g. - -g becomes optional. - Removed option --id-list with short option -l. - Removed option --ak-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. * tpm2_readpublic: - --opu is now --output. - --context-object is now --object-context. - Removed option --object with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Added --serialized-handle for saving serialized ESYS_TR handle to disk. - Added --name with short option -n for saving the binary name. - Supports ECC pem and der file generation. * tpm2_rsadecrypt: - --pwdk is now --auth. - --out-file is now --output. - -P becomes -p. - Added --label with short option -l for specifying label. - Added --scheme with short option -s for specifying encryption scheme. - Removed option -I or in-file input option and make argument. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_rsaencrypt: - --out-file is now --output. - Added --scheme with short option -s for specifying encryption scheme. - Added --label with -l for specifying label. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - make output binary either stdout or file based on -o. * tpm2_selftest: - New tool for invoking tpm selftest. * tpm2_send: - --out-file is now --output. * tpm2_sign: - --pwdk is now --auth. - --halg is now --hash-algorithm. - --sig is now --signature. - -P becomes -p. - -s becomes -o. - Added --digest with short option -d. - Added --scheme with short option -s. - Supports rsapss. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --msg with short option -m. - Make -d toggle if input is a digest. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Supports signing a pre-computed hash via -d. * tpm2_startauthsession: - New tool to start/save a trial-policy-session (default) or policy- authorization-session with command line option --policy-session. * tpm2_stirrandom: - new command for injecting entropy into the TPM. * tpm2_takeownership: - split into tpm2_clear and tpm2_changeauth * tpm2_testparms: - new tool for querying tpm for supported algorithms. * tpm2_unseal: - --pwdk is now --auth. - --outfile is now --output. - --item-context is now --object-context. - -P becomes -p - Removed option --item with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_verifysignature: - --halg is now --hash-algorithm. - --msg is now --message. - --sig is now --signature. - -D becomes -d. - -t becomes optional. - Issue warning when ticket is specified for a NULL hierarchy. - Added option --format with short option -f. - Removed option --raw with short option -r. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Support routines for OpenSSL compatible format of public keys (PEM, DER) and plain signature data without TSS specific headers. * misc: - cmac algorithm support. - Add support for reading authorisation passwords from a file. - Ported all tools from SAPI to ESAPI. - Load TCTI's by SONAME, not raw .so file. - system tests are now run with make check when --enable-unit is used in configure. - Libre SSL builds fixed. - Dynamic TCTIS. Support for pluggable TCTI modules via the -T or --tcti options. - test: system testing scripts moved into subordinate test directory. - configure: enable code coverage option. - env: add TPM2TOOLS_ENABLE_ERRATA to control the -Z or errata option. affects all tools. - Fix parsing bug in PCR mini-language. - Fix misspelling of TPM2_PT_HR constants which effects tpm2_getcap output. - configure option --with-bashcompdir for specifying bash completion directory. - changes in version 3.2.1: * Fix invalid memcpy when extracting ECDSA plain signatures. * Fix resource leak on FILE * in hashing routine. * Correct PCR logic to prevent memory corruption bug. * Errata handler fix. - changes in version 3.2.0: * fix configure bug for linking against libmu. * tpm2_changeauth: Support changing platform hierarchy auth. * tpm2_flushcontext: Introduce new tool for flushing handles from the TPM. * tpm2_checkquote: Introduce new tool for checking validity of quotes. * tpm2_quote: Add ability to output PCR values for quotes. * tpm2_makecredential: add support for executing tool off-TPM. * tpm2_pcrreset: introduce new tool for resetting PCRs. * tpm2_quote: Fix AK auth password not being used. - add fix_bad_bufsize.patch: fixes findings from compile time fread() checks that indicate bad buffer size specification. - add fix_bogus_warning.patch: fixes `maybe-unitialized` warnings that are bogus, since the variables in questions will be initialized in any case later on. - update to version 4.3: - changes in version 4.3: - tss2_*: Fix double-free errors in commands asking for password authorization - tss2_*: Fix shorthand command -f that was falsely requiring an argument - tss2_*: Update tss2_encrypt to the new FAPI interface - The argument 'policyPath' is removed which was never read anyway - tss2_*: Remove the additional '\n' that was appended when redirecting to stdout - tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec - tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo - tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout - tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec - tss2_*: Add parameter types to all man page - tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data - tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output - tss2_pcrextend: fix extending PCR 0 - tss2_quote: fix unused TSS2_RC in LOG_ERR - changes in 4.2.1: - Fix missing handle maps for ESY3 handle breaks. See #1994. - Bump ESYS minimum dependency version from 2.3.0 to 2.4.0. - Fix for loop declarations build error. - changes in 4.2: - Fix various issues reported by static analysis tools. - Add integration test for ECC based getekcertificate. - Fix for issue #1959 where ARM builds were failing. - Add a check in autotools to add "expect" as a package dependency for fapi tools. - tpm2_createek: Drop the unused -p or --ek-auth option - tpm2_policyor: List of policy files should be specified as an argument - instead of -l option. The -l option is still retained for backwards - compatibility. See issue#1894. - tpm2_eventlog: add a tool for parsing and displaying the event log. - tpm2_createek: Fix an issue where the template option looked for args - tpm2_hierarchycontrol: Fixed bug where tool operation failed silently - tpm2_nvdefine: Fixed an issue where text output suggested failures as passes - tpm2_certify: Add an example usage in man page - tpm2_policyor: Fix a bug where tool failed silently when no input were given - tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address - tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed - .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations - tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command - Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. - tpm2_import: Fix an issue where the imported key always required to have a policy - tpm2_policysecret: Fix an issue where authorization model was fixed to password only - Feature API (FAPI) tools added. These additional set of tools implement utilities - using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv - tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons. - changes in 4.1.1: - tpm2_certify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed. - tpm2_gettime: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvcertify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvreadpublic: add name hash output. - tpm2_import: Support object policies when importing raw key material. - Fix overflow in pcrs.h where sizeof() was used instead of ARRAY_LEN(). - build: - Fix compilation issue: lib/tpm2_hash.c:17:19: note: 'left' was declared here. - man: - Fix manpage examples that have "sha" instead of "sha1" - tpm2_shutdown manpage was missing, add it to build. - Fix manpage example for tpm2_createak's tpm2_evictcontrol example. - Remove fix_bad_bufsize.patch: is now contained in upstream tarball - Adjust fix_bogus_warning.patch: one hunk no longer applies, upstream code changed. - add fix_warnings.patch: fixes a couple of build errors resulting from LTO linking and -Werror. - add fix_pie_linking.patch: fixes an error in the build system that causes the tss2 binary to be linked without passed LDFLAGS (like -pie), which causes the binary not to be position independent. - update to major version 5.0: - Non Backwards Compatible Changes * Default hash algorithm is now sha256. Prior versions claimed sha1, but were inconsistent in choice. Best practice is to specify the hash algorithm to avoid surprises. * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie tpm2_getrandom becomes tpm2 getrandom. make install will install symlinks to the old tool names and the tpm2 commandlet will interrogate argv[0] for the command to run. This will provide backwards compatibility if they are installed. If you wish to use the old names not installed system wide, set DESTDIR during install to a separate path and set the proper directory on PATH. * tpm2_eventlog's output changed to be YAML compliant. The output before was intended to be YAML compliant but was never properly checked and tested. * umask set to 0117 for all tools. * tpm2_getekcertificate now outputs the INTC EK certificates in PEM format by default. In order to output the URL safe variant of base64 encoded output of the INTC EK certificate use the added option --raw. - Dependency update * Update tpm2-tss dependency version to 3.0.1 * Update tpm2-abrmd dependency version to 2.3.3 - New tools and features * tpm2_zgen2phase: Add new tool to support command TPM2_CC_ZGen_2Phase. * tpm2_ecdhzgen: Add new tool to support command TPM2_CC_ECDH_ZGen. * tpm2_ecdhkeygen: Add new tool to support command TPM2_CC_ECDH_KeyGen. * tpm2_commit: Add new tool to support command TPM2_CC_Commit. * tpm2_ecephemeral: Add new tool to support command TPM2_CC_EC_Ephemeral. * tpm2_geteccparameters: Add new tool to support command TPM2_CC_ECC_Parameters. * tpm2_setcommandauditstatus: Added new tool to support command TPM2_CC_SetCommandCodeAuditStatus. * tpm2_getcommandauditstatus: Added new tool to support command TPM2_CC_GetCommandAuditDigest. * tpm2_getsessionauditdigest: Added new tool to support command TPM2_CC_GetSessionAuditDigest. * tpm2_certifyX509certutil: Added new tool for creating partial x509 certificates required to support the TPM2_CC_CertifyX509 command. * tpm2_policysigned: Added option --cphash-input to specify the command parameter hash (cpHashA), enforcing the TPM command to be authorized as well as its handle and parameter values. * tpm2_createprimary: Added option to specify the unique data from the stdin by adding provision for specifying the option value for unique file as -. * tpm2_startauthsession: Added new feature/option --audit-session to start an HMAC session to be used as an audit session. * tpm2_getrandom: - Added new feature/option -S, --session to specify a HMAC session to be used as an audit session. This adds support for auditing the command using an audit session. - Added new feature/option --rphash to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. - Added new feature/option --cphash to specify a file path to record the hash of the command parameters. This is commonly termed as cpHash. NOTE: In absence of --rphash option, when this option is selected, The tool will not actually execute the command, it simply returns a cpHash. * tpm2_getcap: tpm2_getcap was missing raw on a property TPM2_PT_REVISION, and it should always be specified. * tpm2_sign: - Add option --commit-index to specify the commit index to use when performing an ECDAA signature. - Add support for ECDAA signature. * tpm2_getekcertificate: - Add option --raw to output EK certificate in URL safe variant base64 encoded format. By default it outputs a PEM formatted certificate. - The tool can now output INTC and non INTC EK certificates from NV indices specified by the TCG EK profile specification. * tpm2_activatecredential: - The secret data input can now be specified as stdin with -s option. - The public key used for encryption can be specified as -u to make it similar to rest of the tools specifying a public key. The old -e option is retained for backwards compatibility. - Add option to specify the key algorithm when the input public key is in PEM format using the new option -G, --key-algorithm. Can specify either RSA/ECC. When this option is used, input public key is expected to be in PEM format and the default TCG EK template is used for the key properties. * tpm2_checkqoute: - Add EC support. - Support loading tss signatures. - Support loading tpm2 pcrread PCR values by specifying the PCR selection using the new option -l, --pcr-list. - Added support for automatically detecting the signature format. With this -F, --format option is retained for backwards compatibility but it is deprecated. * tpm2_createak: add option to output qualified name with new option - q, --ak-qualified-name. * tpm2_policypcr: Add option for specifying cumulative hash of PCR's as an argument. * tpm2_readpublic: Add option to output qualified name using the new option - q, --qualified-name. * tpm2_print: - Support printing TPM2B_PUBLIC data structures. - Support printing TPMT_PUBLIC data structures. * tpm2_send: Add support for handling sending and receiving command and response buffer for multiple commands. * tpm2_verifysignature: Added support for verifying RSA-PSS signatures. * tpm2_eventlog: - Add handling of sha1 log format. - Add fixes for eventlog output to be proper YAML. - Add support for sha384, sha512, sm3_256 PCR hash algorithms. - Add support for computing PCR values based on the events. * tpm2_tools (all): - Set stdin/stdout to non-buffering. - Added changes for FreeBSD portability. - Bug fixes * Fix printing short options when no ascii character is used. * OpenSSL: Fix deprecated OpenSSL functions. ECC Functions with suffix GFp will become deprecated (DEPRECATED_1_2_0). * tpm2_eventlog: output EV_POST_CODE as string not firmware blob to be compliant with TCG PC Client FPF section 2.3.4.1 and 9.4.12.3.4.1 * Fix missing handle maps for ESY3 handle breaks. See #1994. * tpm2_rsaencrypt: fix OAEP RSA encryption failing to invalid hash selection. * tpm2_rsadecrypt: fix OAEP RSA decryption failing to invalid hash selection. * tpm2_sign: fix for signing failures with restricted signing keys when input data to sign is not a digest, rather the full message. The validation ticket creation process defaults to the owner hierarchy and so in order to choose other hierarchies the tpm2_hash tool should be used instead. * tpm2_print: fix segfault when -t option is omitted by appropriately warning of the required option. * tpm2_nvdefine: fix for default size when size is not specified by invoking TPM2_CC_GetCapability. * Fix for an issue where the return code for unsupported algorithms was tool_rc_general instead of tool_rc_unsupported in tpm2_create and tpm2_createprimary tools. * Fix for an issue where RSA_PSS signature verification caused failures. * tpm2_nvreadpublic, tpm2_kdfa, tpm2_checkquote, tpm2_quote: Fixes for issues with interoperability of the attestation tools between big and little endian platforms. * tss2_*: - Fix bash-completion for tss2_pcrextend and tss2_verifysignature - Add force option to tss2_list - Make force option consistent in all fapi tools - Do not decode non-TPM errors - Enhance integration tests to test changes of optional/mandatory parameters - Add --hex parameter to tss2_getrandom - Fix autocompletion issue - Switch tss2_* to with-"="-style - Add size parameter to tss2_createseal - References to the cryptographic profile (fapi-profile(5)) and config file - (fapi-config(5)) man pages from all relevant tss2_* man pages. - Fix policy branch selection menu item from 1 to 0. - Documentation * wiki pages have been removed and data has been migrated to tpm2-software.github.io portal's tutorial section. * Fix the problem with man and no-man help output for tools were not correctly displayed. * man: - tpm2_create: Correct max seal data size from 256 bytes to 128 bytes. - tpm2_nvread: Fix manpage example. - tpm2_nvwrite: Added missing information on how to specify the NV index as an argument. - tpm2_unseal: Add end-to-end example. - tpm2_nvincrement: Fix incorrect commands in example section. - tpm2_hmac: Fix the example section. - fix `--version` output of tools. Since now autoreconf is called and configure.ac attempts to fetch the version from git (which we don't have during building), the version was empty. Fix this by replacing the git invocation in configure.ac. - add 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch: no longer use a fixed AES key in the context of the tpm2_import command. Fixes CVE-2021-3565 (bsc#1186490). - drop fix_pie_linking.patch: now contained in upstream tarball - drop fix_warnings.patch: now contained in upstream tarball - update to upstream version 5.1: - Minimum tpm2-tss version dependency bumped to 3.1.0 - Minimum tpm2-abrmd version dependency bumped to 2.4.0 - tss2: - Support in tools for PolicyRef inclusion in policy search per latest TSS. - Support to use TPM objects protected by a policy with PolicySigned. - Enable backward compatibility to old Fapi callback API. - Fix PCR selection for tss2 quote. - Support policy signed policies by implementing Fapi_SetSignCB. - Command/ response parameter support for auditing and pHash policies: - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash - Add support to calculate rphash for tpm2_create, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps. - Session-support: - tpm2_sessionconfig: Add tool to display and configure session attributes. - tpm2_getrandom: Fix— session input was hardcoded for audit-only - tpm2_startauthsession: Add option to specify the bind object and its authorization value. - tpm2_startauthsession: support for bounded-only session. - tpm2_startauthsession: support for salted-only session. - tpm2_startauthsession: add option to specify an hmac session type. - Add support for specifying non-authorization sessions for audit and parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend, tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps. - tpm2_eventlog: - Support for event type: EV_IPL extensively used by the Shim and Grub. - Support for event type: EV_EFI_GPT_EVENT to parse. UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY. - Support for event type: EFI_SIGNATURE_LIST, which contains one or more EFI_SIGNATURE_DATA. - Support for event type EV_EFI_VARIABLE_AUTHORITY. - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into the Event Log entry TCG_PCR_EVENT2.event field for event types EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB. - Parse secureboot variable to indicate enable as 'Yes'. - Parse BootOrder variable to a more readable format. - Parse Boot variables per EFI_LOAD_OPTION described in more details in UEFI Spec Section 3.1.3 - Parse Device-path in a readable format using the efivar library. - Support for logs longer than 64 kilobytes. - Perform verification for event types where digest can be verified from their event payload. - Better support for multiline strings. - Fix handling of event log EV_POST_CODE data where field is empty and len is specified. - scripts/utils: Add a utility to read the cert chain of embedded CA. - tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404. - tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV indices set in extend mode. - tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM without first requiring them to be loaded to a local TPM. - tpm2_dictionarylockout: Fix issue where setting value for one parameter caused to reset the others. - tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest. - Fix segfault where optind > argc. - tools/tpm2_checkquote: fix missing initializer - tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0 - openssl: fix EVP_ENCODE_CTX_(new|free) - test: Add support for swTPM simulator to the testing framework and make it the default if mssim isn't available. - tpm2_unseal: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvextend: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvdefine: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_changepps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeeps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeauth: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certifycreation: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certify: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_activatecredential: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_create: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_unseal: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvdefine: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvextend: - Added option **-S**, **--session** to specify auxilary sessions for audit and encryption. - Do not BuildRequire pandoc on ix86 architectures: the haskell stack is not supported on intel 32bit archs. - Disable lto to fix tpm2_checkquote error (boo#1187316) - Update service file to point to the correct revision - Add 0001-tpm2_checkquote-fix-uninitialized-variable.patch for a better fix of boo#1187316 - Re-enable lto - Add 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch to fix the tpm2_eventlog command (boo#1187360) - update to version 5.1.1: - tpm2_import: fix fixed AES key CVE-2021-3565 - tpm2_import used a fixed AES key for the inner wrapper, which means that a MITM attack would be able to unwrap the imported key. To fix this, ensure the key size is 16 bytes or bigger and use OpenSSL to generate a secure random AES key. - Avoid pandoc build dependency, use prebuilt man pages everywhere - Drop 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch, now upstream - Drop _service, unused - Drop unused unzip build dependency - Drop autoreconfigure call, no longer necessary - Use %autosetup - Verify tarball signature - Build against efivar - Drop %check section, tests weren't built, so that was a noop - prepare running the test suite via %check, but leave it commented out, because it is broken due to LTO linking. - Add 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch to fix the offset of the read buffer - Update to version 5.2: + tpm2_nvextend: * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_Extend command to the TPM. + tpm2_nvread: * Added option --rphash=FILE to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NVRead command to the TPM. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. + tpm2_nvsetbits: * Added option --rphash=FILE to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_SetBits command to the TPM. + tpm2_createprimary: * Support public-key output at creation time in various public-key formats. + tpm2_create: * Support public-key output at creation time in various public-key formats. + tpm2_print: * Support outputing public key in various public key formats over the default YAML output. Supports taking -u output from tpm2_create and converting it to a PEM or DER file format. + tpm2_import: * Add support for importing keys with sealed-data-blobs. + tpm2_rsaencrypt, tpm2_rsadecrypt: * Add support for specifying the hash algorithm with oaep. + tpm2_pcrread, tpm2_quote: * Add option -F, --pcrs_format to specify PCR format selection for the binary blob in the PCR output file. 'values' will output a binary blob of the PCR values. 'serialized' will output a binary blob of the PCR values in the form of serialized data structure in little endian format. + tpm2_eventlog: * Add support for decoding StartupLocality. * Add support for printing the partition information. * Add support for reading eventlogs longer than 64kb including from /sys/kernel/security/tpm0/binary_bios-measurements. + tpm2_duplicate: * Add option -L, --policy to specify an authorization policy to be associated with the duplicated object. * Added support for external key duplication without needing the TCTI. + tools: * Enhance error message on invalid passwords when sessions cannot be used. + lib/tpm2_options: * Add option to specify fake tcti which is required in cases where sapi ctx is required to be initialized for retrieving command parameters without invoking the tcti to talk to the TPM. + openssl: * Dropped support for OpenSSL < 1.1.0 * Add support for OpenSSL 3.0.0 + Support added to make the repository documentation and man pages available live on readthedocs. + Bug-fixes: * tpm2_import: Don't allow setting passwords for imported object with -p option as the tool doesn't modify the TPM2B_SENSITIVE structure. Added appropriate logging to indicate using tpm2_changeauth after import. * lib/tpm2_util.c: The function to calculate pHash algorithm returned error when input session is a password session and the only session in the command. * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under ECC. * tpm2_sign: Fix segfaults when tool does not find TPM resources (TPM or RM). * tpm2_makecredential: Fix an issue where reading input from stdin could result in unsupported data size larger than the largest digest size. * tpm2_loadexternal: Fix an issue where restricted attribute could not be set. * lib/tpm2_nv_util.h: The NV index size is dependent on different data sets read from the GetCapability structures because there is a dependency on the NV operation type: Define vs Read vs Write vs Extend. Fix a sane default in the case where GetCapability fails or fails to report the specific property/ data set. This is especially true because some properties are TPM implementation dependent. * tpm2_createpolicy: Fix an issue where tool exited silently without reporting an error if wrong pcr string is specified. * lib/tpm2_alg_util: add error message on public init to prevent tools from dying silently, add an error message. * tpm2_import: fix an issue where an imported hmac object scheme was NULL. While allowed, it was inconsistent with other tools like tpm2_create which set the scheme as hmac->sha256 when generating a keyedhash object. - Drop patches already in upstream: + 0001-tpm2_checkquote-fix-uninitialized-variable.patch + 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch + 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch - Fix python3-PyYAML requirement - Move the tests inside a bcond. Disabled by default. - The update to 5.2 fill also jsc#SLE-9515 (4.1) and jsc#SLE-17366 (4.3.0) - Add 0001-tpm2_checkquote-Fix-check-of-magic-number.patch: tpm2_checkquote did not check whether the magic number in the attest is equal to TPM2_GENERATED_VALUE, which might allow a malicious actor to generate arbitrary quote data, undetected by tpm2_checkquote (bsc#1223687, CVE-2024-29038). - Add 0001-tpm2_checkquote-Add-comparison-of-pcr-selection.patch: tpm2_checkquote did not compare the --pcr parameter passed to the tool with the attest. A malicious actor might thus be able to fake a valid attestation (bsc#1223689, CVE-2024-29039). - update to minor version 3.1.2 (FATE#326270): - Revert the change to use user supplied object attributes exclusively. This is an inappropriate behavioural change for a MINOR version number increment. - Fix inclusion of object attribute specifiers section in tpm2_create and tpm2_createprimary man pages. - Use better object attribute defaults for authentication, preventing an empty password being used for authentication when a policy is set. - update to minor version 3.1.3: - Restore support for the TPM2TOOLS_* env vars for TCTI configuration, in addition to supporting the new unified TPM2TOOLS_ENV_TCTI - Fix tpm2_getcap to print properties with the TPM_PT prefix, rather than TPM2_PT - Make test_tpm2_activecredential Python 3 compatible - Fix tpm2_takeownership to only attempt to change the specified hierarchies - use a _service file to sync with upstream tags - update to minor version 3.1.4: * Fix various man pages * tpm2_getmanufec: fix OSSL build warnings * Fix broken -T option * Various build compatibility fixes * Fix some unit tests * Update build for recent autoconf-archive versions * Install m4 files - update to major version 4.1: - changes in version 4.1: * tpm2_certifycreation: New tool enabling command TPM2_CertifyCreation. * tpm2_checkquote: - Fix YAML output bug. - -g option for specifying hash algorithm is optional and defaults to sha256. * tpm2_changeeps: A new tool for changing the Endorsement hierarchy primary seed. * tpm2_changepps: A new tool for changing the Platform hierarchy primary seed. * tpm2_clockrateadjust: Add a new tool for modifying the period on the TPM. * tpm2_create: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_createprimary: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_evictcontrol: - Fix bug in automatic persistent handle selection when hierarchy is platform. - Fix bug in YAML key action where action was wrong when using ESYS_TR. * tpm2_getcap: clean up remanenats of -c option in manpages and tool output. * tpm2_gettime: Add a new tool for retrieving a signed timestamp from a TPM. * tpm2_nvcertify: Add a new tool for certifying the contents of an NV index. * tpm2_nvdefine: - Support default set of attributes so -a is not mandatory. - Support searching for free index if an index isn't specified. * tpm2_nvextend: Add a new tool for extending an NV index similair to a PCR. * tpm2_nvreadpublic: - Support specifying nv index to read public data from as argument. * tpm2_nvsetbits: Add a new tool for setting the values of PCR with type "bits". * tpm2_nvundefine: Add support for deleting NV indices with attribute `TPMA_NV_POLICY_DELETE` set using NV Undefine Special command. * tpm2_nvwritelock: Add a new tool for setting a write lock on an NV index or globally locking nv indices with TPMA_NV_GLOBALLOCK. * tpm2_policyauthorizenv: New tool enabling signed, revocable policies. * tpm2_policyauthvalue: New tool enabling authorization to be bound to the authorization of another object. * tpm2_policycountertimer: Add a new tool for enabling policy bound to TPM clock or timer values. * tpm2_policynamehash: Add a new tool for specifying policy based on object name. * tpm2_policynv: Add a new tool for specifying policy based on NV contents. * tpm2_nvwritten: Add a new tool for specifying policy based on whether or not an NV index was written to. * tpm2_policysecret: Add tool options for specifying - --expiration or -t - --ticket - --timeout - --nonce-tpm or -x - --qualification or -q * tpm2_policysigned: New tool enabling policy command TPM2_PolicySigned. * tpm2_policytemplate: New tool enabling policy command TPM2_PolicyTemplate. * tpm2_policyticket: New tool enabling policy command TPM2_PolicyTicket. * tpm2_readclock: Add a new tool for reading the TPM clock. * tpm2_setclock: Add a new tool for setting the TPM clock. * tpm2_setprimarypolicy: New tool setting policy on hierarchies. * tpm2_shutdown: Add a new tool for issuing a TPM shutdown command. * misc: - Support "tpmt" as a public key output format that only saves the TPMT structure. - Qualifying data or extra data in many tools can be hex array string or binary file. - Add support for specifying NV index type when specifying NV attributes. - Support added for tools to run on FreeBSD. - Skip and notify of action that man pages will not install if the package pandoc is missing. - Fix precedence issue with bitwise operator order int tpm2_getcap - travis: bump abrmd version 2.3.0 - tpm2_util.c: Fix an issue int variable size was checked against uint - pcr.c: Fix buffer length issue to support all defined hash algorithm - changes in version 4.0.1: * tpm2_checkquote: Fix YAML output bug. - changes in version 4.0: * tpm2_activatecredential: - --context is now --credentialedkey-context. - --key-context is now --credentialkey-context. - --Password is now --credentialedkey-auth. - --endorse-passwd is now --credentialkey-auth. - --in-file is now --credential-secret. - --out-file is now --certinfo-data. - -f becomes -i. - -k becomes -C. - -e becomes -E. * tpm2_certify: - --halg is now --hash-algorithm. - --obj-context is now --certifiedkey-context. - --key-context is now --signingkey-context. - --pwdo is now --certifiedkey-auth. - --pwdk is now --signingkey-auth. - -a becomes -o. - -k becomes -p. - -c becomes -C. - -k becomes -K. * tpm2_changeauth: - New tool for changing the authorization values of: - Hierarchies - NV - Objects - Replaces tpm2_takeownership with more generic functionality. * tpm2_checkquote: - --halg is now --hash-algorithm. - --pcr-input-file is now --pcr. - --pubfile is now --public. - --qualify-data is now --qualification. - -f becomes -F. - -F becomes -f. - -G becomes -g. * tpm2_clear: - --lockout-passwd is now --auth-lockout. * tpm2_clearcontrol: - New tool for enabling or disabling tpm2_clear commands. * tpm2_create - --object-attributes is now --attributes. - --pwdp is now --parent-auth. - --pwdo is now --key-auth. - --in-file is now --sealing-input. - --policy-file is now --policy. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -o becomes -c. - -K becomes -p. - -A becomes -b. - -I becomes -i. - -g becomes an optional option. - -G becomes an optional option. - Supports TPM command CreateLoaded via -c. * tpm2_createak: - Renamed from tpm2_getpubak * tpm2_createek: - renamed from tpm2_getpubek * tpm2_createpolicy: - --out-policy-file is now --policy. - --policy-digest-alg is now --policy-algorithm. - --auth-policy-session is now --policy-session. - -L becomes -l. - -F becomes -f. - -f becomes -o. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - Removed short option a for specifying auth session. Use long option --policy-session. - Removed short option -P for specifying pcr policy. Use long option --policy-pcr. * tpm2_createprimary: - --object-attributes is now --attributes. - -o is now -c - --pwdp is now --hierarchy-auth. - --pwdk is now --key-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - --context-object is now --key-context. - --policy-file is now --policy. - support for unique field when creating objects via -u - saves a context file for the generated primary's handle to disk via -c. - -A becomes -a. - -K becomes -p. - -H becomes -C. - -g becomes optional. - -G becomes optional. * tpm2_dictionarylockout: - --lockout-passwd is now --auth. - -P becomes -p. * tpm2_duplicate: - New tool for duplicating TPM objects. * tpm2_encryptdecrypt: - --pwdk is now --auth. - --out-file is now --output. - -D becomes -d. - -I becomes an argument. - -P becomes -p. - Support IVs via -t or --iv. - Support modes via -G. - Support padding via -e or --pad. - Supports input and output to stdin and stdout respectively. * tpm2_evictcontrol: - --auth is now --hierarchy. - --context is now --object-context. - --pwda is now --auth. - --persistent with short option -S is now an argument. - -A becomes -C. - Added option --output -o to serialize handle to disk. - Removed option --handle with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -i. - Authorization session is now part of password mini language. * tpm2_getcap: - -c becomes an argument. - Most instances of value replaced with raw in YAML output. - TPM2_PT_MANUFACTURER displays string value and raw value. - Supports --pcr option for listing hash algorithms and bank numbers. * tpm2_getekcertificate: - Renamed from tpm2_getmanufec * tpm2_getmanufec: - Renamed the tool to tpm2_getekcertificate. - Removed ek key creation and management logic. - Added option for getting ek cert for offline platform via -x. - Support for ECC keys. - --ec-cert is now --ek-certificate, - --untrusted is now --allow-unverified, - --output is now --ek-public, - -U is now -X. - -O is now -x. - -f becomes -o. - Removed option -P or --endorse-passwd. - Removed option -p or --ek-passwd. - Removed option -w or --owner-passwd. - Removed option -H or --persistent-handle. - Removed option -G or --key-algorithm. - Removed option -N or --non-persistent. - Removed option -O or --offline. * tpm2_getpubak: - renamed to tpm2_createak. - -f becomes -p and -f is used for format of public key output. - --auth-endorse is now --eh-auth. - --auth-ak is now --ak-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -e becomes -P. - -P becomes -p. - -D becomes -g. - -p becomes -u. - --context becomes --ak-context. - --algorithm becomes --kalg. - --digest-alg becomes --halg. - --privfile becomes --private. - remove -k persistant option. Use tpm2_evictcontrol. - Fix -o option to -w. - now saves a context file for the generated primary's handle to disk. - -E becomes -e. - -g changes to -G. - support for non-persistent AK generation. * tpm2_getpubek: - renamed to tpm2_createek - --endorse-passwd is now --eh-auth. - --owner-passwd is now --owner-auth. - --ek-passwd is now --ek-auth. - --file is now --public. - --context is now --ek-context. - --algorithm is now --key-algorithm. - -e is now -P. - -P is now -p. - -p is now -u. - -o is now -w. - -g is now -G. - Support for saving a context file for the generated primary keys handle to disk. - support for non-persistent EK generation. - -f is now -p. - -f support for format of public key output. * tpm2_getrandom: - change default output to binary. - add --hex option for output to hex format. - --out-file is now --output. - bound input request on max hash size per spec, allow -f to override this. * tpm_gettestresult: - new tool for getting test results. * tpm2_hash: - add --hex for specifying hex output. - default output of hash to stdout. - default output of hash as binary. - remove output of ticket to stdout. - --halg is now --hash-algorithm. - --out-file is now --output. - -a is now -C. - -H is now -a. * tpm2_hmac: - add -t option for specifying ticket result. - --out-file is now --output. - --auth-key is now --auth. - --algorithm is now --hash-algorithm. - --pwdk is now --auth-key. - -C is now -c. - -P is now -p. * tpm2_hierarchycontrol: - new tool added for enabling or disabling the use of a hierarchy and its associated NV storage. * tpm2_import: - --object-attributes is now --attributes. - --auth-parent is now --parent-auth. - --auth-key is now --key-auth. - --algorithm is now --key-algorithm. - --in-file is now --input. - --parent-key is now --parent-context. - --privfile is now --private. - --pubfile is now --public. - --halg is now --hash-algorithm. - --policy-file is now --policy. - --sym-alg-file is now --encryption-key. - -A is now -b. - -k is now -i. - support OSSL style -passin argument as --passin for PEM file passwords. - support additional import key types: - RSA1024/2048. - AES128/192/256. - -q changes to -u to align with tpm2_loads public/private output arguments. - Supports setting object name algorithm via -g. - support specifying parent key with a context file. - --parent-key-handle/-H becomes --parent-key/-C - Parent public data option is optional and changes from `-K` to `-U`. - Supports importing external RSA 2048 keys via pem files. - Supports ECC Parent keys. * tpm2_incrementalselftest: - Add tool to test support of specific algorithms. * tpm2_listpersistent: - deleted as tpm2_getcap and tpm2_readpublic can be used instead. * tpm2_load: - -o is now -c. - --context-parent is now --parent-context. - --auth-parent is now --auth. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - now saves a context file for the generated primary's handle to disk. - Option `--pwdp` changes to `--auth-parent`. * tpm2_loadexternal: - --object-attributes is now --attributes. - -o is now -c - --key-alg is now --key-algorithm. - --pubfile is now --public. - --privfile is now --private. - --auth-key is now --auth. - --policy-file is now --policy. - --halg is now --hash-algorithm. - --out-context is now --key-context. - Remove unused -P option. - -H is now -a. - Fix -A option to -b for attributes. - now saves a context file for the generated primary's handle to disk. - support OSSL style -passin argument as --passin for PEM file passwords. - name output to file and stdout. Changes YAML stdout output. - ECC Public and Private PEM support. - AES Public and Private "raw file" support. - RSA Public and Private PEM support. - Object Attribute support. - Object authorization support. - Default hierarchy changes to the *null* hierarchy. * tpm2_makecredential: - --out-file is now --credential-blob - --enckey is now --encryption-key. - Option `--sec` changes to `--secret`. * tpm2_nvdefine: - --handle-passwd is now --hierarchy-auth. - --index-passwd is now --index-auth. - --policy-file is now --policy. - --auth-handle is now --hierarchy. - -a becomes -C. - -t becomes -a. - -I becomes -p. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvincrement: - New tool to increment value of a Non-Volatile (NV) index setup as a counter. * tpm2_nvlist: - tpm2_nvlist is now tpm2_nvreadpublic. * tpm2_nvread: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - fix a buffer overflow. * tpm2_nvreadlock: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvwrite: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_nvrelease: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvundefine: - Renamed from tpm2_nvrelease. * tpm2_pcrallocate: - New tool for changing the allocated PCRs of a TPM. * tpm2_pcrevent: - --password is now --auth. - Removed option --pcr-index with short option -i. - PCR index is now specified as an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_pcrlist: - -gls options go away with -g and -l becoming a single argument. * tpm2_pcrread: - Renamed from tpm2_pcrlist. * tpm2_print: - New tool that decodes a TPM data structure and prints enclosed elements to stdout as YAML. * tpm2_policyauthorize: - New tool that allows for policies to change by associating the policy to a signing authority essentially allowing the auth policy to change. * tpm2_policycommandcode: - New tool to restricts TPM object authorization to specific TPM commands. * tpm2_policyduplicationselect: - New tool for creating a policy to restrict duplication to a new parent and or duplicable object. * tpm2_policylocality: - New tool for creating a policy restricted to a locality. * tpm2_policypcr: - New tool to generate a pcr policy event that bounds auth to specific PCR values in user defined pcr banks and indices. * tpm2_policyor: - New tool to compound multiple policies in a logical OR fashion to allow multiple auth methods using a policy session. * tpm2_policypassword: - New tool to mandate specifying of the object password in clear using a policy session. * tpm2_policysecret: - New tool to associate auth of a reference object as the auth of the new object using a policy session. * tpm2_quote: - --ak-context is now --key-context. - --ak-password is now --auth. - --sel-list is now --pcr-list. - --qualify-data is now --qualification-data. - --pcrs is now --pcr. - --sig-hash-algorithm is now --hash-algorithm. - -P becomes -p - -L becomes -l. - -p becomes -o. - -G becomes -g. - -g becomes optional. - Removed option --id-list with short option -l. - Removed option --ak-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. * tpm2_readpublic: - --opu is now --output. - --context-object is now --object-context. - Removed option --object with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Added --serialized-handle for saving serialized ESYS_TR handle to disk. - Added --name with short option -n for saving the binary name. - Supports ECC pem and der file generation. * tpm2_rsadecrypt: - --pwdk is now --auth. - --out-file is now --output. - -P becomes -p. - Added --label with short option -l for specifying label. - Added --scheme with short option -s for specifying encryption scheme. - Removed option -I or in-file input option and make argument. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_rsaencrypt: - --out-file is now --output. - Added --scheme with short option -s for specifying encryption scheme. - Added --label with -l for specifying label. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - make output binary either stdout or file based on -o. * tpm2_selftest: - New tool for invoking tpm selftest. * tpm2_send: - --out-file is now --output. * tpm2_sign: - --pwdk is now --auth. - --halg is now --hash-algorithm. - --sig is now --signature. - -P becomes -p. - -s becomes -o. - Added --digest with short option -d. - Added --scheme with short option -s. - Supports rsapss. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --msg with short option -m. - Make -d toggle if input is a digest. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Supports signing a pre-computed hash via -d. * tpm2_startauthsession: - New tool to start/save a trial-policy-session (default) or policy- authorization-session with command line option --policy-session. * tpm2_stirrandom: - new command for injecting entropy into the TPM. * tpm2_takeownership: - split into tpm2_clear and tpm2_changeauth * tpm2_testparms: - new tool for querying tpm for supported algorithms. * tpm2_unseal: - --pwdk is now --auth. - --outfile is now --output. - --item-context is now --object-context. - -P becomes -p - Removed option --item with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_verifysignature: - --halg is now --hash-algorithm. - --msg is now --message. - --sig is now --signature. - -D becomes -d. - -t becomes optional. - Issue warning when ticket is specified for a NULL hierarchy. - Added option --format with short option -f. - Removed option --raw with short option -r. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Support routines for OpenSSL compatible format of public keys (PEM, DER) and plain signature data without TSS specific headers. * misc: - cmac algorithm support. - Add support for reading authorisation passwords from a file. - Ported all tools from SAPI to ESAPI. - Load TCTI's by SONAME, not raw .so file. - system tests are now run with make check when --enable-unit is used in configure. - Libre SSL builds fixed. - Dynamic TCTIS. Support for pluggable TCTI modules via the -T or --tcti options. - test: system testing scripts moved into subordinate test directory. - configure: enable code coverage option. - env: add TPM2TOOLS_ENABLE_ERRATA to control the -Z or errata option. affects all tools. - Fix parsing bug in PCR mini-language. - Fix misspelling of TPM2_PT_HR constants which effects tpm2_getcap output. - configure option --with-bashcompdir for specifying bash completion directory. - changes in version 3.2.1: * Fix invalid memcpy when extracting ECDSA plain signatures. * Fix resource leak on FILE * in hashing routine. * Correct PCR logic to prevent memory corruption bug. * Errata handler fix. - changes in version 3.2.0: * fix configure bug for linking against libmu. * tpm2_changeauth: Support changing platform hierarchy auth. * tpm2_flushcontext: Introduce new tool for flushing handles from the TPM. * tpm2_checkquote: Introduce new tool for checking validity of quotes. * tpm2_quote: Add ability to output PCR values for quotes. * tpm2_makecredential: add support for executing tool off-TPM. * tpm2_pcrreset: introduce new tool for resetting PCRs. * tpm2_quote: Fix AK auth password not being used. - add fix_bad_bufsize.patch: fixes findings from compile time fread() checks that indicate bad buffer size specification. - add fix_bogus_warning.patch: fixes `maybe-unitialized` warnings that are bogus, since the variables in questions will be initialized in any case later on. - update to version 4.3: - changes in version 4.3: - tss2_*: Fix double-free errors in commands asking for password authorization - tss2_*: Fix shorthand command -f that was falsely requiring an argument - tss2_*: Update tss2_encrypt to the new FAPI interface - The argument 'policyPath' is removed which was never read anyway - tss2_*: Remove the additional '\n' that was appended when redirecting to stdout - tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec - tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo - tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout - tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec - tss2_*: Add parameter types to all man page - tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data - tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output - tss2_pcrextend: fix extending PCR 0 - tss2_quote: fix unused TSS2_RC in LOG_ERR - changes in 4.2.1: - Fix missing handle maps for ESY3 handle breaks. See #1994. - Bump ESYS minimum dependency version from 2.3.0 to 2.4.0. - Fix for loop declarations build error. - changes in 4.2: - Fix various issues reported by static analysis tools. - Add integration test for ECC based getekcertificate. - Fix for issue #1959 where ARM builds were failing. - Add a check in autotools to add "expect" as a package dependency for fapi tools. - tpm2_createek: Drop the unused -p or --ek-auth option - tpm2_policyor: List of policy files should be specified as an argument - instead of -l option. The -l option is still retained for backwards - compatibility. See issue#1894. - tpm2_eventlog: add a tool for parsing and displaying the event log. - tpm2_createek: Fix an issue where the template option looked for args - tpm2_hierarchycontrol: Fixed bug where tool operation failed silently - tpm2_nvdefine: Fixed an issue where text output suggested failures as passes - tpm2_certify: Add an example usage in man page - tpm2_policyor: Fix a bug where tool failed silently when no input were given - tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address - tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed - .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations - tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command - Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. - tpm2_import: Fix an issue where the imported key always required to have a policy - tpm2_policysecret: Fix an issue where authorization model was fixed to password only - Feature API (FAPI) tools added. These additional set of tools implement utilities - using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv - tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons. - changes in 4.1.1: - tpm2_certify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed. - tpm2_gettime: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvcertify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvreadpublic: add name hash output. - tpm2_import: Support object policies when importing raw key material. - Fix overflow in pcrs.h where sizeof() was used instead of ARRAY_LEN(). - build: - Fix compilation issue: lib/tpm2_hash.c:17:19: note: 'left' was declared here. - man: - Fix manpage examples that have "sha" instead of "sha1" - tpm2_shutdown manpage was missing, add it to build. - Fix manpage example for tpm2_createak's tpm2_evictcontrol example. - Remove fix_bad_bufsize.patch: is now contained in upstream tarball - Adjust fix_bogus_warning.patch: one hunk no longer applies, upstream code changed. - add fix_warnings.patch: fixes a couple of build errors resulting from LTO linking and -Werror. - add fix_pie_linking.patch: fixes an error in the build system that causes the tss2 binary to be linked without passed LDFLAGS (like -pie), which causes the binary not to be position independent. - update to major version 5.0: - Non Backwards Compatible Changes * Default hash algorithm is now sha256. Prior versions claimed sha1, but were inconsistent in choice. Best practice is to specify the hash algorithm to avoid surprises. * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie tpm2_getrandom becomes tpm2 getrandom. make install will install symlinks to the old tool names and the tpm2 commandlet will interrogate argv[0] for the command to run. This will provide backwards compatibility if they are installed. If you wish to use the old names not installed system wide, set DESTDIR during install to a separate path and set the proper directory on PATH. * tpm2_eventlog's output changed to be YAML compliant. The output before was intended to be YAML compliant but was never properly checked and tested. * umask set to 0117 for all tools. * tpm2_getekcertificate now outputs the INTC EK certificates in PEM format by default. In order to output the URL safe variant of base64 encoded output of the INTC EK certificate use the added option --raw. - Dependency update * Update tpm2-tss dependency version to 3.0.1 * Update tpm2-abrmd dependency version to 2.3.3 - New tools and features * tpm2_zgen2phase: Add new tool to support command TPM2_CC_ZGen_2Phase. * tpm2_ecdhzgen: Add new tool to support command TPM2_CC_ECDH_ZGen. * tpm2_ecdhkeygen: Add new tool to support command TPM2_CC_ECDH_KeyGen. * tpm2_commit: Add new tool to support command TPM2_CC_Commit. * tpm2_ecephemeral: Add new tool to support command TPM2_CC_EC_Ephemeral. * tpm2_geteccparameters: Add new tool to support command TPM2_CC_ECC_Parameters. * tpm2_setcommandauditstatus: Added new tool to support command TPM2_CC_SetCommandCodeAuditStatus. * tpm2_getcommandauditstatus: Added new tool to support command TPM2_CC_GetCommandAuditDigest. * tpm2_getsessionauditdigest: Added new tool to support command TPM2_CC_GetSessionAuditDigest. * tpm2_certifyX509certutil: Added new tool for creating partial x509 certificates required to support the TPM2_CC_CertifyX509 command. * tpm2_policysigned: Added option --cphash-input to specify the command parameter hash (cpHashA), enforcing the TPM command to be authorized as well as its handle and parameter values. * tpm2_createprimary: Added option to specify the unique data from the stdin by adding provision for specifying the option value for unique file as -. * tpm2_startauthsession: Added new feature/option --audit-session to start an HMAC session to be used as an audit session. * tpm2_getrandom: - Added new feature/option -S, --session to specify a HMAC session to be used as an audit session. This adds support for auditing the command using an audit session. - Added new feature/option --rphash to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. - Added new feature/option --cphash to specify a file path to record the hash of the command parameters. This is commonly termed as cpHash. NOTE: In absence of --rphash option, when this option is selected, The tool will not actually execute the command, it simply returns a cpHash. * tpm2_getcap: tpm2_getcap was missing raw on a property TPM2_PT_REVISION, and it should always be specified. * tpm2_sign: - Add option --commit-index to specify the commit index to use when performing an ECDAA signature. - Add support for ECDAA signature. * tpm2_getekcertificate: - Add option --raw to output EK certificate in URL safe variant base64 encoded format. By default it outputs a PEM formatted certificate. - The tool can now output INTC and non INTC EK certificates from NV indices specified by the TCG EK profile specification. * tpm2_activatecredential: - The secret data input can now be specified as stdin with -s option. - The public key used for encryption can be specified as -u to make it similar to rest of the tools specifying a public key. The old -e option is retained for backwards compatibility. - Add option to specify the key algorithm when the input public key is in PEM format using the new option -G, --key-algorithm. Can specify either RSA/ECC. When this option is used, input public key is expected to be in PEM format and the default TCG EK template is used for the key properties. * tpm2_checkqoute: - Add EC support. - Support loading tss signatures. - Support loading tpm2 pcrread PCR values by specifying the PCR selection using the new option -l, --pcr-list. - Added support for automatically detecting the signature format. With this -F, --format option is retained for backwards compatibility but it is deprecated. * tpm2_createak: add option to output qualified name with new option - q, --ak-qualified-name. * tpm2_policypcr: Add option for specifying cumulative hash of PCR's as an argument. * tpm2_readpublic: Add option to output qualified name using the new option - q, --qualified-name. * tpm2_print: - Support printing TPM2B_PUBLIC data structures. - Support printing TPMT_PUBLIC data structures. * tpm2_send: Add support for handling sending and receiving command and response buffer for multiple commands. * tpm2_verifysignature: Added support for verifying RSA-PSS signatures. * tpm2_eventlog: - Add handling of sha1 log format. - Add fixes for eventlog output to be proper YAML. - Add support for sha384, sha512, sm3_256 PCR hash algorithms. - Add support for computing PCR values based on the events. * tpm2_tools (all): - Set stdin/stdout to non-buffering. - Added changes for FreeBSD portability. - Bug fixes * Fix printing short options when no ascii character is used. * OpenSSL: Fix deprecated OpenSSL functions. ECC Functions with suffix GFp will become deprecated (DEPRECATED_1_2_0). * tpm2_eventlog: output EV_POST_CODE as string not firmware blob to be compliant with TCG PC Client FPF section 2.3.4.1 and 9.4.12.3.4.1 * Fix missing handle maps for ESY3 handle breaks. See #1994. * tpm2_rsaencrypt: fix OAEP RSA encryption failing to invalid hash selection. * tpm2_rsadecrypt: fix OAEP RSA decryption failing to invalid hash selection. * tpm2_sign: fix for signing failures with restricted signing keys when input data to sign is not a digest, rather the full message. The validation ticket creation process defaults to the owner hierarchy and so in order to choose other hierarchies the tpm2_hash tool should be used instead. * tpm2_print: fix segfault when -t option is omitted by appropriately warning of the required option. * tpm2_nvdefine: fix for default size when size is not specified by invoking TPM2_CC_GetCapability. * Fix for an issue where the return code for unsupported algorithms was tool_rc_general instead of tool_rc_unsupported in tpm2_create and tpm2_createprimary tools. * Fix for an issue where RSA_PSS signature verification caused failures. * tpm2_nvreadpublic, tpm2_kdfa, tpm2_checkquote, tpm2_quote: Fixes for issues with interoperability of the attestation tools between big and little endian platforms. * tss2_*: - Fix bash-completion for tss2_pcrextend and tss2_verifysignature - Add force option to tss2_list - Make force option consistent in all fapi tools - Do not decode non-TPM errors - Enhance integration tests to test changes of optional/mandatory parameters - Add --hex parameter to tss2_getrandom - Fix autocompletion issue - Switch tss2_* to with-"="-style - Add size parameter to tss2_createseal - References to the cryptographic profile (fapi-profile(5)) and config file - (fapi-config(5)) man pages from all relevant tss2_* man pages. - Fix policy branch selection menu item from 1 to 0. - Documentation * wiki pages have been removed and data has been migrated to tpm2-software.github.io portal's tutorial section. * Fix the problem with man and no-man help output for tools were not correctly displayed. * man: - tpm2_create: Correct max seal data size from 256 bytes to 128 bytes. - tpm2_nvread: Fix manpage example. - tpm2_nvwrite: Added missing information on how to specify the NV index as an argument. - tpm2_unseal: Add end-to-end example. - tpm2_nvincrement: Fix incorrect commands in example section. - tpm2_hmac: Fix the example section. - fix `--version` output of tools. Since now autoreconf is called and configure.ac attempts to fetch the version from git (which we don't have during building), the version was empty. Fix this by replacing the git invocation in configure.ac. - add 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch: no longer use a fixed AES key in the context of the tpm2_import command. Fixes CVE-2021-3565 (bsc#1186490). - drop fix_pie_linking.patch: now contained in upstream tarball - drop fix_warnings.patch: now contained in upstream tarball - update to upstream version 5.1: - Minimum tpm2-tss version dependency bumped to 3.1.0 - Minimum tpm2-abrmd version dependency bumped to 2.4.0 - tss2: - Support in tools for PolicyRef inclusion in policy search per latest TSS. - Support to use TPM objects protected by a policy with PolicySigned. - Enable backward compatibility to old Fapi callback API. - Fix PCR selection for tss2 quote. - Support policy signed policies by implementing Fapi_SetSignCB. - Command/ response parameter support for auditing and pHash policies: - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash - Add support to calculate rphash for tpm2_create, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps. - Session-support: - tpm2_sessionconfig: Add tool to display and configure session attributes. - tpm2_getrandom: Fix— session input was hardcoded for audit-only - tpm2_startauthsession: Add option to specify the bind object and its authorization value. - tpm2_startauthsession: support for bounded-only session. - tpm2_startauthsession: support for salted-only session. - tpm2_startauthsession: add option to specify an hmac session type. - Add support for specifying non-authorization sessions for audit and parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend, tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps. - tpm2_eventlog: - Support for event type: EV_IPL extensively used by the Shim and Grub. - Support for event type: EV_EFI_GPT_EVENT to parse. UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY. - Support for event type: EFI_SIGNATURE_LIST, which contains one or more EFI_SIGNATURE_DATA. - Support for event type EV_EFI_VARIABLE_AUTHORITY. - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into the Event Log entry TCG_PCR_EVENT2.event field for event types EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB. - Parse secureboot variable to indicate enable as 'Yes'. - Parse BootOrder variable to a more readable format. - Parse Boot variables per EFI_LOAD_OPTION described in more details in UEFI Spec Section 3.1.3 - Parse Device-path in a readable format using the efivar library. - Support for logs longer than 64 kilobytes. - Perform verification for event types where digest can be verified from their event payload. - Better support for multiline strings. - Fix handling of event log EV_POST_CODE data where field is empty and len is specified. - scripts/utils: Add a utility to read the cert chain of embedded CA. - tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404. - tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV indices set in extend mode. - tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM without first requiring them to be loaded to a local TPM. - tpm2_dictionarylockout: Fix issue where setting value for one parameter caused to reset the others. - tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest. - Fix segfault where optind > argc. - tools/tpm2_checkquote: fix missing initializer - tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0 - openssl: fix EVP_ENCODE_CTX_(new|free) - test: Add support for swTPM simulator to the testing framework and make it the default if mssim isn't available. - tpm2_unseal: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvextend: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvdefine: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_changepps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeeps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeauth: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certifycreation: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certify: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_activatecredential: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_create: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_unseal: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvdefine: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvextend: - Added option **-S**, **--session** to specify auxilary sessions for audit and encryption. - Do not BuildRequire pandoc on ix86 architectures: the haskell stack is not supported on intel 32bit archs. - Disable lto to fix tpm2_checkquote error (boo#1187316) - Update service file to point to the correct revision - Add 0001-tpm2_checkquote-fix-uninitialized-variable.patch for a better fix of boo#1187316 - Re-enable lto - Add 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch to fix the tpm2_eventlog command (boo#1187360) - update to version 5.1.1: - tpm2_import: fix fixed AES key CVE-2021-3565 - tpm2_import used a fixed AES key for the inner wrapper, which means that a MITM attack would be able to unwrap the imported key. To fix this, ensure the key size is 16 bytes or bigger and use OpenSSL to generate a secure random AES key. - Avoid pandoc build dependency, use prebuilt man pages everywhere - Drop 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch, now upstream - Drop _service, unused - Drop unused unzip build dependency - Drop autoreconfigure call, no longer necessary - Use %autosetup - Verify tarball signature - Build against efivar - Drop %check section, tests weren't built, so that was a noop - prepare running the test suite via %check, but leave it commented out, because it is broken due to LTO linking. - Add 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch to fix the offset of the read buffer - Update to version 5.2: + tpm2_nvextend: * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_Extend command to the TPM. + tpm2_nvread: * Added option --rphash=FILE to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NVRead command to the TPM. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. + tpm2_nvsetbits: * Added option --rphash=FILE to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_SetBits command to the TPM. + tpm2_createprimary: * Support public-key output at creation time in various public-key formats. + tpm2_create: * Support public-key output at creation time in various public-key formats. + tpm2_print: * Support outputing public key in various public key formats over the default YAML output. Supports taking -u output from tpm2_create and converting it to a PEM or DER file format. + tpm2_import: * Add support for importing keys with sealed-data-blobs. + tpm2_rsaencrypt, tpm2_rsadecrypt: * Add support for specifying the hash algorithm with oaep. + tpm2_pcrread, tpm2_quote: * Add option -F, --pcrs_format to specify PCR format selection for the binary blob in the PCR output file. 'values' will output a binary blob of the PCR values. 'serialized' will output a binary blob of the PCR values in the form of serialized data structure in little endian format. + tpm2_eventlog: * Add support for decoding StartupLocality. * Add support for printing the partition information. * Add support for reading eventlogs longer than 64kb including from /sys/kernel/security/tpm0/binary_bios-measurements. + tpm2_duplicate: * Add option -L, --policy to specify an authorization policy to be associated with the duplicated object. * Added support for external key duplication without needing the TCTI. + tools: * Enhance error message on invalid passwords when sessions cannot be used. + lib/tpm2_options: * Add option to specify fake tcti which is required in cases where sapi ctx is required to be initialized for retrieving command parameters without invoking the tcti to talk to the TPM. + openssl: * Dropped support for OpenSSL < 1.1.0 * Add support for OpenSSL 3.0.0 + Support added to make the repository documentation and man pages available live on readthedocs. + Bug-fixes: * tpm2_import: Don't allow setting passwords for imported object with -p option as the tool doesn't modify the TPM2B_SENSITIVE structure. Added appropriate logging to indicate using tpm2_changeauth after import. * lib/tpm2_util.c: The function to calculate pHash algorithm returned error when input session is a password session and the only session in the command. * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under ECC. * tpm2_sign: Fix segfaults when tool does not find TPM resources (TPM or RM). * tpm2_makecredential: Fix an issue where reading input from stdin could result in unsupported data size larger than the largest digest size. * tpm2_loadexternal: Fix an issue where restricted attribute could not be set. * lib/tpm2_nv_util.h: The NV index size is dependent on different data sets read from the GetCapability structures because there is a dependency on the NV operation type: Define vs Read vs Write vs Extend. Fix a sane default in the case where GetCapability fails or fails to report the specific property/ data set. This is especially true because some properties are TPM implementation dependent. * tpm2_createpolicy: Fix an issue where tool exited silently without reporting an error if wrong pcr string is specified. * lib/tpm2_alg_util: add error message on public init to prevent tools from dying silently, add an error message. * tpm2_import: fix an issue where an imported hmac object scheme was NULL. While allowed, it was inconsistent with other tools like tpm2_create which set the scheme as hmac->sha256 when generating a keyedhash object. - Drop patches already in upstream: + 0001-tpm2_checkquote-fix-uninitialized-variable.patch + 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch + 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch - Fix python3-PyYAML requirement - Move the tests inside a bcond. Disabled by default. - The update to 5.2 fill also jsc#SLE-9515 (4.1) and jsc#SLE-17366 (4.3.0) - Add 0001-tpm2_checkquote-Fix-check-of-magic-number.patch: tpm2_checkquote did not check whether the magic number in the attest is equal to TPM2_GENERATED_VALUE, which might allow a malicious actor to generate arbitrary quote data, undetected by tpm2_checkquote (bsc#1223687, CVE-2024-29038). - Add 0001-tpm2_checkquote-Add-comparison-of-pcr-selection.patch: tpm2_checkquote did not compare the --pcr parameter passed to the tool with the attest. A malicious actor might thus be able to fake a valid attestation (bsc#1223689, CVE-2024-29039). - update to minor version 3.1.2 (FATE#326270): - Revert the change to use user supplied object attributes exclusively. This is an inappropriate behavioural change for a MINOR version number increment. - Fix inclusion of object attribute specifiers section in tpm2_create and tpm2_createprimary man pages. - Use better object attribute defaults for authentication, preventing an empty password being used for authentication when a policy is set. - update to minor version 3.1.3: - Restore support for the TPM2TOOLS_* env vars for TCTI configuration, in addition to supporting the new unified TPM2TOOLS_ENV_TCTI - Fix tpm2_getcap to print properties with the TPM_PT prefix, rather than TPM2_PT - Make test_tpm2_activecredential Python 3 compatible - Fix tpm2_takeownership to only attempt to change the specified hierarchies - use a _service file to sync with upstream tags - update to minor version 3.1.4: * Fix various man pages * tpm2_getmanufec: fix OSSL build warnings * Fix broken -T option * Various build compatibility fixes * Fix some unit tests * Update build for recent autoconf-archive versions * Install m4 files - update to major version 4.1: - changes in version 4.1: * tpm2_certifycreation: New tool enabling command TPM2_CertifyCreation. * tpm2_checkquote: - Fix YAML output bug. - -g option for specifying hash algorithm is optional and defaults to sha256. * tpm2_changeeps: A new tool for changing the Endorsement hierarchy primary seed. * tpm2_changepps: A new tool for changing the Platform hierarchy primary seed. * tpm2_clockrateadjust: Add a new tool for modifying the period on the TPM. * tpm2_create: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_createprimary: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_evictcontrol: - Fix bug in automatic persistent handle selection when hierarchy is platform. - Fix bug in YAML key action where action was wrong when using ESYS_TR. * tpm2_getcap: clean up remanenats of -c option in manpages and tool output. * tpm2_gettime: Add a new tool for retrieving a signed timestamp from a TPM. * tpm2_nvcertify: Add a new tool for certifying the contents of an NV index. * tpm2_nvdefine: - Support default set of attributes so -a is not mandatory. - Support searching for free index if an index isn't specified. * tpm2_nvextend: Add a new tool for extending an NV index similair to a PCR. * tpm2_nvreadpublic: - Support specifying nv index to read public data from as argument. * tpm2_nvsetbits: Add a new tool for setting the values of PCR with type "bits". * tpm2_nvundefine: Add support for deleting NV indices with attribute `TPMA_NV_POLICY_DELETE` set using NV Undefine Special command. * tpm2_nvwritelock: Add a new tool for setting a write lock on an NV index or globally locking nv indices with TPMA_NV_GLOBALLOCK. * tpm2_policyauthorizenv: New tool enabling signed, revocable policies. * tpm2_policyauthvalue: New tool enabling authorization to be bound to the authorization of another object. * tpm2_policycountertimer: Add a new tool for enabling policy bound to TPM clock or timer values. * tpm2_policynamehash: Add a new tool for specifying policy based on object name. * tpm2_policynv: Add a new tool for specifying policy based on NV contents. * tpm2_nvwritten: Add a new tool for specifying policy based on whether or not an NV index was written to. * tpm2_policysecret: Add tool options for specifying - --expiration or -t - --ticket - --timeout - --nonce-tpm or -x - --qualification or -q * tpm2_policysigned: New tool enabling policy command TPM2_PolicySigned. * tpm2_policytemplate: New tool enabling policy command TPM2_PolicyTemplate. * tpm2_policyticket: New tool enabling policy command TPM2_PolicyTicket. * tpm2_readclock: Add a new tool for reading the TPM clock. * tpm2_setclock: Add a new tool for setting the TPM clock. * tpm2_setprimarypolicy: New tool setting policy on hierarchies. * tpm2_shutdown: Add a new tool for issuing a TPM shutdown command. * misc: - Support "tpmt" as a public key output format that only saves the TPMT structure. - Qualifying data or extra data in many tools can be hex array string or binary file. - Add support for specifying NV index type when specifying NV attributes. - Support added for tools to run on FreeBSD. - Skip and notify of action that man pages will not install if the package pandoc is missing. - Fix precedence issue with bitwise operator order int tpm2_getcap - travis: bump abrmd version 2.3.0 - tpm2_util.c: Fix an issue int variable size was checked against uint - pcr.c: Fix buffer length issue to support all defined hash algorithm - changes in version 4.0.1: * tpm2_checkquote: Fix YAML output bug. - changes in version 4.0: * tpm2_activatecredential: - --context is now --credentialedkey-context. - --key-context is now --credentialkey-context. - --Password is now --credentialedkey-auth. - --endorse-passwd is now --credentialkey-auth. - --in-file is now --credential-secret. - --out-file is now --certinfo-data. - -f becomes -i. - -k becomes -C. - -e becomes -E. * tpm2_certify: - --halg is now --hash-algorithm. - --obj-context is now --certifiedkey-context. - --key-context is now --signingkey-context. - --pwdo is now --certifiedkey-auth. - --pwdk is now --signingkey-auth. - -a becomes -o. - -k becomes -p. - -c becomes -C. - -k becomes -K. * tpm2_changeauth: - New tool for changing the authorization values of: - Hierarchies - NV - Objects - Replaces tpm2_takeownership with more generic functionality. * tpm2_checkquote: - --halg is now --hash-algorithm. - --pcr-input-file is now --pcr. - --pubfile is now --public. - --qualify-data is now --qualification. - -f becomes -F. - -F becomes -f. - -G becomes -g. * tpm2_clear: - --lockout-passwd is now --auth-lockout. * tpm2_clearcontrol: - New tool for enabling or disabling tpm2_clear commands. * tpm2_create - --object-attributes is now --attributes. - --pwdp is now --parent-auth. - --pwdo is now --key-auth. - --in-file is now --sealing-input. - --policy-file is now --policy. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -o becomes -c. - -K becomes -p. - -A becomes -b. - -I becomes -i. - -g becomes an optional option. - -G becomes an optional option. - Supports TPM command CreateLoaded via -c. * tpm2_createak: - Renamed from tpm2_getpubak * tpm2_createek: - renamed from tpm2_getpubek * tpm2_createpolicy: - --out-policy-file is now --policy. - --policy-digest-alg is now --policy-algorithm. - --auth-policy-session is now --policy-session. - -L becomes -l. - -F becomes -f. - -f becomes -o. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - Removed short option a for specifying auth session. Use long option --policy-session. - Removed short option -P for specifying pcr policy. Use long option --policy-pcr. * tpm2_createprimary: - --object-attributes is now --attributes. - -o is now -c - --pwdp is now --hierarchy-auth. - --pwdk is now --key-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - --context-object is now --key-context. - --policy-file is now --policy. - support for unique field when creating objects via -u - saves a context file for the generated primary's handle to disk via -c. - -A becomes -a. - -K becomes -p. - -H becomes -C. - -g becomes optional. - -G becomes optional. * tpm2_dictionarylockout: - --lockout-passwd is now --auth. - -P becomes -p. * tpm2_duplicate: - New tool for duplicating TPM objects. * tpm2_encryptdecrypt: - --pwdk is now --auth. - --out-file is now --output. - -D becomes -d. - -I becomes an argument. - -P becomes -p. - Support IVs via -t or --iv. - Support modes via -G. - Support padding via -e or --pad. - Supports input and output to stdin and stdout respectively. * tpm2_evictcontrol: - --auth is now --hierarchy. - --context is now --object-context. - --pwda is now --auth. - --persistent with short option -S is now an argument. - -A becomes -C. - Added option --output -o to serialize handle to disk. - Removed option --handle with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -i. - Authorization session is now part of password mini language. * tpm2_getcap: - -c becomes an argument. - Most instances of value replaced with raw in YAML output. - TPM2_PT_MANUFACTURER displays string value and raw value. - Supports --pcr option for listing hash algorithms and bank numbers. * tpm2_getekcertificate: - Renamed from tpm2_getmanufec * tpm2_getmanufec: - Renamed the tool to tpm2_getekcertificate. - Removed ek key creation and management logic. - Added option for getting ek cert for offline platform via -x. - Support for ECC keys. - --ec-cert is now --ek-certificate, - --untrusted is now --allow-unverified, - --output is now --ek-public, - -U is now -X. - -O is now -x. - -f becomes -o. - Removed option -P or --endorse-passwd. - Removed option -p or --ek-passwd. - Removed option -w or --owner-passwd. - Removed option -H or --persistent-handle. - Removed option -G or --key-algorithm. - Removed option -N or --non-persistent. - Removed option -O or --offline. * tpm2_getpubak: - renamed to tpm2_createak. - -f becomes -p and -f is used for format of public key output. - --auth-endorse is now --eh-auth. - --auth-ak is now --ak-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -e becomes -P. - -P becomes -p. - -D becomes -g. - -p becomes -u. - --context becomes --ak-context. - --algorithm becomes --kalg. - --digest-alg becomes --halg. - --privfile becomes --private. - remove -k persistant option. Use tpm2_evictcontrol. - Fix -o option to -w. - now saves a context file for the generated primary's handle to disk. - -E becomes -e. - -g changes to -G. - support for non-persistent AK generation. * tpm2_getpubek: - renamed to tpm2_createek - --endorse-passwd is now --eh-auth. - --owner-passwd is now --owner-auth. - --ek-passwd is now --ek-auth. - --file is now --public. - --context is now --ek-context. - --algorithm is now --key-algorithm. - -e is now -P. - -P is now -p. - -p is now -u. - -o is now -w. - -g is now -G. - Support for saving a context file for the generated primary keys handle to disk. - support for non-persistent EK generation. - -f is now -p. - -f support for format of public key output. * tpm2_getrandom: - change default output to binary. - add --hex option for output to hex format. - --out-file is now --output. - bound input request on max hash size per spec, allow -f to override this. * tpm_gettestresult: - new tool for getting test results. * tpm2_hash: - add --hex for specifying hex output. - default output of hash to stdout. - default output of hash as binary. - remove output of ticket to stdout. - --halg is now --hash-algorithm. - --out-file is now --output. - -a is now -C. - -H is now -a. * tpm2_hmac: - add -t option for specifying ticket result. - --out-file is now --output. - --auth-key is now --auth. - --algorithm is now --hash-algorithm. - --pwdk is now --auth-key. - -C is now -c. - -P is now -p. * tpm2_hierarchycontrol: - new tool added for enabling or disabling the use of a hierarchy and its associated NV storage. * tpm2_import: - --object-attributes is now --attributes. - --auth-parent is now --parent-auth. - --auth-key is now --key-auth. - --algorithm is now --key-algorithm. - --in-file is now --input. - --parent-key is now --parent-context. - --privfile is now --private. - --pubfile is now --public. - --halg is now --hash-algorithm. - --policy-file is now --policy. - --sym-alg-file is now --encryption-key. - -A is now -b. - -k is now -i. - support OSSL style -passin argument as --passin for PEM file passwords. - support additional import key types: - RSA1024/2048. - AES128/192/256. - -q changes to -u to align with tpm2_loads public/private output arguments. - Supports setting object name algorithm via -g. - support specifying parent key with a context file. - --parent-key-handle/-H becomes --parent-key/-C - Parent public data option is optional and changes from `-K` to `-U`. - Supports importing external RSA 2048 keys via pem files. - Supports ECC Parent keys. * tpm2_incrementalselftest: - Add tool to test support of specific algorithms. * tpm2_listpersistent: - deleted as tpm2_getcap and tpm2_readpublic can be used instead. * tpm2_load: - -o is now -c. - --context-parent is now --parent-context. - --auth-parent is now --auth. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - now saves a context file for the generated primary's handle to disk. - Option `--pwdp` changes to `--auth-parent`. * tpm2_loadexternal: - --object-attributes is now --attributes. - -o is now -c - --key-alg is now --key-algorithm. - --pubfile is now --public. - --privfile is now --private. - --auth-key is now --auth. - --policy-file is now --policy. - --halg is now --hash-algorithm. - --out-context is now --key-context. - Remove unused -P option. - -H is now -a. - Fix -A option to -b for attributes. - now saves a context file for the generated primary's handle to disk. - support OSSL style -passin argument as --passin for PEM file passwords. - name output to file and stdout. Changes YAML stdout output. - ECC Public and Private PEM support. - AES Public and Private "raw file" support. - RSA Public and Private PEM support. - Object Attribute support. - Object authorization support. - Default hierarchy changes to the *null* hierarchy. * tpm2_makecredential: - --out-file is now --credential-blob - --enckey is now --encryption-key. - Option `--sec` changes to `--secret`. * tpm2_nvdefine: - --handle-passwd is now --hierarchy-auth. - --index-passwd is now --index-auth. - --policy-file is now --policy. - --auth-handle is now --hierarchy. - -a becomes -C. - -t becomes -a. - -I becomes -p. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvincrement: - New tool to increment value of a Non-Volatile (NV) index setup as a counter. * tpm2_nvlist: - tpm2_nvlist is now tpm2_nvreadpublic. * tpm2_nvread: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - fix a buffer overflow. * tpm2_nvreadlock: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvwrite: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_nvrelease: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvundefine: - Renamed from tpm2_nvrelease. * tpm2_pcrallocate: - New tool for changing the allocated PCRs of a TPM. * tpm2_pcrevent: - --password is now --auth. - Removed option --pcr-index with short option -i. - PCR index is now specified as an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_pcrlist: - -gls options go away with -g and -l becoming a single argument. * tpm2_pcrread: - Renamed from tpm2_pcrlist. * tpm2_print: - New tool that decodes a TPM data structure and prints enclosed elements to stdout as YAML. * tpm2_policyauthorize: - New tool that allows for policies to change by associating the policy to a signing authority essentially allowing the auth policy to change. * tpm2_policycommandcode: - New tool to restricts TPM object authorization to specific TPM commands. * tpm2_policyduplicationselect: - New tool for creating a policy to restrict duplication to a new parent and or duplicable object. * tpm2_policylocality: - New tool for creating a policy restricted to a locality. * tpm2_policypcr: - New tool to generate a pcr policy event that bounds auth to specific PCR values in user defined pcr banks and indices. * tpm2_policyor: - New tool to compound multiple policies in a logical OR fashion to allow multiple auth methods using a policy session. * tpm2_policypassword: - New tool to mandate specifying of the object password in clear using a policy session. * tpm2_policysecret: - New tool to associate auth of a reference object as the auth of the new object using a policy session. * tpm2_quote: - --ak-context is now --key-context. - --ak-password is now --auth. - --sel-list is now --pcr-list. - --qualify-data is now --qualification-data. - --pcrs is now --pcr. - --sig-hash-algorithm is now --hash-algorithm. - -P becomes -p - -L becomes -l. - -p becomes -o. - -G becomes -g. - -g becomes optional. - Removed option --id-list with short option -l. - Removed option --ak-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. * tpm2_readpublic: - --opu is now --output. - --context-object is now --object-context. - Removed option --object with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Added --serialized-handle for saving serialized ESYS_TR handle to disk. - Added --name with short option -n for saving the binary name. - Supports ECC pem and der file generation. * tpm2_rsadecrypt: - --pwdk is now --auth. - --out-file is now --output. - -P becomes -p. - Added --label with short option -l for specifying label. - Added --scheme with short option -s for specifying encryption scheme. - Removed option -I or in-file input option and make argument. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_rsaencrypt: - --out-file is now --output. - Added --scheme with short option -s for specifying encryption scheme. - Added --label with -l for specifying label. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - make output binary either stdout or file based on -o. * tpm2_selftest: - New tool for invoking tpm selftest. * tpm2_send: - --out-file is now --output. * tpm2_sign: - --pwdk is now --auth. - --halg is now --hash-algorithm. - --sig is now --signature. - -P becomes -p. - -s becomes -o. - Added --digest with short option -d. - Added --scheme with short option -s. - Supports rsapss. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --msg with short option -m. - Make -d toggle if input is a digest. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Supports signing a pre-computed hash via -d. * tpm2_startauthsession: - New tool to start/save a trial-policy-session (default) or policy- authorization-session with command line option --policy-session. * tpm2_stirrandom: - new command for injecting entropy into the TPM. * tpm2_takeownership: - split into tpm2_clear and tpm2_changeauth * tpm2_testparms: - new tool for querying tpm for supported algorithms. * tpm2_unseal: - --pwdk is now --auth. - --outfile is now --output. - --item-context is now --object-context. - -P becomes -p - Removed option --item with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_verifysignature: - --halg is now --hash-algorithm. - --msg is now --message. - --sig is now --signature. - -D becomes -d. - -t becomes optional. - Issue warning when ticket is specified for a NULL hierarchy. - Added option --format with short option -f. - Removed option --raw with short option -r. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Support routines for OpenSSL compatible format of public keys (PEM, DER) and plain signature data without TSS specific headers. * misc: - cmac algorithm support. - Add support for reading authorisation passwords from a file. - Ported all tools from SAPI to ESAPI. - Load TCTI's by SONAME, not raw .so file. - system tests are now run with make check when --enable-unit is used in configure. - Libre SSL builds fixed. - Dynamic TCTIS. Support for pluggable TCTI modules via the -T or --tcti options. - test: system testing scripts moved into subordinate test directory. - configure: enable code coverage option. - env: add TPM2TOOLS_ENABLE_ERRATA to control the -Z or errata option. affects all tools. - Fix parsing bug in PCR mini-language. - Fix misspelling of TPM2_PT_HR constants which effects tpm2_getcap output. - configure option --with-bashcompdir for specifying bash completion directory. - changes in version 3.2.1: * Fix invalid memcpy when extracting ECDSA plain signatures. * Fix resource leak on FILE * in hashing routine. * Correct PCR logic to prevent memory corruption bug. * Errata handler fix. - changes in version 3.2.0: * fix configure bug for linking against libmu. * tpm2_changeauth: Support changing platform hierarchy auth. * tpm2_flushcontext: Introduce new tool for flushing handles from the TPM. * tpm2_checkquote: Introduce new tool for checking validity of quotes. * tpm2_quote: Add ability to output PCR values for quotes. * tpm2_makecredential: add support for executing tool off-TPM. * tpm2_pcrreset: introduce new tool for resetting PCRs. * tpm2_quote: Fix AK auth password not being used. - add fix_bad_bufsize.patch: fixes findings from compile time fread() checks that indicate bad buffer size specification. - add fix_bogus_warning.patch: fixes `maybe-unitialized` warnings that are bogus, since the variables in questions will be initialized in any case later on. - update to version 4.3: - changes in version 4.3: - tss2_*: Fix double-free errors in commands asking for password authorization - tss2_*: Fix shorthand command -f that was falsely requiring an argument - tss2_*: Update tss2_encrypt to the new FAPI interface - The argument 'policyPath' is removed which was never read anyway - tss2_*: Remove the additional '\n' that was appended when redirecting to stdout - tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec - tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo - tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout - tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec - tss2_*: Add parameter types to all man page - tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data - tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output - tss2_pcrextend: fix extending PCR 0 - tss2_quote: fix unused TSS2_RC in LOG_ERR - changes in 4.2.1: - Fix missing handle maps for ESY3 handle breaks. See #1994. - Bump ESYS minimum dependency version from 2.3.0 to 2.4.0. - Fix for loop declarations build error. - changes in 4.2: - Fix various issues reported by static analysis tools. - Add integration test for ECC based getekcertificate. - Fix for issue #1959 where ARM builds were failing. - Add a check in autotools to add "expect" as a package dependency for fapi tools. - tpm2_createek: Drop the unused -p or --ek-auth option - tpm2_policyor: List of policy files should be specified as an argument - instead of -l option. The -l option is still retained for backwards - compatibility. See issue#1894. - tpm2_eventlog: add a tool for parsing and displaying the event log. - tpm2_createek: Fix an issue where the template option looked for args - tpm2_hierarchycontrol: Fixed bug where tool operation failed silently - tpm2_nvdefine: Fixed an issue where text output suggested failures as passes - tpm2_certify: Add an example usage in man page - tpm2_policyor: Fix a bug where tool failed silently when no input were given - tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address - tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed - .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations - tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command - Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. - tpm2_import: Fix an issue where the imported key always required to have a policy - tpm2_policysecret: Fix an issue where authorization model was fixed to password only - Feature API (FAPI) tools added. These additional set of tools implement utilities - using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv - tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons. - changes in 4.1.1: - tpm2_certify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed. - tpm2_gettime: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvcertify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvreadpublic: add name hash output. - tpm2_import: Support object policies when importing raw key material. - Fix overflow in pcrs.h where sizeof() was used instead of ARRAY_LEN(). - build: - Fix compilation issue: lib/tpm2_hash.c:17:19: note: 'left' was declared here. - man: - Fix manpage examples that have "sha" instead of "sha1" - tpm2_shutdown manpage was missing, add it to build. - Fix manpage example for tpm2_createak's tpm2_evictcontrol example. - Remove fix_bad_bufsize.patch: is now contained in upstream tarball - Adjust fix_bogus_warning.patch: one hunk no longer applies, upstream code changed. - add fix_warnings.patch: fixes a couple of build errors resulting from LTO linking and -Werror. - add fix_pie_linking.patch: fixes an error in the build system that causes the tss2 binary to be linked without passed LDFLAGS (like -pie), which causes the binary not to be position independent. - update to major version 5.0: - Non Backwards Compatible Changes * Default hash algorithm is now sha256. Prior versions claimed sha1, but were inconsistent in choice. Best practice is to specify the hash algorithm to avoid surprises. * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie tpm2_getrandom becomes tpm2 getrandom. make install will install symlinks to the old tool names and the tpm2 commandlet will interrogate argv[0] for the command to run. This will provide backwards compatibility if they are installed. If you wish to use the old names not installed system wide, set DESTDIR during install to a separate path and set the proper directory on PATH. * tpm2_eventlog's output changed to be YAML compliant. The output before was intended to be YAML compliant but was never properly checked and tested. * umask set to 0117 for all tools. * tpm2_getekcertificate now outputs the INTC EK certificates in PEM format by default. In order to output the URL safe variant of base64 encoded output of the INTC EK certificate use the added option --raw. - Dependency update * Update tpm2-tss dependency version to 3.0.1 * Update tpm2-abrmd dependency version to 2.3.3 - New tools and features * tpm2_zgen2phase: Add new tool to support command TPM2_CC_ZGen_2Phase. * tpm2_ecdhzgen: Add new tool to support command TPM2_CC_ECDH_ZGen. * tpm2_ecdhkeygen: Add new tool to support command TPM2_CC_ECDH_KeyGen. * tpm2_commit: Add new tool to support command TPM2_CC_Commit. * tpm2_ecephemeral: Add new tool to support command TPM2_CC_EC_Ephemeral. * tpm2_geteccparameters: Add new tool to support command TPM2_CC_ECC_Parameters. * tpm2_setcommandauditstatus: Added new tool to support command TPM2_CC_SetCommandCodeAuditStatus. * tpm2_getcommandauditstatus: Added new tool to support command TPM2_CC_GetCommandAuditDigest. * tpm2_getsessionauditdigest: Added new tool to support command TPM2_CC_GetSessionAuditDigest. * tpm2_certifyX509certutil: Added new tool for creating partial x509 certificates required to support the TPM2_CC_CertifyX509 command. * tpm2_policysigned: Added option --cphash-input to specify the command parameter hash (cpHashA), enforcing the TPM command to be authorized as well as its handle and parameter values. * tpm2_createprimary: Added option to specify the unique data from the stdin by adding provision for specifying the option value for unique file as -. * tpm2_startauthsession: Added new feature/option --audit-session to start an HMAC session to be used as an audit session. * tpm2_getrandom: - Added new feature/option -S, --session to specify a HMAC session to be used as an audit session. This adds support for auditing the command using an audit session. - Added new feature/option --rphash to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. - Added new feature/option --cphash to specify a file path to record the hash of the command parameters. This is commonly termed as cpHash. NOTE: In absence of --rphash option, when this option is selected, The tool will not actually execute the command, it simply returns a cpHash. * tpm2_getcap: tpm2_getcap was missing raw on a property TPM2_PT_REVISION, and it should always be specified. * tpm2_sign: - Add option --commit-index to specify the commit index to use when performing an ECDAA signature. - Add support for ECDAA signature. * tpm2_getekcertificate: - Add option --raw to output EK certificate in URL safe variant base64 encoded format. By default it outputs a PEM formatted certificate. - The tool can now output INTC and non INTC EK certificates from NV indices specified by the TCG EK profile specification. * tpm2_activatecredential: - The secret data input can now be specified as stdin with -s option. - The public key used for encryption can be specified as -u to make it similar to rest of the tools specifying a public key. The old -e option is retained for backwards compatibility. - Add option to specify the key algorithm when the input public key is in PEM format using the new option -G, --key-algorithm. Can specify either RSA/ECC. When this option is used, input public key is expected to be in PEM format and the default TCG EK template is used for the key properties. * tpm2_checkqoute: - Add EC support. - Support loading tss signatures. - Support loading tpm2 pcrread PCR values by specifying the PCR selection using the new option -l, --pcr-list. - Added support for automatically detecting the signature format. With this -F, --format option is retained for backwards compatibility but it is deprecated. * tpm2_createak: add option to output qualified name with new option - q, --ak-qualified-name. * tpm2_policypcr: Add option for specifying cumulative hash of PCR's as an argument. * tpm2_readpublic: Add option to output qualified name using the new option - q, --qualified-name. * tpm2_print: - Support printing TPM2B_PUBLIC data structures. - Support printing TPMT_PUBLIC data structures. * tpm2_send: Add support for handling sending and receiving command and response buffer for multiple commands. * tpm2_verifysignature: Added support for verifying RSA-PSS signatures. * tpm2_eventlog: - Add handling of sha1 log format. - Add fixes for eventlog output to be proper YAML. - Add support for sha384, sha512, sm3_256 PCR hash algorithms. - Add support for computing PCR values based on the events. * tpm2_tools (all): - Set stdin/stdout to non-buffering. - Added changes for FreeBSD portability. - Bug fixes * Fix printing short options when no ascii character is used. * OpenSSL: Fix deprecated OpenSSL functions. ECC Functions with suffix GFp will become deprecated (DEPRECATED_1_2_0). * tpm2_eventlog: output EV_POST_CODE as string not firmware blob to be compliant with TCG PC Client FPF section 2.3.4.1 and 9.4.12.3.4.1 * Fix missing handle maps for ESY3 handle breaks. See #1994. * tpm2_rsaencrypt: fix OAEP RSA encryption failing to invalid hash selection. * tpm2_rsadecrypt: fix OAEP RSA decryption failing to invalid hash selection. * tpm2_sign: fix for signing failures with restricted signing keys when input data to sign is not a digest, rather the full message. The validation ticket creation process defaults to the owner hierarchy and so in order to choose other hierarchies the tpm2_hash tool should be used instead. * tpm2_print: fix segfault when -t option is omitted by appropriately warning of the required option. * tpm2_nvdefine: fix for default size when size is not specified by invoking TPM2_CC_GetCapability. * Fix for an issue where the return code for unsupported algorithms was tool_rc_general instead of tool_rc_unsupported in tpm2_create and tpm2_createprimary tools. * Fix for an issue where RSA_PSS signature verification caused failures. * tpm2_nvreadpublic, tpm2_kdfa, tpm2_checkquote, tpm2_quote: Fixes for issues with interoperability of the attestation tools between big and little endian platforms. * tss2_*: - Fix bash-completion for tss2_pcrextend and tss2_verifysignature - Add force option to tss2_list - Make force option consistent in all fapi tools - Do not decode non-TPM errors - Enhance integration tests to test changes of optional/mandatory parameters - Add --hex parameter to tss2_getrandom - Fix autocompletion issue - Switch tss2_* to with-"="-style - Add size parameter to tss2_createseal - References to the cryptographic profile (fapi-profile(5)) and config file - (fapi-config(5)) man pages from all relevant tss2_* man pages. - Fix policy branch selection menu item from 1 to 0. - Documentation * wiki pages have been removed and data has been migrated to tpm2-software.github.io portal's tutorial section. * Fix the problem with man and no-man help output for tools were not correctly displayed. * man: - tpm2_create: Correct max seal data size from 256 bytes to 128 bytes. - tpm2_nvread: Fix manpage example. - tpm2_nvwrite: Added missing information on how to specify the NV index as an argument. - tpm2_unseal: Add end-to-end example. - tpm2_nvincrement: Fix incorrect commands in example section. - tpm2_hmac: Fix the example section. - fix `--version` output of tools. Since now autoreconf is called and configure.ac attempts to fetch the version from git (which we don't have during building), the version was empty. Fix this by replacing the git invocation in configure.ac. - add 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch: no longer use a fixed AES key in the context of the tpm2_import command. Fixes CVE-2021-3565 (bsc#1186490). - drop fix_pie_linking.patch: now contained in upstream tarball - drop fix_warnings.patch: now contained in upstream tarball - update to upstream version 5.1: - Minimum tpm2-tss version dependency bumped to 3.1.0 - Minimum tpm2-abrmd version dependency bumped to 2.4.0 - tss2: - Support in tools for PolicyRef inclusion in policy search per latest TSS. - Support to use TPM objects protected by a policy with PolicySigned. - Enable backward compatibility to old Fapi callback API. - Fix PCR selection for tss2 quote. - Support policy signed policies by implementing Fapi_SetSignCB. - Command/ response parameter support for auditing and pHash policies: - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash - Add support to calculate rphash for tpm2_create, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps. - Session-support: - tpm2_sessionconfig: Add tool to display and configure session attributes. - tpm2_getrandom: Fix— session input was hardcoded for audit-only - tpm2_startauthsession: Add option to specify the bind object and its authorization value. - tpm2_startauthsession: support for bounded-only session. - tpm2_startauthsession: support for salted-only session. - tpm2_startauthsession: add option to specify an hmac session type. - Add support for specifying non-authorization sessions for audit and parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend, tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps. - tpm2_eventlog: - Support for event type: EV_IPL extensively used by the Shim and Grub. - Support for event type: EV_EFI_GPT_EVENT to parse. UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY. - Support for event type: EFI_SIGNATURE_LIST, which contains one or more EFI_SIGNATURE_DATA. - Support for event type EV_EFI_VARIABLE_AUTHORITY. - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into the Event Log entry TCG_PCR_EVENT2.event field for event types EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB. - Parse secureboot variable to indicate enable as 'Yes'. - Parse BootOrder variable to a more readable format. - Parse Boot variables per EFI_LOAD_OPTION described in more details in UEFI Spec Section 3.1.3 - Parse Device-path in a readable format using the efivar library. - Support for logs longer than 64 kilobytes. - Perform verification for event types where digest can be verified from their event payload. - Better support for multiline strings. - Fix handling of event log EV_POST_CODE data where field is empty and len is specified. - scripts/utils: Add a utility to read the cert chain of embedded CA. - tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404. - tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV indices set in extend mode. - tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM without first requiring them to be loaded to a local TPM. - tpm2_dictionarylockout: Fix issue where setting value for one parameter caused to reset the others. - tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest. - Fix segfault where optind > argc. - tools/tpm2_checkquote: fix missing initializer - tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0 - openssl: fix EVP_ENCODE_CTX_(new|free) - test: Add support for swTPM simulator to the testing framework and make it the default if mssim isn't available. - tpm2_unseal: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvextend: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvdefine: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_changepps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeeps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeauth: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certifycreation: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certify: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_activatecredential: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_create: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_unseal: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvdefine: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvextend: - Added option **-S**, **--session** to specify auxilary sessions for audit and encryption. - Do not BuildRequire pandoc on ix86 architectures: the haskell stack is not supported on intel 32bit archs. - Disable lto to fix tpm2_checkquote error (boo#1187316) - Update service file to point to the correct revision - Add 0001-tpm2_checkquote-fix-uninitialized-variable.patch for a better fix of boo#1187316 - Re-enable lto - Add 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch to fix the tpm2_eventlog command (boo#1187360) - update to version 5.1.1: - tpm2_import: fix fixed AES key CVE-2021-3565 - tpm2_import used a fixed AES key for the inner wrapper, which means that a MITM attack would be able to unwrap the imported key. To fix this, ensure the key size is 16 bytes or bigger and use OpenSSL to generate a secure random AES key. - Avoid pandoc build dependency, use prebuilt man pages everywhere - Drop 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch, now upstream - Drop _service, unused - Drop unused unzip build dependency - Drop autoreconfigure call, no longer necessary - Use %autosetup - Verify tarball signature - Build against efivar - Drop %check section, tests weren't built, so that was a noop - prepare running the test suite via %check, but leave it commented out, because it is broken due to LTO linking. - Add 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch to fix the offset of the read buffer - Update to version 5.2: + tpm2_nvextend: * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_Extend command to the TPM. + tpm2_nvread: * Added option --rphash=FILE to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NVRead command to the TPM. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. + tpm2_nvsetbits: * Added option --rphash=FILE to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_SetBits command to the TPM. + tpm2_createprimary: * Support public-key output at creation time in various public-key formats. + tpm2_create: * Support public-key output at creation time in various public-key formats. + tpm2_print: * Support outputing public key in various public key formats over the default YAML output. Supports taking -u output from tpm2_create and converting it to a PEM or DER file format. + tpm2_import: * Add support for importing keys with sealed-data-blobs. + tpm2_rsaencrypt, tpm2_rsadecrypt: * Add support for specifying the hash algorithm with oaep. + tpm2_pcrread, tpm2_quote: * Add option -F, --pcrs_format to specify PCR format selection for the binary blob in the PCR output file. 'values' will output a binary blob of the PCR values. 'serialized' will output a binary blob of the PCR values in the form of serialized data structure in little endian format. + tpm2_eventlog: * Add support for decoding StartupLocality. * Add support for printing the partition information. * Add support for reading eventlogs longer than 64kb including from /sys/kernel/security/tpm0/binary_bios-measurements. + tpm2_duplicate: * Add option -L, --policy to specify an authorization policy to be associated with the duplicated object. * Added support for external key duplication without needing the TCTI. + tools: * Enhance error message on invalid passwords when sessions cannot be used. + lib/tpm2_options: * Add option to specify fake tcti which is required in cases where sapi ctx is required to be initialized for retrieving command parameters without invoking the tcti to talk to the TPM. + openssl: * Dropped support for OpenSSL < 1.1.0 * Add support for OpenSSL 3.0.0 + Support added to make the repository documentation and man pages available live on readthedocs. + Bug-fixes: * tpm2_import: Don't allow setting passwords for imported object with -p option as the tool doesn't modify the TPM2B_SENSITIVE structure. Added appropriate logging to indicate using tpm2_changeauth after import. * lib/tpm2_util.c: The function to calculate pHash algorithm returned error when input session is a password session and the only session in the command. * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under ECC. * tpm2_sign: Fix segfaults when tool does not find TPM resources (TPM or RM). * tpm2_makecredential: Fix an issue where reading input from stdin could result in unsupported data size larger than the largest digest size. * tpm2_loadexternal: Fix an issue where restricted attribute could not be set. * lib/tpm2_nv_util.h: The NV index size is dependent on different data sets read from the GetCapability structures because there is a dependency on the NV operation type: Define vs Read vs Write vs Extend. Fix a sane default in the case where GetCapability fails or fails to report the specific property/ data set. This is especially true because some properties are TPM implementation dependent. * tpm2_createpolicy: Fix an issue where tool exited silently without reporting an error if wrong pcr string is specified. * lib/tpm2_alg_util: add error message on public init to prevent tools from dying silently, add an error message. * tpm2_import: fix an issue where an imported hmac object scheme was NULL. While allowed, it was inconsistent with other tools like tpm2_create which set the scheme as hmac->sha256 when generating a keyedhash object. - Drop patches already in upstream: + 0001-tpm2_checkquote-fix-uninitialized-variable.patch + 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch + 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch - Fix python3-PyYAML requirement - Move the tests inside a bcond. Disabled by default. - The update to 5.2 fill also jsc#SLE-9515 (4.1) and jsc#SLE-17366 (4.3.0) - Add 0001-tpm2_checkquote-Fix-check-of-magic-number.patch: tpm2_checkquote did not check whether the magic number in the attest is equal to TPM2_GENERATED_VALUE, which might allow a malicious actor to generate arbitrary quote data, undetected by tpm2_checkquote (bsc#1223687, CVE-2024-29038). - Add 0001-tpm2_checkquote-Add-comparison-of-pcr-selection.patch: tpm2_checkquote did not compare the --pcr parameter passed to the tool with the attest. A malicious actor might thus be able to fake a valid attestation (bsc#1223689, CVE-2024-29039). - update to minor version 3.1.2 (FATE#326270): - Revert the change to use user supplied object attributes exclusively. This is an inappropriate behavioural change for a MINOR version number increment. - Fix inclusion of object attribute specifiers section in tpm2_create and tpm2_createprimary man pages. - Use better object attribute defaults for authentication, preventing an empty password being used for authentication when a policy is set. - update to minor version 3.1.3: - Restore support for the TPM2TOOLS_* env vars for TCTI configuration, in addition to supporting the new unified TPM2TOOLS_ENV_TCTI - Fix tpm2_getcap to print properties with the TPM_PT prefix, rather than TPM2_PT - Make test_tpm2_activecredential Python 3 compatible - Fix tpm2_takeownership to only attempt to change the specified hierarchies - use a _service file to sync with upstream tags - update to minor version 3.1.4: * Fix various man pages * tpm2_getmanufec: fix OSSL build warnings * Fix broken -T option * Various build compatibility fixes * Fix some unit tests * Update build for recent autoconf-archive versions * Install m4 files - update to major version 4.1: - changes in version 4.1: * tpm2_certifycreation: New tool enabling command TPM2_CertifyCreation. * tpm2_checkquote: - Fix YAML output bug. - -g option for specifying hash algorithm is optional and defaults to sha256. * tpm2_changeeps: A new tool for changing the Endorsement hierarchy primary seed. * tpm2_changepps: A new tool for changing the Platform hierarchy primary seed. * tpm2_clockrateadjust: Add a new tool for modifying the period on the TPM. * tpm2_create: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_createprimary: Add tool options for specifying output data for use in certification - --creation-data to save the creation data - --creation-ticket or -t to save the creation ticket - --creation-hash or -d to save the creation hash - --template-data for saving the template data of the key - --outside-info or -q for specifying unique data to include in creation data. - --pcr-list or -l Add option to specify pcr list to add to creation data. * tpm2_evictcontrol: - Fix bug in automatic persistent handle selection when hierarchy is platform. - Fix bug in YAML key action where action was wrong when using ESYS_TR. * tpm2_getcap: clean up remanenats of -c option in manpages and tool output. * tpm2_gettime: Add a new tool for retrieving a signed timestamp from a TPM. * tpm2_nvcertify: Add a new tool for certifying the contents of an NV index. * tpm2_nvdefine: - Support default set of attributes so -a is not mandatory. - Support searching for free index if an index isn't specified. * tpm2_nvextend: Add a new tool for extending an NV index similair to a PCR. * tpm2_nvreadpublic: - Support specifying nv index to read public data from as argument. * tpm2_nvsetbits: Add a new tool for setting the values of PCR with type "bits". * tpm2_nvundefine: Add support for deleting NV indices with attribute `TPMA_NV_POLICY_DELETE` set using NV Undefine Special command. * tpm2_nvwritelock: Add a new tool for setting a write lock on an NV index or globally locking nv indices with TPMA_NV_GLOBALLOCK. * tpm2_policyauthorizenv: New tool enabling signed, revocable policies. * tpm2_policyauthvalue: New tool enabling authorization to be bound to the authorization of another object. * tpm2_policycountertimer: Add a new tool for enabling policy bound to TPM clock or timer values. * tpm2_policynamehash: Add a new tool for specifying policy based on object name. * tpm2_policynv: Add a new tool for specifying policy based on NV contents. * tpm2_nvwritten: Add a new tool for specifying policy based on whether or not an NV index was written to. * tpm2_policysecret: Add tool options for specifying - --expiration or -t - --ticket - --timeout - --nonce-tpm or -x - --qualification or -q * tpm2_policysigned: New tool enabling policy command TPM2_PolicySigned. * tpm2_policytemplate: New tool enabling policy command TPM2_PolicyTemplate. * tpm2_policyticket: New tool enabling policy command TPM2_PolicyTicket. * tpm2_readclock: Add a new tool for reading the TPM clock. * tpm2_setclock: Add a new tool for setting the TPM clock. * tpm2_setprimarypolicy: New tool setting policy on hierarchies. * tpm2_shutdown: Add a new tool for issuing a TPM shutdown command. * misc: - Support "tpmt" as a public key output format that only saves the TPMT structure. - Qualifying data or extra data in many tools can be hex array string or binary file. - Add support for specifying NV index type when specifying NV attributes. - Support added for tools to run on FreeBSD. - Skip and notify of action that man pages will not install if the package pandoc is missing. - Fix precedence issue with bitwise operator order int tpm2_getcap - travis: bump abrmd version 2.3.0 - tpm2_util.c: Fix an issue int variable size was checked against uint - pcr.c: Fix buffer length issue to support all defined hash algorithm - changes in version 4.0.1: * tpm2_checkquote: Fix YAML output bug. - changes in version 4.0: * tpm2_activatecredential: - --context is now --credentialedkey-context. - --key-context is now --credentialkey-context. - --Password is now --credentialedkey-auth. - --endorse-passwd is now --credentialkey-auth. - --in-file is now --credential-secret. - --out-file is now --certinfo-data. - -f becomes -i. - -k becomes -C. - -e becomes -E. * tpm2_certify: - --halg is now --hash-algorithm. - --obj-context is now --certifiedkey-context. - --key-context is now --signingkey-context. - --pwdo is now --certifiedkey-auth. - --pwdk is now --signingkey-auth. - -a becomes -o. - -k becomes -p. - -c becomes -C. - -k becomes -K. * tpm2_changeauth: - New tool for changing the authorization values of: - Hierarchies - NV - Objects - Replaces tpm2_takeownership with more generic functionality. * tpm2_checkquote: - --halg is now --hash-algorithm. - --pcr-input-file is now --pcr. - --pubfile is now --public. - --qualify-data is now --qualification. - -f becomes -F. - -F becomes -f. - -G becomes -g. * tpm2_clear: - --lockout-passwd is now --auth-lockout. * tpm2_clearcontrol: - New tool for enabling or disabling tpm2_clear commands. * tpm2_create - --object-attributes is now --attributes. - --pwdp is now --parent-auth. - --pwdo is now --key-auth. - --in-file is now --sealing-input. - --policy-file is now --policy. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -o becomes -c. - -K becomes -p. - -A becomes -b. - -I becomes -i. - -g becomes an optional option. - -G becomes an optional option. - Supports TPM command CreateLoaded via -c. * tpm2_createak: - Renamed from tpm2_getpubak * tpm2_createek: - renamed from tpm2_getpubek * tpm2_createpolicy: - --out-policy-file is now --policy. - --policy-digest-alg is now --policy-algorithm. - --auth-policy-session is now --policy-session. - -L becomes -l. - -F becomes -f. - -f becomes -o. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - Removed short option a for specifying auth session. Use long option --policy-session. - Removed short option -P for specifying pcr policy. Use long option --policy-pcr. * tpm2_createprimary: - --object-attributes is now --attributes. - -o is now -c - --pwdp is now --hierarchy-auth. - --pwdk is now --key-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - --context-object is now --key-context. - --policy-file is now --policy. - support for unique field when creating objects via -u - saves a context file for the generated primary's handle to disk via -c. - -A becomes -a. - -K becomes -p. - -H becomes -C. - -g becomes optional. - -G becomes optional. * tpm2_dictionarylockout: - --lockout-passwd is now --auth. - -P becomes -p. * tpm2_duplicate: - New tool for duplicating TPM objects. * tpm2_encryptdecrypt: - --pwdk is now --auth. - --out-file is now --output. - -D becomes -d. - -I becomes an argument. - -P becomes -p. - Support IVs via -t or --iv. - Support modes via -G. - Support padding via -e or --pad. - Supports input and output to stdin and stdout respectively. * tpm2_evictcontrol: - --auth is now --hierarchy. - --context is now --object-context. - --pwda is now --auth. - --persistent with short option -S is now an argument. - -A becomes -C. - Added option --output -o to serialize handle to disk. - Removed option --handle with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -i. - Authorization session is now part of password mini language. * tpm2_getcap: - -c becomes an argument. - Most instances of value replaced with raw in YAML output. - TPM2_PT_MANUFACTURER displays string value and raw value. - Supports --pcr option for listing hash algorithms and bank numbers. * tpm2_getekcertificate: - Renamed from tpm2_getmanufec * tpm2_getmanufec: - Renamed the tool to tpm2_getekcertificate. - Removed ek key creation and management logic. - Added option for getting ek cert for offline platform via -x. - Support for ECC keys. - --ec-cert is now --ek-certificate, - --untrusted is now --allow-unverified, - --output is now --ek-public, - -U is now -X. - -O is now -x. - -f becomes -o. - Removed option -P or --endorse-passwd. - Removed option -p or --ek-passwd. - Removed option -w or --owner-passwd. - Removed option -H or --persistent-handle. - Removed option -G or --key-algorithm. - Removed option -N or --non-persistent. - Removed option -O or --offline. * tpm2_getpubak: - renamed to tpm2_createak. - -f becomes -p and -f is used for format of public key output. - --auth-endorse is now --eh-auth. - --auth-ak is now --ak-auth. - --halg is now --hash-algorithm. - --kalg is now --key-algorithm. - -e becomes -P. - -P becomes -p. - -D becomes -g. - -p becomes -u. - --context becomes --ak-context. - --algorithm becomes --kalg. - --digest-alg becomes --halg. - --privfile becomes --private. - remove -k persistant option. Use tpm2_evictcontrol. - Fix -o option to -w. - now saves a context file for the generated primary's handle to disk. - -E becomes -e. - -g changes to -G. - support for non-persistent AK generation. * tpm2_getpubek: - renamed to tpm2_createek - --endorse-passwd is now --eh-auth. - --owner-passwd is now --owner-auth. - --ek-passwd is now --ek-auth. - --file is now --public. - --context is now --ek-context. - --algorithm is now --key-algorithm. - -e is now -P. - -P is now -p. - -p is now -u. - -o is now -w. - -g is now -G. - Support for saving a context file for the generated primary keys handle to disk. - support for non-persistent EK generation. - -f is now -p. - -f support for format of public key output. * tpm2_getrandom: - change default output to binary. - add --hex option for output to hex format. - --out-file is now --output. - bound input request on max hash size per spec, allow -f to override this. * tpm_gettestresult: - new tool for getting test results. * tpm2_hash: - add --hex for specifying hex output. - default output of hash to stdout. - default output of hash as binary. - remove output of ticket to stdout. - --halg is now --hash-algorithm. - --out-file is now --output. - -a is now -C. - -H is now -a. * tpm2_hmac: - add -t option for specifying ticket result. - --out-file is now --output. - --auth-key is now --auth. - --algorithm is now --hash-algorithm. - --pwdk is now --auth-key. - -C is now -c. - -P is now -p. * tpm2_hierarchycontrol: - new tool added for enabling or disabling the use of a hierarchy and its associated NV storage. * tpm2_import: - --object-attributes is now --attributes. - --auth-parent is now --parent-auth. - --auth-key is now --key-auth. - --algorithm is now --key-algorithm. - --in-file is now --input. - --parent-key is now --parent-context. - --privfile is now --private. - --pubfile is now --public. - --halg is now --hash-algorithm. - --policy-file is now --policy. - --sym-alg-file is now --encryption-key. - -A is now -b. - -k is now -i. - support OSSL style -passin argument as --passin for PEM file passwords. - support additional import key types: - RSA1024/2048. - AES128/192/256. - -q changes to -u to align with tpm2_loads public/private output arguments. - Supports setting object name algorithm via -g. - support specifying parent key with a context file. - --parent-key-handle/-H becomes --parent-key/-C - Parent public data option is optional and changes from `-K` to `-U`. - Supports importing external RSA 2048 keys via pem files. - Supports ECC Parent keys. * tpm2_incrementalselftest: - Add tool to test support of specific algorithms. * tpm2_listpersistent: - deleted as tpm2_getcap and tpm2_readpublic can be used instead. * tpm2_load: - -o is now -c. - --context-parent is now --parent-context. - --auth-parent is now --auth. - --pubfile is now --public. - --privfile is now --private. - --out-context is now --key-context. - now saves a context file for the generated primary's handle to disk. - Option `--pwdp` changes to `--auth-parent`. * tpm2_loadexternal: - --object-attributes is now --attributes. - -o is now -c - --key-alg is now --key-algorithm. - --pubfile is now --public. - --privfile is now --private. - --auth-key is now --auth. - --policy-file is now --policy. - --halg is now --hash-algorithm. - --out-context is now --key-context. - Remove unused -P option. - -H is now -a. - Fix -A option to -b for attributes. - now saves a context file for the generated primary's handle to disk. - support OSSL style -passin argument as --passin for PEM file passwords. - name output to file and stdout. Changes YAML stdout output. - ECC Public and Private PEM support. - AES Public and Private "raw file" support. - RSA Public and Private PEM support. - Object Attribute support. - Object authorization support. - Default hierarchy changes to the *null* hierarchy. * tpm2_makecredential: - --out-file is now --credential-blob - --enckey is now --encryption-key. - Option `--sec` changes to `--secret`. * tpm2_nvdefine: - --handle-passwd is now --hierarchy-auth. - --index-passwd is now --index-auth. - --policy-file is now --policy. - --auth-handle is now --hierarchy. - -a becomes -C. - -t becomes -a. - -I becomes -p. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvincrement: - New tool to increment value of a Non-Volatile (NV) index setup as a counter. * tpm2_nvlist: - tpm2_nvlist is now tpm2_nvreadpublic. * tpm2_nvread: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. - fix a buffer overflow. * tpm2_nvreadlock: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvwrite: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed short option -o for specifying offset. Use long option --offset. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_nvrelease: - --handle-passwd is now --auth. - --auth-handle is now --hierarchy. - -a becomes -C. - Removed option --index with short option -x. It is now an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_nvundefine: - Renamed from tpm2_nvrelease. * tpm2_pcrallocate: - New tool for changing the allocated PCRs of a TPM. * tpm2_pcrevent: - --password is now --auth. - Removed option --pcr-index with short option -i. - PCR index is now specified as an argument. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_pcrlist: - -gls options go away with -g and -l becoming a single argument. * tpm2_pcrread: - Renamed from tpm2_pcrlist. * tpm2_print: - New tool that decodes a TPM data structure and prints enclosed elements to stdout as YAML. * tpm2_policyauthorize: - New tool that allows for policies to change by associating the policy to a signing authority essentially allowing the auth policy to change. * tpm2_policycommandcode: - New tool to restricts TPM object authorization to specific TPM commands. * tpm2_policyduplicationselect: - New tool for creating a policy to restrict duplication to a new parent and or duplicable object. * tpm2_policylocality: - New tool for creating a policy restricted to a locality. * tpm2_policypcr: - New tool to generate a pcr policy event that bounds auth to specific PCR values in user defined pcr banks and indices. * tpm2_policyor: - New tool to compound multiple policies in a logical OR fashion to allow multiple auth methods using a policy session. * tpm2_policypassword: - New tool to mandate specifying of the object password in clear using a policy session. * tpm2_policysecret: - New tool to associate auth of a reference object as the auth of the new object using a policy session. * tpm2_quote: - --ak-context is now --key-context. - --ak-password is now --auth. - --sel-list is now --pcr-list. - --qualify-data is now --qualification-data. - --pcrs is now --pcr. - --sig-hash-algorithm is now --hash-algorithm. - -P becomes -p - -L becomes -l. - -p becomes -o. - -G becomes -g. - -g becomes optional. - Removed option --id-list with short option -l. - Removed option --ak-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. * tpm2_readpublic: - --opu is now --output. - --context-object is now --object-context. - Removed option --object with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Added --serialized-handle for saving serialized ESYS_TR handle to disk. - Added --name with short option -n for saving the binary name. - Supports ECC pem and der file generation. * tpm2_rsadecrypt: - --pwdk is now --auth. - --out-file is now --output. - -P becomes -p. - Added --label with short option -l for specifying label. - Added --scheme with short option -s for specifying encryption scheme. - Removed option -I or in-file input option and make argument. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. * tpm2_rsaencrypt: - --out-file is now --output. - Added --scheme with short option -s for specifying encryption scheme. - Added --label with -l for specifying label. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - make output binary either stdout or file based on -o. * tpm2_selftest: - New tool for invoking tpm selftest. * tpm2_send: - --out-file is now --output. * tpm2_sign: - --pwdk is now --auth. - --halg is now --hash-algorithm. - --sig is now --signature. - -P becomes -p. - -s becomes -o. - Added --digest with short option -d. - Added --scheme with short option -s. - Supports rsapss. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --msg with short option -m. - Make -d toggle if input is a digest. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Supports signing a pre-computed hash via -d. * tpm2_startauthsession: - New tool to start/save a trial-policy-session (default) or policy- authorization-session with command line option --policy-session. * tpm2_stirrandom: - new command for injecting entropy into the TPM. * tpm2_takeownership: - split into tpm2_clear and tpm2_changeauth * tpm2_testparms: - new tool for querying tpm for supported algorithms. * tpm2_unseal: - --pwdk is now --auth. - --outfile is now --output. - --item-context is now --object-context. - -P becomes -p - Removed option --item with short option -H. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Removed option --input-session-handle with short option -S. - Authorization session is now part of password mini language. - Removed option --set-list with short option -L. - Removed option --pcr-input-file with short option -F. - Pcr policy options replaced with pcr password mini language. * tpm2_verifysignature: - --halg is now --hash-algorithm. - --msg is now --message. - --sig is now --signature. - -D becomes -d. - -t becomes optional. - Issue warning when ticket is specified for a NULL hierarchy. - Added option --format with short option -f. - Removed option --raw with short option -r. - Removed option --key-handle with short option -k. - Raw object-handles and object-contexts are commonly handled with object handling logic. - Support routines for OpenSSL compatible format of public keys (PEM, DER) and plain signature data without TSS specific headers. * misc: - cmac algorithm support. - Add support for reading authorisation passwords from a file. - Ported all tools from SAPI to ESAPI. - Load TCTI's by SONAME, not raw .so file. - system tests are now run with make check when --enable-unit is used in configure. - Libre SSL builds fixed. - Dynamic TCTIS. Support for pluggable TCTI modules via the -T or --tcti options. - test: system testing scripts moved into subordinate test directory. - configure: enable code coverage option. - env: add TPM2TOOLS_ENABLE_ERRATA to control the -Z or errata option. affects all tools. - Fix parsing bug in PCR mini-language. - Fix misspelling of TPM2_PT_HR constants which effects tpm2_getcap output. - configure option --with-bashcompdir for specifying bash completion directory. - changes in version 3.2.1: * Fix invalid memcpy when extracting ECDSA plain signatures. * Fix resource leak on FILE * in hashing routine. * Correct PCR logic to prevent memory corruption bug. * Errata handler fix. - changes in version 3.2.0: * fix configure bug for linking against libmu. * tpm2_changeauth: Support changing platform hierarchy auth. * tpm2_flushcontext: Introduce new tool for flushing handles from the TPM. * tpm2_checkquote: Introduce new tool for checking validity of quotes. * tpm2_quote: Add ability to output PCR values for quotes. * tpm2_makecredential: add support for executing tool off-TPM. * tpm2_pcrreset: introduce new tool for resetting PCRs. * tpm2_quote: Fix AK auth password not being used. - add fix_bad_bufsize.patch: fixes findings from compile time fread() checks that indicate bad buffer size specification. - add fix_bogus_warning.patch: fixes `maybe-unitialized` warnings that are bogus, since the variables in questions will be initialized in any case later on. - update to version 4.3: - changes in version 4.3: - tss2_*: Fix double-free errors in commands asking for password authorization - tss2_*: Fix shorthand command -f that was falsely requiring an argument - tss2_*: Update tss2_encrypt to the new FAPI interface - The argument 'policyPath' is removed which was never read anyway - tss2_*: Remove the additional '\n' that was appended when redirecting to stdout - tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec - tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo - tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout - tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec - tss2_*: Add parameter types to all man page - tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data - tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output - tss2_pcrextend: fix extending PCR 0 - tss2_quote: fix unused TSS2_RC in LOG_ERR - changes in 4.2.1: - Fix missing handle maps for ESY3 handle breaks. See #1994. - Bump ESYS minimum dependency version from 2.3.0 to 2.4.0. - Fix for loop declarations build error. - changes in 4.2: - Fix various issues reported by static analysis tools. - Add integration test for ECC based getekcertificate. - Fix for issue #1959 where ARM builds were failing. - Add a check in autotools to add "expect" as a package dependency for fapi tools. - tpm2_createek: Drop the unused -p or --ek-auth option - tpm2_policyor: List of policy files should be specified as an argument - instead of -l option. The -l option is still retained for backwards - compatibility. See issue#1894. - tpm2_eventlog: add a tool for parsing and displaying the event log. - tpm2_createek: Fix an issue where the template option looked for args - tpm2_hierarchycontrol: Fixed bug where tool operation failed silently - tpm2_nvdefine: Fixed an issue where text output suggested failures as passes - tpm2_certify: Add an example usage in man page - tpm2_policyor: Fix a bug where tool failed silently when no input were given - tpm2_getekcertificate: Intel (R) PTT EK cert web portal is set as default address - tpm2_alg_util.c: Fix a bug where string rsa3072 was not parsed - .ci/download-deps.sh: Change tss dependency to 2.4.0 to acquire SAPI handles for cpHash calculations - tpm2_policycphash: Add a tool to implement enhanced authorization with cpHash of a command - Add options to tools to enable cpHash outputs: tpm2_nvsetbits, tpm2_nvextend, tpm2_nvincrement, tpm2_nvread, tpm2_nvreadlock, tpm2_writelock, tpm2_nvdefine, tpm2_nvundefine, tpm2_nvcertify, tpm2_policynv, tpm2_policyauthorizenv, tpm2_policysecret, tpm2_create, tpm2_load, tpm2_activatecredential, tpm2_unseal, tpm2_changeauth, tpm2_duplicate, tpm2_import, tpm2_rsadecrypt, tpm2_certify, tpm2_certifycreation, tpm2_hierarchycontrol, tpm2_setprimarypolicy, tpm2_clearcontrol, tpm2_dictionarylockout, tpm2_evictcontrol, tpm2_setclock, tpm2_clockrateadjust, tpm2_clear, tpm2_nvwrite, tpm2_encryptdecrypt, tpm2_hmac. - tpm2_import: Fix an issue where the imported key always required to have a policy - tpm2_policysecret: Fix an issue where authorization model was fixed to password only - Feature API (FAPI) tools added. These additional set of tools implement utilities - using the FAPI which was added to the tpm2-tss v2.4.4: tss2_decrypt, tss2_encrypt, tss2_list, tss2_changeauth, tss2_delete, tss2_import, tss2_getinfo, tss2_createkey, tss2_createseal, tss2_exportkey, tss2_getcertificate, tss2_getplatformcertificates, tss2_gettpmblobs, tss2_getappdata, tss2_setappdata, tss2_setcertificate, tss2_sign, tss2_verifysignature, tss2_verifyquote, tss2_createnv, tss2_nvextend, tss2_nvincrement, tss2_nvread, tss2_nvsetbits, tss2_nvwrite, tss2_getdescription, tss2_setdescription, tss2_pcrextend, tss2_quote, tss2_pcrread, tss2_authorizepolicy, tss2_exportpolicy, tss2_import, tss2_provision, tss2_getrandom, tss2_unseal, tss2_writeauthorizenv - tpm2_policycountertimer: Fix an issue where operandB array was reversed causing faulty comparisons. - changes in 4.1.1: - tpm2_certify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_certifycreation: Fix tool to match manpage where the code had the -C and -c options reversed. - tpm2_gettime: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvcertify: Fix output of attestation data including size field. Now outputs just bytes. - tpm2_nvreadpublic: add name hash output. - tpm2_import: Support object policies when importing raw key material. - Fix overflow in pcrs.h where sizeof() was used instead of ARRAY_LEN(). - build: - Fix compilation issue: lib/tpm2_hash.c:17:19: note: 'left' was declared here. - man: - Fix manpage examples that have "sha" instead of "sha1" - tpm2_shutdown manpage was missing, add it to build. - Fix manpage example for tpm2_createak's tpm2_evictcontrol example. - Remove fix_bad_bufsize.patch: is now contained in upstream tarball - Adjust fix_bogus_warning.patch: one hunk no longer applies, upstream code changed. - add fix_warnings.patch: fixes a couple of build errors resulting from LTO linking and -Werror. - add fix_pie_linking.patch: fixes an error in the build system that causes the tss2 binary to be linked without passed LDFLAGS (like -pie), which causes the binary not to be position independent. - update to major version 5.0: - Non Backwards Compatible Changes * Default hash algorithm is now sha256. Prior versions claimed sha1, but were inconsistent in choice. Best practice is to specify the hash algorithm to avoid surprises. * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie tpm2_getrandom becomes tpm2 getrandom. make install will install symlinks to the old tool names and the tpm2 commandlet will interrogate argv[0] for the command to run. This will provide backwards compatibility if they are installed. If you wish to use the old names not installed system wide, set DESTDIR during install to a separate path and set the proper directory on PATH. * tpm2_eventlog's output changed to be YAML compliant. The output before was intended to be YAML compliant but was never properly checked and tested. * umask set to 0117 for all tools. * tpm2_getekcertificate now outputs the INTC EK certificates in PEM format by default. In order to output the URL safe variant of base64 encoded output of the INTC EK certificate use the added option --raw. - Dependency update * Update tpm2-tss dependency version to 3.0.1 * Update tpm2-abrmd dependency version to 2.3.3 - New tools and features * tpm2_zgen2phase: Add new tool to support command TPM2_CC_ZGen_2Phase. * tpm2_ecdhzgen: Add new tool to support command TPM2_CC_ECDH_ZGen. * tpm2_ecdhkeygen: Add new tool to support command TPM2_CC_ECDH_KeyGen. * tpm2_commit: Add new tool to support command TPM2_CC_Commit. * tpm2_ecephemeral: Add new tool to support command TPM2_CC_EC_Ephemeral. * tpm2_geteccparameters: Add new tool to support command TPM2_CC_ECC_Parameters. * tpm2_setcommandauditstatus: Added new tool to support command TPM2_CC_SetCommandCodeAuditStatus. * tpm2_getcommandauditstatus: Added new tool to support command TPM2_CC_GetCommandAuditDigest. * tpm2_getsessionauditdigest: Added new tool to support command TPM2_CC_GetSessionAuditDigest. * tpm2_certifyX509certutil: Added new tool for creating partial x509 certificates required to support the TPM2_CC_CertifyX509 command. * tpm2_policysigned: Added option --cphash-input to specify the command parameter hash (cpHashA), enforcing the TPM command to be authorized as well as its handle and parameter values. * tpm2_createprimary: Added option to specify the unique data from the stdin by adding provision for specifying the option value for unique file as -. * tpm2_startauthsession: Added new feature/option --audit-session to start an HMAC session to be used as an audit session. * tpm2_getrandom: - Added new feature/option -S, --session to specify a HMAC session to be used as an audit session. This adds support for auditing the command using an audit session. - Added new feature/option --rphash to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. - Added new feature/option --cphash to specify a file path to record the hash of the command parameters. This is commonly termed as cpHash. NOTE: In absence of --rphash option, when this option is selected, The tool will not actually execute the command, it simply returns a cpHash. * tpm2_getcap: tpm2_getcap was missing raw on a property TPM2_PT_REVISION, and it should always be specified. * tpm2_sign: - Add option --commit-index to specify the commit index to use when performing an ECDAA signature. - Add support for ECDAA signature. * tpm2_getekcertificate: - Add option --raw to output EK certificate in URL safe variant base64 encoded format. By default it outputs a PEM formatted certificate. - The tool can now output INTC and non INTC EK certificates from NV indices specified by the TCG EK profile specification. * tpm2_activatecredential: - The secret data input can now be specified as stdin with -s option. - The public key used for encryption can be specified as -u to make it similar to rest of the tools specifying a public key. The old -e option is retained for backwards compatibility. - Add option to specify the key algorithm when the input public key is in PEM format using the new option -G, --key-algorithm. Can specify either RSA/ECC. When this option is used, input public key is expected to be in PEM format and the default TCG EK template is used for the key properties. * tpm2_checkqoute: - Add EC support. - Support loading tss signatures. - Support loading tpm2 pcrread PCR values by specifying the PCR selection using the new option -l, --pcr-list. - Added support for automatically detecting the signature format. With this -F, --format option is retained for backwards compatibility but it is deprecated. * tpm2_createak: add option to output qualified name with new option - q, --ak-qualified-name. * tpm2_policypcr: Add option for specifying cumulative hash of PCR's as an argument. * tpm2_readpublic: Add option to output qualified name using the new option - q, --qualified-name. * tpm2_print: - Support printing TPM2B_PUBLIC data structures. - Support printing TPMT_PUBLIC data structures. * tpm2_send: Add support for handling sending and receiving command and response buffer for multiple commands. * tpm2_verifysignature: Added support for verifying RSA-PSS signatures. * tpm2_eventlog: - Add handling of sha1 log format. - Add fixes for eventlog output to be proper YAML. - Add support for sha384, sha512, sm3_256 PCR hash algorithms. - Add support for computing PCR values based on the events. * tpm2_tools (all): - Set stdin/stdout to non-buffering. - Added changes for FreeBSD portability. - Bug fixes * Fix printing short options when no ascii character is used. * OpenSSL: Fix deprecated OpenSSL functions. ECC Functions with suffix GFp will become deprecated (DEPRECATED_1_2_0). * tpm2_eventlog: output EV_POST_CODE as string not firmware blob to be compliant with TCG PC Client FPF section 2.3.4.1 and 9.4.12.3.4.1 * Fix missing handle maps for ESY3 handle breaks. See #1994. * tpm2_rsaencrypt: fix OAEP RSA encryption failing to invalid hash selection. * tpm2_rsadecrypt: fix OAEP RSA decryption failing to invalid hash selection. * tpm2_sign: fix for signing failures with restricted signing keys when input data to sign is not a digest, rather the full message. The validation ticket creation process defaults to the owner hierarchy and so in order to choose other hierarchies the tpm2_hash tool should be used instead. * tpm2_print: fix segfault when -t option is omitted by appropriately warning of the required option. * tpm2_nvdefine: fix for default size when size is not specified by invoking TPM2_CC_GetCapability. * Fix for an issue where the return code for unsupported algorithms was tool_rc_general instead of tool_rc_unsupported in tpm2_create and tpm2_createprimary tools. * Fix for an issue where RSA_PSS signature verification caused failures. * tpm2_nvreadpublic, tpm2_kdfa, tpm2_checkquote, tpm2_quote: Fixes for issues with interoperability of the attestation tools between big and little endian platforms. * tss2_*: - Fix bash-completion for tss2_pcrextend and tss2_verifysignature - Add force option to tss2_list - Make force option consistent in all fapi tools - Do not decode non-TPM errors - Enhance integration tests to test changes of optional/mandatory parameters - Add --hex parameter to tss2_getrandom - Fix autocompletion issue - Switch tss2_* to with-"="-style - Add size parameter to tss2_createseal - References to the cryptographic profile (fapi-profile(5)) and config file - (fapi-config(5)) man pages from all relevant tss2_* man pages. - Fix policy branch selection menu item from 1 to 0. - Documentation * wiki pages have been removed and data has been migrated to tpm2-software.github.io portal's tutorial section. * Fix the problem with man and no-man help output for tools were not correctly displayed. * man: - tpm2_create: Correct max seal data size from 256 bytes to 128 bytes. - tpm2_nvread: Fix manpage example. - tpm2_nvwrite: Added missing information on how to specify the NV index as an argument. - tpm2_unseal: Add end-to-end example. - tpm2_nvincrement: Fix incorrect commands in example section. - tpm2_hmac: Fix the example section. - fix `--version` output of tools. Since now autoreconf is called and configure.ac attempts to fetch the version from git (which we don't have during building), the version was empty. Fix this by replacing the git invocation in configure.ac. - add 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch: no longer use a fixed AES key in the context of the tpm2_import command. Fixes CVE-2021-3565 (bsc#1186490). - drop fix_pie_linking.patch: now contained in upstream tarball - drop fix_warnings.patch: now contained in upstream tarball - update to upstream version 5.1: - Minimum tpm2-tss version dependency bumped to 3.1.0 - Minimum tpm2-abrmd version dependency bumped to 2.4.0 - tss2: - Support in tools for PolicyRef inclusion in policy search per latest TSS. - Support to use TPM objects protected by a policy with PolicySigned. - Enable backward compatibility to old Fapi callback API. - Fix PCR selection for tss2 quote. - Support policy signed policies by implementing Fapi_SetSignCB. - Command/ response parameter support for auditing and pHash policies: - lib/tpm2_util.c: Add method to determine hashing alg for cp/rphash - Add support to calculate rphash for tpm2_create, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps, tpm2_nvdefine, tpm2_nvextend, tpm2_unseal - Add support to calculate cphash for tpm2_changeeps, tpm2_changepps. - Session-support: - tpm2_sessionconfig: Add tool to display and configure session attributes. - tpm2_getrandom: Fix— session input was hardcoded for audit-only - tpm2_startauthsession: Add option to specify the bind object and its authorization value. - tpm2_startauthsession: support for bounded-only session. - tpm2_startauthsession: support for salted-only session. - tpm2_startauthsession: add option to specify an hmac session type. - Add support for specifying non-authorization sessions for audit and parameter encryption for tpm2_getrandom, tpm2_create, tpm2_nvextend, tpm2_nvdefine, tpm2_unseal, tpm2_activatecredential, tpm2_certify, tpm2_certifycreation, tpm2_changeauth, tpm2_changeeps, tpm2_changepps. - tpm2_eventlog: - Support for event type: EV_IPL extensively used by the Shim and Grub. - Support for event type: EV_EFI_GPT_EVENT to parse. UEFI_PARTITION_TABLE_HEADER and UEFI_PARTITION_ENTRY. - Support for event type: EFI_SIGNATURE_LIST, which contains one or more EFI_SIGNATURE_DATA. - Support for event type EV_EFI_VARIABLE_AUTHORITY. - Parse UEFI_PLATFORM_FIRMWARE_BLOB structure that the CRTM MUST put into the Event Log entry TCG_PCR_EVENT2.event field for event types EV_POST_CODE, EV_S_CRTM_CONTENTS, and EV_EFI_PLATFORM_FIRMWARE_BLOB. - Parse secureboot variable to indicate enable as 'Yes'. - Parse BootOrder variable to a more readable format. - Parse Boot variables per EFI_LOAD_OPTION described in more details in UEFI Spec Section 3.1.3 - Parse Device-path in a readable format using the efivar library. - Support for logs longer than 64 kilobytes. - Perform verification for event types where digest can be verified from their event payload. - Better support for multiline strings. - Fix handling of event log EV_POST_CODE data where field is empty and len is specified. - scripts/utils: Add a utility to read the cert chain of embedded CA. - tpm2_getekcertificate: Fix tool failing to return error/non-zero for HTTP 404. - tpm2_nvdefine: allow setting hash algorithm by command line parameter for NV indices set in extend mode. - tpm2_duplicate, tpm2_import: support duplicating non-TPM keys to a remote TPM without first requiring them to be loaded to a local TPM. - tpm2_dictionarylockout: Fix issue where setting value for one parameter caused to reset the others. - tpm2_getpolicydigest: Add new tool to enable TPM2_CC_PolicyGetDigest. - Fix segfault where optind > argc. - tools/tpm2_checkquote: fix missing initializer - tpm2_convert: fix EVP_EncodeUpdate usage for OSSL < 1.1.0 - openssl: fix EVP_ENCODE_CTX_(new|free) - test: Add support for swTPM simulator to the testing framework and make it the default if mssim isn't available. - tpm2_unseal: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvextend: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_nvdefine: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_changepps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeeps: - Added option **\--cphash**=_FILE_ to specify ile path to record the hash of the command parameters. This is commonly termed as cpHash. - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_changeauth: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certifycreation: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_certify: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_activatecredential: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - Added option **-S**, **\--session** to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. - tpm2_create: - Added option **\--rphash**=_FILE_ to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. - tpm2_unseal: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvdefine: - Added option **-S**, **--session** to specify auxiliary sessions for audit and encryption. - tpm2_nvextend: - Added option **-S**, **--session** to specify auxilary sessions for audit and encryption. - Do not BuildRequire pandoc on ix86 architectures: the haskell stack is not supported on intel 32bit archs. - Disable lto to fix tpm2_checkquote error (boo#1187316) - Update service file to point to the correct revision - Add 0001-tpm2_checkquote-fix-uninitialized-variable.patch for a better fix of boo#1187316 - Re-enable lto - Add 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch to fix the tpm2_eventlog command (boo#1187360) - update to version 5.1.1: - tpm2_import: fix fixed AES key CVE-2021-3565 - tpm2_import used a fixed AES key for the inner wrapper, which means that a MITM attack would be able to unwrap the imported key. To fix this, ensure the key size is 16 bytes or bigger and use OpenSSL to generate a secure random AES key. - Avoid pandoc build dependency, use prebuilt man pages everywhere - Drop 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch, now upstream - Drop _service, unused - Drop unused unzip build dependency - Drop autoreconfigure call, no longer necessary - Use %autosetup - Verify tarball signature - Build against efivar - Drop %check section, tests weren't built, so that was a noop - prepare running the test suite via %check, but leave it commented out, because it is broken due to LTO linking. - Add 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch to fix the offset of the read buffer - Update to version 5.2: + tpm2_nvextend: * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_Extend command to the TPM. + tpm2_nvread: * Added option --rphash=FILE to specify ile path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NVRead command to the TPM. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. + tpm2_nvsetbits: * Added option --rphash=FILE to specify file path to record the hash of the response parameters. This is commonly termed as rpHash. * Added option -S, --session to specify to specify an auxiliary session for auditing and or encryption/decryption of the parameters. * Added option -n, --name to specify the name of the nvindex in hex bytes. This is used when cpHash ought to be calculated without dispatching the TPM2_NV_SetBits command to the TPM. + tpm2_createprimary: * Support public-key output at creation time in various public-key formats. + tpm2_create: * Support public-key output at creation time in various public-key formats. + tpm2_print: * Support outputing public key in various public key formats over the default YAML output. Supports taking -u output from tpm2_create and converting it to a PEM or DER file format. + tpm2_import: * Add support for importing keys with sealed-data-blobs. + tpm2_rsaencrypt, tpm2_rsadecrypt: * Add support for specifying the hash algorithm with oaep. + tpm2_pcrread, tpm2_quote: * Add option -F, --pcrs_format to specify PCR format selection for the binary blob in the PCR output file. 'values' will output a binary blob of the PCR values. 'serialized' will output a binary blob of the PCR values in the form of serialized data structure in little endian format. + tpm2_eventlog: * Add support for decoding StartupLocality. * Add support for printing the partition information. * Add support for reading eventlogs longer than 64kb including from /sys/kernel/security/tpm0/binary_bios-measurements. + tpm2_duplicate: * Add option -L, --policy to specify an authorization policy to be associated with the duplicated object. * Added support for external key duplication without needing the TCTI. + tools: * Enhance error message on invalid passwords when sessions cannot be used. + lib/tpm2_options: * Add option to specify fake tcti which is required in cases where sapi ctx is required to be initialized for retrieving command parameters without invoking the tcti to talk to the TPM. + openssl: * Dropped support for OpenSSL < 1.1.0 * Add support for OpenSSL 3.0.0 + Support added to make the repository documentation and man pages available live on readthedocs. + Bug-fixes: * tpm2_import: Don't allow setting passwords for imported object with -p option as the tool doesn't modify the TPM2B_SENSITIVE structure. Added appropriate logging to indicate using tpm2_changeauth after import. * lib/tpm2_util.c: The function to calculate pHash algorithm returned error when input session is a password session and the only session in the command. * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under ECC. * tpm2_sign: Fix segfaults when tool does not find TPM resources (TPM or RM). * tpm2_makecredential: Fix an issue where reading input from stdin could result in unsupported data size larger than the largest digest size. * tpm2_loadexternal: Fix an issue where restricted attribute could not be set. * lib/tpm2_nv_util.h: The NV index size is dependent on different data sets read from the GetCapability structures because there is a dependency on the NV operation type: Define vs Read vs Write vs Extend. Fix a sane default in the case where GetCapability fails or fails to report the specific property/ data set. This is especially true because some properties are TPM implementation dependent. * tpm2_createpolicy: Fix an issue where tool exited silently without reporting an error if wrong pcr string is specified. * lib/tpm2_alg_util: add error message on public init to prevent tools from dying silently, add an error message. * tpm2_import: fix an issue where an imported hmac object scheme was NULL. While allowed, it was inconsistent with other tools like tpm2_create which set the scheme as hmac->sha256 when generating a keyedhash object. - Drop patches already in upstream: + 0001-tpm2_checkquote-fix-uninitialized-variable.patch + 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch + 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch - Fix python3-PyYAML requirement - Move the tests inside a bcond. Disabled by default. - The update to 5.2 fill also jsc#SLE-9515 (4.1) and jsc#SLE-17366 (4.3.0) - Add 0001-tpm2_checkquote-Fix-check-of-magic-number.patch: tpm2_checkquote did not check whether the magic number in the attest is equal to TPM2_GENERATED_VALUE, which might allow a malicious actor to generate arbitrary quote data, undetected by tpm2_checkquote (bsc#1223687, CVE-2024-29038). - Add 0001-tpm2_checkquote-Add-comparison-of-pcr-selection.patch: tpm2_checkquote did not compare the --pcr parameter passed to the tool with the attest. A malicious actor might thus be able to fake a valid attestation (bsc#1223689, CVE-2024-29039). - Initial version. obsoletes the version found in package net-tools - This is the implementation used by the rest of the planet, not the one found in SUSE but Fedora, RHEL, Debian, Mandriva, Gentoo, Ubuntu. - The previous incarnation of traceroute had a traceroute6 binary, provide a compatibility symlink for it. - Build with full RELRO. - version 2.0.20 * Describe all complementary long options in the man page * Use correct service name for AS lookups * Avoid some rare case null dereference * Improve expiration check for simultaneous probes - traceroute-secure_getenv.patch use secure_getenv - traceroute-autotools.patch refresh - Version 2.0.21 * fix -F --mtu with current kernel versions - traceroute-autotools.patch refresh and add -fvisibility=hidden to CFLAGS. - traceroute-autotools.patch: switch to non-recursive automake without libtool. - security update - added patches fix CVE-2023-46316 [bsc#1216591], wrapper scripts do not properly parse command lines + traceroute-CVE-2023-46316.patch - Initial version. obsoletes the version found in package net-tools - This is the implementation used by the rest of the planet, not the one found in SUSE but Fedora, RHEL, Debian, Mandriva, Gentoo, Ubuntu. - The previous incarnation of traceroute had a traceroute6 binary, provide a compatibility symlink for it. - Build with full RELRO. - version 2.0.20 * Describe all complementary long options in the man page * Use correct service name for AS lookups * Avoid some rare case null dereference * Improve expiration check for simultaneous probes - traceroute-secure_getenv.patch use secure_getenv - traceroute-autotools.patch refresh - Version 2.0.21 * fix -F --mtu with current kernel versions - traceroute-autotools.patch refresh and add -fvisibility=hidden to CFLAGS. - traceroute-autotools.patch: switch to non-recursive automake without libtool. - security update - added patches fix CVE-2023-46316 [bsc#1216591], wrapper scripts do not properly parse command lines + traceroute-CVE-2023-46316.patch - Initial version. obsoletes the version found in package net-tools - This is the implementation used by the rest of the planet, not the one found in SUSE but Fedora, RHEL, Debian, Mandriva, Gentoo, Ubuntu. - The previous incarnation of traceroute had a traceroute6 binary, provide a compatibility symlink for it. - Build with full RELRO. - version 2.0.20 * Describe all complementary long options in the man page * Use correct service name for AS lookups * Avoid some rare case null dereference * Improve expiration check for simultaneous probes - traceroute-secure_getenv.patch use secure_getenv - traceroute-autotools.patch refresh - Version 2.0.21 * fix -F --mtu with current kernel versions - traceroute-autotools.patch refresh and add -fvisibility=hidden to CFLAGS. - traceroute-autotools.patch: switch to non-recursive automake without libtool. - security update - added patches fix CVE-2023-46316 [bsc#1216591], wrapper scripts do not properly parse command lines + traceroute-CVE-2023-46316.patch - Initial version. obsoletes the version found in package net-tools - This is the implementation used by the rest of the planet, not the one found in SUSE but Fedora, RHEL, Debian, Mandriva, Gentoo, Ubuntu. - The previous incarnation of traceroute had a traceroute6 binary, provide a compatibility symlink for it. - Build with full RELRO. - version 2.0.20 * Describe all complementary long options in the man page * Use correct service name for AS lookups * Avoid some rare case null dereference * Improve expiration check for simultaneous probes - traceroute-secure_getenv.patch use secure_getenv - traceroute-autotools.patch refresh - Version 2.0.21 * fix -F --mtu with current kernel versions - traceroute-autotools.patch refresh and add -fvisibility=hidden to CFLAGS. - traceroute-autotools.patch: switch to non-recursive automake without libtool. - security update - added patches fix CVE-2023-46316 [bsc#1216591], wrapper scripts do not properly parse command lines + traceroute-CVE-2023-46316.patch - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - updated to trousers 0.3.13 (bnc#881095 LTC#111124) - Changed exported functions which had a name too common, to avoid collision - Assessed daemon security using manual techniques and coverity - Fixed major security bugs and memory leaks - Added debug support to run tcsd with a different user/group - Daemon now properly closes sockets before shutting down * TROUSERS_0_3_12 - Added new network code for RPC, which supports IPv6 - Users of client applications can configure the hostname of the tcsd server they want to connect through the TSS_TCSD_HOSTNAME env var (only works if application didn't set a hostname in the context) - Added disable_ipv4 and disable_ipv6 config options for server - removed trousers-wrap_large_key_overflow.patch: upstream - removed trousers-0.3.11.2.diff: solved upstream now - Cleanup spec-file with spec-cleaner - Update prerequires - Use systemd unit file * replace tcsd.init with tcsd.service - Force GNU inline semantics, fixes build with GCC5 - Check for user/group existence before attempting to add them, and remove error suppression from these calls. - Avoid runtime dependency on systemd, the macros can all deal with its absence. - Update to version 0.3.14 (see ChangeLog) (FATE#321450) - fix wrong installation of system.data.{auth,noauth} into /var/lib/tpm. These files are only sample files that *can* be used to fake that ownership was already taken by trousers, when other TPM stacks did that already. These files should not be there by default. Therefore install them into /usr/share/trousers instead, to allow the user to use them at his own discretion (fixes bsc#1111381). - implement a backup and restore logic for /var/lib/tpm/system.data.* to prevent removal of validly stored trousers state during update. - Fix a local symlink attack problem with the %posttrans scriptlet (bsc#1157651, CVE-2019-18898). A rogue tss user could have used this attack to gain ownership of arbitrary files in the system during installation/update of the trousers package. - fix a potential tss user to root privilege escalation when running tcsd (bsc#1164472). To do this run tcsd as the 'tss' user right away to prevent badly designed privilege drop and initialization code to run. - add bsc1164472.patch: additionally harden operation of tcsd when running as root. No longer follow symlinks in /var/lib/tpm. Drop gid to tss main group. require /etc/tcsd.conf to be owned by root:tss mode 0640. - update to new upstream version 0.3.15 (jira#SLE-18269): - Corrected mutliple security issues that existed if the tcsd is started by root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331 - Replaced use of _no_optimize with asm memory barrier - Fixed multiple potential instances of use after free memory handling - Removed unused global variables which caused build issue on some distros - drop bsc1164472.patch: now contained in upstream tarball - adjusted %setup macro invocation which seemed to be wrong - fix runtime requirements for stat and udevadm (bsc#1221770). On minimal systems this can cause the %pretrans or %post scriptlets to fail because of missing tools. - updated to trousers 0.3.13 (bnc#881095 LTC#111124) - Changed exported functions which had a name too common, to avoid collision - Assessed daemon security using manual techniques and coverity - Fixed major security bugs and memory leaks - Added debug support to run tcsd with a different user/group - Daemon now properly closes sockets before shutting down * TROUSERS_0_3_12 - Added new network code for RPC, which supports IPv6 - Users of client applications can configure the hostname of the tcsd server they want to connect through the TSS_TCSD_HOSTNAME env var (only works if application didn't set a hostname in the context) - Added disable_ipv4 and disable_ipv6 config options for server - removed trousers-wrap_large_key_overflow.patch: upstream - removed trousers-0.3.11.2.diff: solved upstream now - Cleanup spec-file with spec-cleaner - Update prerequires - Use systemd unit file * replace tcsd.init with tcsd.service - Force GNU inline semantics, fixes build with GCC5 - Check for user/group existence before attempting to add them, and remove error suppression from these calls. - Avoid runtime dependency on systemd, the macros can all deal with its absence. - Update to version 0.3.14 (see ChangeLog) (FATE#321450) - fix wrong installation of system.data.{auth,noauth} into /var/lib/tpm. These files are only sample files that *can* be used to fake that ownership was already taken by trousers, when other TPM stacks did that already. These files should not be there by default. Therefore install them into /usr/share/trousers instead, to allow the user to use them at his own discretion (fixes bsc#1111381). - implement a backup and restore logic for /var/lib/tpm/system.data.* to prevent removal of validly stored trousers state during update. - Fix a local symlink attack problem with the %posttrans scriptlet (bsc#1157651, CVE-2019-18898). A rogue tss user could have used this attack to gain ownership of arbitrary files in the system during installation/update of the trousers package. - fix a potential tss user to root privilege escalation when running tcsd (bsc#1164472). To do this run tcsd as the 'tss' user right away to prevent badly designed privilege drop and initialization code to run. - add bsc1164472.patch: additionally harden operation of tcsd when running as root. No longer follow symlinks in /var/lib/tpm. Drop gid to tss main group. require /etc/tcsd.conf to be owned by root:tss mode 0640. - update to new upstream version 0.3.15 (jira#SLE-18269): - Corrected mutliple security issues that existed if the tcsd is started by root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331 - Replaced use of _no_optimize with asm memory barrier - Fixed multiple potential instances of use after free memory handling - Removed unused global variables which caused build issue on some distros - drop bsc1164472.patch: now contained in upstream tarball - adjusted %setup macro invocation which seemed to be wrong - fix runtime requirements for stat and udevadm (bsc#1221770). On minimal systems this can cause the %pretrans or %post scriptlets to fail because of missing tools. - Updated to TROUNSERS_0_3_6 - Fixed a number of warnings during a build with --debug regarding THREAD ID definition - Removed htole() dependency, which was included only in glibc 2.9 - Updated to TROUSERS_0_3_5 - Allowed TCD Daemon to run with reduced privileges In Solaris. - Fixing previous kfreebsd build patch conflict with the current tree. - TCSD error handling improvements. - mutex init inclusion. - pthread_t portability fix - Owner Evict keys load fix. - Big- endian issues. - Memory leak fix. - Adding missing #include <limits.h>. - kfreebsd build fixes. - Fixed usage of syslog(). - 64bits clean - Fixes the TCP UN and IN socket connection attempt handling - Fixes logic on opening a hardware TPM. - Added communication through TCP to software TPMs in TrouSerS. - Fixed conflicting defines - Adds missing free() - Fixed fread() return value check. - Made the previous fix cleaner and more robust. - Added missing check in order to avoid freeing buffer that's out of Tspi_Data_Seal() scope. - Fixed Tspi_TPM_GetRandom 4kb output limit. - fix patch to apply - Updated to TROUSERS_0_3_7 - bugfixes - obj_policy_is_secret_set added - add libtool as buildrequire to avoid implicit dependency - license update: CPL-1.0 SPDX format - Updated to TROUSERS_0_3_8 - Fix ssl_ui.c overflow - Handling of TPM_CERTIFY_INFO2 structure special case - Fix possible obfuscation of obj_migdata.c errors. - Make 1.2 keys respect the TPM_PCRIGNOREDONREAD flag. - PCRInfo member allocation in Trspi_Unload_CERTIFY_INFO. - Add functions for deserializing NVRAM related data structures - Add NVRAM specific error messages - Fix spec file so one can build an rpm - Initialize the tcsd_config_file with NULL. - support for -c <configfile> command line option - Establish a .gitignore file - ENDIAN_H and htole definition fix - Updated to trousers 0.3.9 - lots of bugfixes - updated to trousers 0.3.10 - bugfixes - context checking - Updated to trousers 0.3.11.2 - license changed to BSD-3-Clause - various bug and manpage fixes - trousers-0.3.10.diff renamed and rebased to trousers-0.3.11.2.diff - trousers-wrap_large_key_overflow.patch: Do not wrap keys larger than 2048 bit, as the space on the TPM is limited to that amount. (bnc#868933) - updated to trousers 0.3.13 (bnc#881095 LTC#111124) - Changed exported functions which had a name too common, to avoid collision - Assessed daemon security using manual techniques and coverity - Fixed major security bugs and memory leaks - Added debug support to run tcsd with a different user/group - Daemon now properly closes sockets before shutting down * TROUSERS_0_3_12 - Added new network code for RPC, which supports IPv6 - Users of client applications can configure the hostname of the tcsd server they want to connect through the TSS_TCSD_HOSTNAME env var (only works if application didn't set a hostname in the context) - Added disable_ipv4 and disable_ipv6 config options for server - removed trousers-wrap_large_key_overflow.patch: upstream - removed trousers-0.3.11.2.diff: solved upstream now - Cleanup spec-file with spec-cleaner - Update prerequires - Use systemd unit file * replace tcsd.init with tcsd.service - Force GNU inline semantics, fixes build with GCC5 - Check for user/group existence before attempting to add them, and remove error suppression from these calls. - Avoid runtime dependency on systemd, the macros can all deal with its absence. - Update to version 0.3.14 (see ChangeLog) (FATE#321450) - fix wrong installation of system.data.{auth,noauth} into /var/lib/tpm. These files are only sample files that *can* be used to fake that ownership was already taken by trousers, when other TPM stacks did that already. These files should not be there by default. Therefore install them into /usr/share/trousers instead, to allow the user to use them at his own discretion (fixes bsc#1111381). - implement a backup and restore logic for /var/lib/tpm/system.data.* to prevent removal of validly stored trousers state during update. - Fix a local symlink attack problem with the %posttrans scriptlet (bsc#1157651, CVE-2019-18898). A rogue tss user could have used this attack to gain ownership of arbitrary files in the system during installation/update of the trousers package. - fix a potential tss user to root privilege escalation when running tcsd (bsc#1164472). To do this run tcsd as the 'tss' user right away to prevent badly designed privilege drop and initialization code to run. - add bsc1164472.patch: additionally harden operation of tcsd when running as root. No longer follow symlinks in /var/lib/tpm. Drop gid to tss main group. require /etc/tcsd.conf to be owned by root:tss mode 0640. - update to new upstream version 0.3.15 (jira#SLE-18269): - Corrected mutliple security issues that existed if the tcsd is started by root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331 - Replaced use of _no_optimize with asm memory barrier - Fixed multiple potential instances of use after free memory handling - Removed unused global variables which caused build issue on some distros - drop bsc1164472.patch: now contained in upstream tarball - adjusted %setup macro invocation which seemed to be wrong - fix runtime requirements for stat and udevadm (bsc#1221770). On minimal systems this can cause the %pretrans or %post scriptlets to fail because of missing tools. - updated to trousers 0.3.13 (bnc#881095 LTC#111124) - Changed exported functions which had a name too common, to avoid collision - Assessed daemon security using manual techniques and coverity - Fixed major security bugs and memory leaks - Added debug support to run tcsd with a different user/group - Daemon now properly closes sockets before shutting down * TROUSERS_0_3_12 - Added new network code for RPC, which supports IPv6 - Users of client applications can configure the hostname of the tcsd server they want to connect through the TSS_TCSD_HOSTNAME env var (only works if application didn't set a hostname in the context) - Added disable_ipv4 and disable_ipv6 config options for server - removed trousers-wrap_large_key_overflow.patch: upstream - removed trousers-0.3.11.2.diff: solved upstream now - Cleanup spec-file with spec-cleaner - Update prerequires - Use systemd unit file * replace tcsd.init with tcsd.service - Force GNU inline semantics, fixes build with GCC5 - Check for user/group existence before attempting to add them, and remove error suppression from these calls. - Avoid runtime dependency on systemd, the macros can all deal with its absence. - Update to version 0.3.14 (see ChangeLog) (FATE#321450) - fix wrong installation of system.data.{auth,noauth} into /var/lib/tpm. These files are only sample files that *can* be used to fake that ownership was already taken by trousers, when other TPM stacks did that already. These files should not be there by default. Therefore install them into /usr/share/trousers instead, to allow the user to use them at his own discretion (fixes bsc#1111381). - implement a backup and restore logic for /var/lib/tpm/system.data.* to prevent removal of validly stored trousers state during update. - Fix a local symlink attack problem with the %posttrans scriptlet (bsc#1157651, CVE-2019-18898). A rogue tss user could have used this attack to gain ownership of arbitrary files in the system during installation/update of the trousers package. - fix a potential tss user to root privilege escalation when running tcsd (bsc#1164472). To do this run tcsd as the 'tss' user right away to prevent badly designed privilege drop and initialization code to run. - add bsc1164472.patch: additionally harden operation of tcsd when running as root. No longer follow symlinks in /var/lib/tpm. Drop gid to tss main group. require /etc/tcsd.conf to be owned by root:tss mode 0640. - update to new upstream version 0.3.15 (jira#SLE-18269): - Corrected mutliple security issues that existed if the tcsd is started by root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331 - Replaced use of _no_optimize with asm memory barrier - Fixed multiple potential instances of use after free memory handling - Removed unused global variables which caused build issue on some distros - drop bsc1164472.patch: now contained in upstream tarball - adjusted %setup macro invocation which seemed to be wrong - fix runtime requirements for stat and udevadm (bsc#1221770). On minimal systems this can cause the %pretrans or %post scriptlets to fail because of missing tools. - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.5 - t-u: Use tukit for SUSEConnect call [bsc#1190574] Correctly registers repositories - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.6 - tukit: Add S/390 bootloader support [bsc#1189807] - t-u: support purge-kernels with t-u patch [bsc#1190788] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.5.7 Various fixes affecting Salt support: - t-u: Don't squash stderr messages into stdout - t-u: Correctly handle case when the snapshot has been deleted due to using --drop-if-no-change: Don't show reboot messages and avoid an awk error message [bsc#1191475] - tukit: Make inotify handler less sensitive / ignore more directories [bsc#1191475] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - Version 3.6.0 - Simplify mount hierarchy by just using a single slave bind mount as the root of the update environment; this may avoid the error messages of failed unmounts May fix [boo#1191945] - Version 3.6.1 - Fix rsyncing /etc into the running system with - -drop-if-no-change [bsc#1192242] - Version 3.6.2 - Bind mount root file system snapshot on itself, this makes the temporary directory in /tmp unnecessary; also fixes [boo#1188110] to return the correct snapshot's working directory via API call. - Use separate mount namespace for transactional-update; this should fix several applications that fail to run if a mount point has the 'unbindable' mount flag set - Version 4.0.0~rc1 This release is API, but not ABI compatible with previous releases; existing applications will have to be recompiled against this new version. Major features: - Introduces a D-Bus service to access the libtukit API via the org.opensuse.tukit.Transaction interface - Introduces a C binding via libtukit.h. Other changes: - t-u: Rework --quiet handling to make sure no output is shown even in error cases; this is necessary for automation, e.g. with Salt. [gh#openSUSE/transactional-update#73] - tukit: Allow storing command output into variable by introducing a new optional parameter for "execute" and "callExt". - Replace multiple and non-standalone occurenses of {} in "callExt" argument. - Split transactional-update.timer into transactional-update.timer and transactional-update-cleanup.timer; the later will clean up old snapshots even when the system does not do automatic updates. - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged". - Throw exception if snapshot is not found. - Fix various compiler warnings - Update spec file: - Include tukitd D-Bus daemon - Only install one version of the library (as there are no breaking API changes yet) - Add %pre scriplets for systemd services - Replace %systemd_postun scriptlets with %systemd_postun_with_restart to satisfy rpmlint checks - Add transactional-update log file as %ghost file - Version 4.0.0~rc2 - Fix missing prompt in "shell" command [bsc#1196580] - Add output of tukit commands to log file - Fix compilation error with GCC12 [boo#1194876] - Fixed (non-critical) security review comments [boo#1196149] - Fixed selfupdate - Code cleanup - Version 4.0.0~rc3 - Add Snapshot interface - Reworked signal handling: All public signals are sent from the main thread now, keeping the same sender for everything - Implement D-Bus call "Execute" for Transactions - Implement interface for listing Snapshots - Implement Reboot interface - Fix bug when using --continue on old snapshots - Fix hypothetical integer overflow in snapshot list [bsc#1196826] - Fix wrong sort order in status command [gh#openSUSE/transactional-update#80] - Version 4.0.0~rc4 - Fix building with GCC 12 - Fix stack overflow with very long commands / ids [bsc#1196149] - Use separate mount namespace for chroot, allowing overwriting the bind mounts from the update environment - this could have lead to data loss of the bind mount previously - Fix C error and exception handling for snapshots - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Version 4.0.0 - Last minute interface change: Changed "List" method of Snapshot D-Bus interface to return a map of properties instead of a comma separated list of strings; this will allow retrieving the snapshot properties even if they contain a comma in their value [boo#1202147] - Remove "Snapshot.hpp" as a public API for now - all public functionality is part of SnapshotManager.hpp - Add header file documentation for SnapshotManager.hpp - Add method to delete snapshot [gh#openSUSE/transactional-update#52] - Allow setting description of snapshot [gh#openSUSE/transactional-update#55] - create_dirs_from_rpmdb: set SELinux file context of missing directories [gh#openSUSE/transactional-update#84], [bsc#1197242] - Fix broken logrotate due to typo in config file [gh#openSUSE/transactional-update#87] - create_dirs_from_rpmdb: Fix handling return code of create_dirs() [gh#openSUSE/transactional-update#86] - Fix broken "shell" prompt after selfupdate - Add documented D-Bus interface definition files - Add tukit_sm_get_current and tukit_sm_get_default to C interface - Fixed typos - Version 4.0.1 - create_dirs_from_rpmdb: Just warn if no default SELinux context found [gh#openSUSE/transactional-update#88], [bsc#1188215] - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure [gh#openSUSE/transactional-update#88] - Handle directories owned by multiple packages [gh#openSUSE/transactional-update#90], [bsc#1188215] - Migration of logrotate configuration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Version 4.1.0 - t-u: Add a "setup-kdump" command; implements [jsc#PED-1441] - Export TRANSACTIONAL_UPDATE_ROOT (the path to the snapshot) in the update environment; implements [jsc#PED-1078] - Add support for "notify" reboot method for desktop use [gh#openSUSE/transactional-update#93] - Fix kdump initrd recreation detection; the check was performed in the active snapshot instead of the target snapshot - Document register command [bsc#1202900] - Avoid unnecessary snapshots for register command [bsc#1202901] - Various optimizations for register command - Remove bogus error message when triggering reboot - Rework /etc overlay documentation in "The Transactional Update Guide" - Fix incorrect manpage formatting - Remove leftover "salt" reboot method in configuration example file - Replace deprecated std::mem_fn with lambdas - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.3 - Suppress SELinux relabelling output in quiet mode - Documentation readability improvements - Version 4.1.4 - Workaround for broken Tumbleweed package libfdisk1 - Version 4.1.6 - Use permissions of real /etc when creating overlay [bsc#1215878] - Version 4.1.5 - Add support for configuration file snippets - Version 4.1.7 - Always use zypper of installed system [bsc#1221346] - Version 4.1.8 - tukit: Properly handle overlay syncing failures: If the system would not be rebooted and several snapshots accumulated in the meantime, it was possible that the previous base snapshot - required for /etc syncing - was deleted already. In that case changes in /etc might have been reset. [gh#openSUSE/transactional-update#116] [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287] - Version 4.1.9 - Adding support for specifying migration arguments - tuned-2.4.0-use_cpupower_for_intel_perf_bias.patch * fixed indentation and tabs usage - Update to 2.5.1 * plugin_scheduler: work with nohz_full (rhbz#1247184) * fixed realtime-virtual-guest/host profiles packaged twice (rhbz#1249028) * fixed requirements of realtime and nfv profiles * fixed tuned-gui not starting (boo#937647) * various other minor fixes - Fix build for openSUSE Leap (lack of tmpfiles.d macro) - Update to 2.6.0 * plugin_cpu: do not show error if cpupower or x86_energy_perf_policy are missing * plugin_sysctl: fixed quoting of sysctl values * tuned-adm: added log file location hint to verify command output * libexec: fixed listdir and isdir in defirqaffinity.py * plugin_cpu: save and restore only intel pstate attributes that were changed * functions: fixed sysfs save to work with options * plugins: added scsi_host plugin * tuned-adm: fixed restart attempt if tuned is not running * spec: fixed post scriptlet to work without grub * tuned-profiles-nfv: fix find-lapictscdeadline-optimal.sh for CPUS where ns > 6500 * functions: fixed restore_logs_syncing to preserve SELinux context on rsyslog.conf * realtime: set unboud workqueues cpumask * spec: correctly remove tuned footprint from /etc/default/grub * gui: fixed creation of new profile * profiles: removed nohz_full from the realtime profile * profiles: Added nohz_full and nohz=on to realtime guest/host profiles * profiles: fixed lapic_timer_adv_ns cache * plugin_sysctl: pass verification even if the option doesn't exist * added support for 'summary' and 'description' of profiles, extended D-Bus API for better Cockpit support - Update to version 2.8.0: * builtin functions: parser not traceback if func expands to empty string * systemd: added support for older systemd CPUAffinity syntax * scheduler: do not traceback if process dissapears during enumeration * scheduler: fix more python-linux-procfs tracebacks * plugin_net: Fix invocation of execute() * cpu-partitioning: use tuna for cores isolation * builtin functions: add strip * bootloader: workaround for adding tuned_initrd to new kernels on restart * new release (2.8.0) + Add Patch: Fix category in desktop file for tuned-gui (fix-desktop-category.patch) + Add Patch: Remove unnecessary shebangs (remove-unnecessary-shebangs.patch) + Add Patch: Fix file permission for glade file (fix-glade-file-permission.patch) + Add rpmlintrc to silence unnecessary warnings + Remove Patch: tuned-2.4.0-use_cpupower_for_intel_perf_bias.patch = Modified Patches to apply with 2.8.0: - fix-allow-receive_sender-default.patch - use-cpupower-for-intel-perf-bias.patch - check for `cpupower` binary and set attribute correctly (bsc#1055070) - added patch: * check_for_cpupower.patch - Own %{_sysconfdir}/dbus-1/system.d and %{_sysconfdir}/dbus-1: in the past systemd happened to install things there and 'own' the directory for us, but that was just a coincidence. - Replace systemd BuildRequires with pkgconfig(systemd), allowing OBS to pick systemd-mini for the build. - Switch to normal url fetching, there is no actual reason to run service in order to generate the versioned tarballs - Switch to python3 and format with spec-cleaner - Version update to 2.9.0: * python3 porting start * various small fixes - Drop patches merged upstream: * fix-desktop-category.patch * remove-unnecessary-shebangs.patch * fix-glade-file-permission.patch - Switch to autopatch from calling all individual patchlines - Reintroduce the _service file as we must use git head in order to get all the python3 fixes in - Update to version 2.9.0+git20180328.d25e8b8: * makefile: dropped KVM unit tests, now provided by standalone package * sysctl: support assignment modifiers as other plugins do * spec: used weak deps for tuned-profiles-nfv-host-bin * Added requires to tuned-profiles-nfv-host-bin * Dropped tuned-profiles-nfv-host-bin subpackage * tuned: Add readahead comment to throughput-performance tuned.conf * oracle: fixed ip_local_port_range parity warning * Consistently use 'balance' instead of 'rebalance' in cpu-partitioning - Rebase check_for_cpupower.patch to apply cleanly again - Go for 2.10.0 full version in _service (even this is rc1) bsc#1071436 Latest included git commit: commit 3722b151920dc20735dc15cbd45aed7b573fdfc2 Date: Wed Nov 21 14:21:32 2018 +0100 Still keep the old git version parameter commented out, maybe I need this again. - Since cpupower also has perf_bias binary, the cpupower call to switch this has been reverted to lower maintenance overhead D check_for_cpupower.patch D use-cpupower-for-intel-perf-bias.patch - Update to version 2.10.0: * Add range feature for cpu exclusion * Disable KSM only once, re-enable it only on full rollback * Add log message for unsupported parameters in plugin_net * Add missing feature parameters aliases to plugin_net * Make virtual-host identical to latency-performance - Add missing dependency on python3-linux-procfs - Remove sap subpackages entirely for SLE and Leap products. These conflict with possible other SLE optimized sap subpackages (bnc#1064832). - Create systemd tmpfiles correctly for different releases again. - Update to latest git head commit 26db89de18efad1b4536 including quite some mainline fixes - tuned needs polkit daemon running - Differ archs and x86 CPU vendors to avoid wrong warning about a missing intel tool (x86_energy_perf_bias) - Remember arch and x86 CPU vendor to allow arch/vendor specific CPU tunings in the future (fate#326694) A tuned_differ_x86_and_other_archs_in_cpu_plugin.patch - Require virt-what to be able to detect whether it is running on a virtual machine Added mainline git commit of with proper header: A balanced_added_explicit_priority_to_CPU_plugin_instance.patch D tuned_differ_x86_and_other_archs_in_cpu_plugin.patch Fix backtrace/exit when log file gets rotated (bsc#bsc#1126609): log_initialize_explicitly_with_int.patch Added mainline git commit bug fixes found by review: A conservative_governor_may_be_compiled_as_module_and_needs_explicit_loading.patch A fix_check_in_add_and_remove_device_methods_of_monitor_class.patch A fix_unit_configuration_reading.patch A increase_log_file_size.patch A log_full_stack_trace_of_unhandled_exceptions_as_an_error.patch A plugin_disk_fix_checking_removable_attribute_on_python3.patch A plugin_disk_fix_plug_in_out_problem.patch A reload_profile_configuration_on_SIGHUP.patch A s2kb_fixed_to_be_compatible_with_python3.patch A tuned_differ_x86_and_other_archs_in_cpu_plugin_mainline.patch - Exclude leftover config file (bsc#1153341): /etc/tuned/sap-hana-vmware-variables.conf which is part of sap-hana-vmware-variables profile, which got explicitly excluded recently - plugin_script: Execute all scripts regardless of errors found by review for SLE 15 SP4 (jsc#SLE-20335) A plugin_script-Execute-all-scripts-regardless-of-errors.patch - added uncore plugin (jsc#PED-8397) A uncore-477.patch A uncore-590.patch A uncore-606.patch - own directory /usr/lib/kernel/install.d to fix build - tuned-2.4.0-use_cpupower_for_intel_perf_bias.patch * fixed indentation and tabs usage - Update to 2.5.1 * plugin_scheduler: work with nohz_full (rhbz#1247184) * fixed realtime-virtual-guest/host profiles packaged twice (rhbz#1249028) * fixed requirements of realtime and nfv profiles * fixed tuned-gui not starting (boo#937647) * various other minor fixes - Fix build for openSUSE Leap (lack of tmpfiles.d macro) - Update to 2.6.0 * plugin_cpu: do not show error if cpupower or x86_energy_perf_policy are missing * plugin_sysctl: fixed quoting of sysctl values * tuned-adm: added log file location hint to verify command output * libexec: fixed listdir and isdir in defirqaffinity.py * plugin_cpu: save and restore only intel pstate attributes that were changed * functions: fixed sysfs save to work with options * plugins: added scsi_host plugin * tuned-adm: fixed restart attempt if tuned is not running * spec: fixed post scriptlet to work without grub * tuned-profiles-nfv: fix find-lapictscdeadline-optimal.sh for CPUS where ns > 6500 * functions: fixed restore_logs_syncing to preserve SELinux context on rsyslog.conf * realtime: set unboud workqueues cpumask * spec: correctly remove tuned footprint from /etc/default/grub * gui: fixed creation of new profile * profiles: removed nohz_full from the realtime profile * profiles: Added nohz_full and nohz=on to realtime guest/host profiles * profiles: fixed lapic_timer_adv_ns cache * plugin_sysctl: pass verification even if the option doesn't exist * added support for 'summary' and 'description' of profiles, extended D-Bus API for better Cockpit support - Update to version 2.8.0: * builtin functions: parser not traceback if func expands to empty string * systemd: added support for older systemd CPUAffinity syntax * scheduler: do not traceback if process dissapears during enumeration * scheduler: fix more python-linux-procfs tracebacks * plugin_net: Fix invocation of execute() * cpu-partitioning: use tuna for cores isolation * builtin functions: add strip * bootloader: workaround for adding tuned_initrd to new kernels on restart * new release (2.8.0) + Add Patch: Fix category in desktop file for tuned-gui (fix-desktop-category.patch) + Add Patch: Remove unnecessary shebangs (remove-unnecessary-shebangs.patch) + Add Patch: Fix file permission for glade file (fix-glade-file-permission.patch) + Add rpmlintrc to silence unnecessary warnings + Remove Patch: tuned-2.4.0-use_cpupower_for_intel_perf_bias.patch = Modified Patches to apply with 2.8.0: - fix-allow-receive_sender-default.patch - use-cpupower-for-intel-perf-bias.patch - check for `cpupower` binary and set attribute correctly (bsc#1055070) - added patch: * check_for_cpupower.patch - Own %{_sysconfdir}/dbus-1/system.d and %{_sysconfdir}/dbus-1: in the past systemd happened to install things there and 'own' the directory for us, but that was just a coincidence. - Replace systemd BuildRequires with pkgconfig(systemd), allowing OBS to pick systemd-mini for the build. - Switch to normal url fetching, there is no actual reason to run service in order to generate the versioned tarballs - Switch to python3 and format with spec-cleaner - Version update to 2.9.0: * python3 porting start * various small fixes - Drop patches merged upstream: * fix-desktop-category.patch * remove-unnecessary-shebangs.patch * fix-glade-file-permission.patch - Switch to autopatch from calling all individual patchlines - Reintroduce the _service file as we must use git head in order to get all the python3 fixes in - Update to version 2.9.0+git20180328.d25e8b8: * makefile: dropped KVM unit tests, now provided by standalone package * sysctl: support assignment modifiers as other plugins do * spec: used weak deps for tuned-profiles-nfv-host-bin * Added requires to tuned-profiles-nfv-host-bin * Dropped tuned-profiles-nfv-host-bin subpackage * tuned: Add readahead comment to throughput-performance tuned.conf * oracle: fixed ip_local_port_range parity warning * Consistently use 'balance' instead of 'rebalance' in cpu-partitioning - Rebase check_for_cpupower.patch to apply cleanly again - Go for 2.10.0 full version in _service (even this is rc1) bsc#1071436 Latest included git commit: commit 3722b151920dc20735dc15cbd45aed7b573fdfc2 Date: Wed Nov 21 14:21:32 2018 +0100 Still keep the old git version parameter commented out, maybe I need this again. - Since cpupower also has perf_bias binary, the cpupower call to switch this has been reverted to lower maintenance overhead D check_for_cpupower.patch D use-cpupower-for-intel-perf-bias.patch - Update to version 2.10.0: * Add range feature for cpu exclusion * Disable KSM only once, re-enable it only on full rollback * Add log message for unsupported parameters in plugin_net * Add missing feature parameters aliases to plugin_net * Make virtual-host identical to latency-performance - Add missing dependency on python3-linux-procfs - Remove sap subpackages entirely for SLE and Leap products. These conflict with possible other SLE optimized sap subpackages (bnc#1064832). - Create systemd tmpfiles correctly for different releases again. - Update to latest git head commit 26db89de18efad1b4536 including quite some mainline fixes - tuned needs polkit daemon running - Differ archs and x86 CPU vendors to avoid wrong warning about a missing intel tool (x86_energy_perf_bias) - Remember arch and x86 CPU vendor to allow arch/vendor specific CPU tunings in the future (fate#326694) A tuned_differ_x86_and_other_archs_in_cpu_plugin.patch - Require virt-what to be able to detect whether it is running on a virtual machine Added mainline git commit of with proper header: A balanced_added_explicit_priority_to_CPU_plugin_instance.patch D tuned_differ_x86_and_other_archs_in_cpu_plugin.patch Fix backtrace/exit when log file gets rotated (bsc#bsc#1126609): log_initialize_explicitly_with_int.patch Added mainline git commit bug fixes found by review: A conservative_governor_may_be_compiled_as_module_and_needs_explicit_loading.patch A fix_check_in_add_and_remove_device_methods_of_monitor_class.patch A fix_unit_configuration_reading.patch A increase_log_file_size.patch A log_full_stack_trace_of_unhandled_exceptions_as_an_error.patch A plugin_disk_fix_checking_removable_attribute_on_python3.patch A plugin_disk_fix_plug_in_out_problem.patch A reload_profile_configuration_on_SIGHUP.patch A s2kb_fixed_to_be_compatible_with_python3.patch A tuned_differ_x86_and_other_archs_in_cpu_plugin_mainline.patch - Exclude leftover config file (bsc#1153341): /etc/tuned/sap-hana-vmware-variables.conf which is part of sap-hana-vmware-variables profile, which got explicitly excluded recently - plugin_script: Execute all scripts regardless of errors found by review for SLE 15 SP4 (jsc#SLE-20335) A plugin_script-Execute-all-scripts-regardless-of-errors.patch - added uncore plugin (jsc#PED-8397) A uncore-477.patch A uncore-590.patch A uncore-606.patch - own directory /usr/lib/kernel/install.d to fix build - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Udpate to version 2.42.0: + Remove the libjasper JPEG2000 loader. + Split the gdk-pixbuf-xlib library to a separate repository. + Fix cppcheck 'shifting signed 32-bit value warning', + Fix memory leaks in pixops error paths, + Improve internal consistency of loaders, + Skip bytes during JPEG incremental load. + Check for overflows. + Let the test suite cope with missing loaders. + Check for mmap failure. + Fix UB in the XPM loader. + Speed up alpha scaling pixop. + Add the `gtk_doc` configuration option, and deprecate `docs`. + Add the `introspection` configuration option, and remove `gir`. + Handle truncated PNMs more gracefully. + Clean up GIF loader code. + Fix colormap handling in GIF. - Drop gdk-pixbuf-boo1174307-io-gif-overflow.patch: fixed upstream. - Replace meson parameters, following upstream changes: + -Ddocs=true => -Dgtk_doc=true. + -Dgir=true => -Dintrospection=enabled. - Update to version 2.42.2: + Requre Meson 0.55.3. + Improve the PNG save operation. + Fix leak in the error path of the XPM loader. + Fix loading GIF without a GCE rendering color 0. + Fix invalid LZW codes in the GIF loader (CVE-2020-29385). - Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch: gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393) - Update to version 2.42.4: + Make enum type registration thread safe. + Do not install skipped test files. + Fix GIF initialization. + Always run GIF loader tests. + Fix leaks discovered via ASan. + Expose GdkPixbufLoader API via introspection. + Fix revert-to-previous first frame behaviour for GIF files. + Link to libintl if needed. + Improve support for using gdk-pixbuf as a subproject. + Fix build with GModule disabled. + Use gi-docgen to generate the API reference from introspection data. - Replace gtk-doc BuildRequires with python3-gi-docgen: follow upstreams port. - As a workaround to https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/177, delete the installed gi-docgen program files. - Disable building of docs: creates a cycle with python: + Drop python3-gi-docgen BuildRequires. + Pass gtk_doc=false to meson - Update to stable 2.42.6 + Yield gtk_doc option value in subprojects + Always initialise locale on thumbnailer startup + Add fallback subproject for libjpeg + Use type:array for the builtin_loaders option + Default to using builtin png and jpeg loaders - Drop gdk-pixbuf-bsc1180393-CVE-2020-29385.patch on SLE and Leap 15.4: fixed upstream. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Stop passing no longer used nor recognized options jasper=false and x11=false to meson, fails the build when using meson 0.60.x. - Update to version 2.42.8 (boo#1201826): + Clear the pixbuf's memory buffer to avoid returning uninitialized memory. + Turn GdkPixbufModule functions into typed callbacks. + tiff: Use non-deprecated C99 integer types. + gif: Check for overflow when compositing or clearing frames. + Change png/jpeg/tiff build options from boolean to feature. + jpeg: Do not rely on UB around setjmp/longjmp. + Build fixes. + Documentation fixes. + Security fixes: CVE-2021-46829. + Updated translations. - Stop passing options to meson that just follow upstream default, just rely on upstream providing sane defaults, apart from where we want to deviate. - Update to version 2.42.9: + Fix the check for maximum value of LZW initial code size (boo#1194633 CVE-2021-44648). + Use CMake for dependencies on Windows/MSVC. + Add option for building tests. + Move man pages to reStructuredText. + Disable relocation when built as a static libary on Windows. + Update wrap file for libjpeg-turbo. + Limit the memory size when loading image data. - Add docutils and pkgconfig(gi-docgen) BuildRequires: New dependencies. - avoid bashism in baselibs postscript (bsc#1195391) - Add 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch: fix loading of larger images (glgo#GNOME/gdk-pixbuf#216). - Update to version 2.42.10: + Search for rst2man.py. + Update the memory size limit for JPEG images. + Updated translations. - Drop patch fixed upstream (with different limit): + 0001-jpeg-Increase-memory-limit-for-loading-image-data.patch - Fix path to gdk-pixbuf-query-loader in pkg-config file: we rename the loader to be multi-arch compatible and thus also need to adjust the .pc file to have build-systems find it. - Update to version 2.42.11: + Disable fringe loaders by default. + Introspection fixes. + Updated translations. - Pass -Dothers=enabled to meson: enable other image loaders (most notably beeded seems xpm,xbm). This is in line with upstreams recommendation for now, but won't be working past version 2.43.x. The loaders will likely be split out into a separate repo. (boo#1223903, glgo#GNOME/gdk-pixbuf!169). - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test suite with other loaders enabled. - Update to version 2.42.12: + Fix a build failure, + Fix occasional build failures, + ani: Reject files with multiple INA or IART chunks, + ani: Reject files with multiple anih chunks (CVE-2022-48622), + ani: validate chunk size, + Updated translations. - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed upstream. - Migrate package to a regular obs_scm service, no longer password protecting a zip file. The originally reported bsc#1159337 seems no longer be applicable and we prefer the easier route. - Drop unzip BuildRequires and pre_checkin.sh script. - Enable test suite on x86_64 (other arches seem too flaky for now): + Add %check section and call %meson_test + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for more than 30s, by marking it as a slow test (glgo#GNOME/gdk-pixbuf!174). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 3.24.23+118: + cssnode: Bail out nicely if there is no settings (#2780). + gdk/wayland: Add support for primary-selection-unstable-v1 (#2591). + wayland: Emit dummy configure event when resizing while fixed. + colorchooser: Backport the new color palette. + gdk: Fix parent relative background crash. + Updated translations. - Update to version 3.24.24: + GtkColorChooser: Update the default color palette. + GtkFontChooser: Fix family-only mode to return regular style. + GtkTreeView: Don't set focus-on-click for header buttons. + Accessibility: - Implement scrollSubstringTo. - Add a11y support to GtkPlug/GtkSocket. + Printing: Allow the lpr backend to print pdf and ps files. + Theme: - Update gesture graphics. - Update HighContrast css. + Wayland: Support the primary-selection-unstable-v1 protocol. + X11: Fix a crash with parent-relative backgrounds. + Broadway: Set modifier state of scroll events. + Build: Fix pc file generation on NixOS. + Updated translations. - Update to version 3.24.25: + Settings: Make cursor aspect ratio setting work. + Broadway: - Fix touchscreen event handling. - Support Android / Chrome on-screen keyboard. + Wayland: - Avoid crashes with tablet input. - Add api to support clients with subsurfaces better. + Inspector: Make the inspector available in non-debug builds. + Theme: - Make scrollbars larger. - Disable shadows on maximized, fullscreen and tiled windows. + Printing: Support Avahi-discovered printers better. + Input: - Show preedit for compose sequences. - Support long compose sequences. - Support compose sequences producing multiple characters. + Updated translations. - Update to version 3.24.26: + Input: - Fix a few oversights in Compose file parsing. - Fine-tune Compose preedit display. + Theme: - Fine-tune scrollbar size and transitions. - Reinstate invisible borders for tiled windows. + Wayland: Fix a problem with font settings not being found. + Updated translations. - Update to version 3.24.27: + Input: Ensure preedit-start and preedit-end are emitted properly. + GtkScrolledWindow: Revert a change that broke touch scrolling. + Theme: - Fix a problem with size changes in SSD decorations that caused mutter crashes - Use transparent black for window border in the dark theme. + Updated translations. - Add gtk3-prevent-g_file_get_basename-return-NULL.patch: + Fix a possible crash in gtk_show_uri (boo#1185082, glgo#GNOME/gtk!3458). - Update to version 3.24.28: + Input: Improve dead key handling. + CSS: Fix rendering of scaled text shadows. + Wayland: Fix matching of accelerators with multiple layouts. + X11: Trap errors from the COW. + Build: Make gtk3-update-icon-cache output reproducible. + Updated translations. - Update to version 3.24.29: + Input: - Look for a Compose file in the right place. - Revert some Compose sequence changes (mainly around dead acute and apostrophe). - Consume all key events during preedit, to avoid unexpected interactions. - Ignore more modifiers during preedit, to allow using 3rd and 5th level choosers. - Fix handling of cursor positions in non-ASCII preedit text. + GtkSpinButton: Interpret localized digits. + GtkScale: Fix sporadic criticals. + GtkScrolledWindow: - Cancel overshoot on size changes. - Avoid criticals with non-overlay scrollbars. + GtkFileChooser: Handle smb mounts better. + GtkListBox: Fix extending multi-selections. + Fix a possible crash in gtk_show_uri. + Wayland: Improve font settings fallback. + X11: - Avoid log spam on exit. - Don't beep on untrusted displays. + Updated translations. - Drop gtk3-prevent-g_file_get_basename-return-NULL.patch: fixed upstream. - Update to version 3.24.30: + Input: - Ignore NoSymbol key events (happens with some XKB options). - Fix incomplete reset in some cases. + GtkEmojiChooser: - Update data from CLDR 39. - Support translated keywords for multiple languages. - Allow inserting multiple Emoji with Ctrl. - Match keywords for search. - Fix a memory leak. + GtkFileChooser: Accessibility improvements. + GtkTreeView: - Fix an accessibility-related memory leak. - Fix assertion failures in some cases. + Printing: Remove the Google Cloud Print backend, since the service was shut down. + Wayland: Work with pointer-gestures v1 protocol. + Updated translations. - Drop patch fixed upstream on SLE and Leap 15.4: gtk3-x11-fix-menu-touch-by-pointer-emulation.patch - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Update to version 3.24.31: + input: Fix a crash with touch on GtkScale. + clipboard: Avoid a double-free. + css: Avoid a crash with radial gradients. + GtkFileChooser: Don't leak search results. + GtkTextView: Support css letterspacing. + Wayland: - Reset position when hiding popups. - Ignore globals we did not bind ourselves. - Avoid infinite loops when hiding surfaces. - Avoid clipboard-related lockups. + X11: - Trap errors while doing XRANDR calls. - Support touchpad gestures with XI 2.4. + Updated translations. - Update to version 3.24.32: + GtkCellRendererProgress: Use tabular figures. + GtkFontChooser: - Fix the build with older Pango. - Fix axis name handling. + Theme: Fix border color for tiled windows. + Accessibility: Fix cell accessible leak. + Wayland: - Support new high-contrast setting. - Only update scale when on any outputs. + Updated translations. - Update to version 3.24.33: + No changes. - Update to version 3.24.33+12: + icons: add legacy icons (boo#1197480). + Updated translations. - Update to version 3.24.34: + Include legacy hicolor icons. + Fix the build with gcc 12. + X11: Trap errors when getting output properties. + Wayland: Ignore empty preedit updates. This fixes a problem with textview scrolling. + Updated translations. - Add dependency "python3x-gobject-Gdk if python3x-gobject" to the typelib package (boo#1200614). - Add compatible dependency "python3-gobject-Gdk if python3-gobject" to the typelib package for SLE and Leap (boo#1200614). - Fix nautilus crash after entering wrong SMB password (bsc#1211952) * add gtk3-gtkmountoperation-avoid-SEGV-after-bad-password-inpu.patch - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules in cwd (bsc#1228120). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 2.6.7: + Update to Unicode 13.0.0 + Fix hb_ot_layout_get_ligature_carets for fonts without lcar table - includes fixes from 2.6.6: * A fix in AAT kerning for Geeza Pro - update to 2.6.8: + New API to fetch glyph alternates from GSUB table + New API +hb_ot_layout_lookup_get_glyph_alternates() - Drop gpg2 BuildRequires and stop verifying signature during build: upstream no longer signs the tarball/signature. - Update to version 2.7.2: + Fix a regression in the previous release that caused a crash with Kaithi. + More OOM fixes. + ot-funcs now handles variable empty glyphs better when hvar/vvar isn't present. + Reverted a GDEF processing regression. + A couple of fixes to handle OOM better. + Use an implementation for round that always rounds up, some minor fluctuations are expected on var font specially when hb-ot callback is used. + Fix an AAT's `kerx` issue on broken rendering of Devanagari Sangam MN. + Remove AAT's `lcar` table support from _get_ligature_carets API, not even much use on macOS installed fonts (only two files). GDEF support is the recommended one and expected to work properly after issues fixed two releases ago. - Minor memory fixes to handle OOM better specially in hb-ft. - Minor .so files versioning scheme change and remove stable/unstable scheme differences, was never used in practice (always default to stable scheme). - We are now suggesting careful packaging of the library using meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson for more information. - Distribution package URL is changed, either use GitHub generated tarballs, `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz` or, even more preferably use commit hash of the release and git checkouts like, `git+https://github.com/harfbuzz/harfbuzz#commit=$commit` - Update to version 2.7.4: + Fix missing --enable-introspection configure option - Changes from version 2.7.3: + Update USE shaper to 2020-08-13 specification, and other improvements + Don’t disable liga feature in myanmar shaper, to match Uniscribe + Improvements to language and script tags handling. + Update language system tag registry to OpenType 1.8.4 + Support for serializing and deserializing Unicode buffers + Increase buffer work limits to handle fonts with many complex lookups + Handle more shaping operations in trace output + Memory access fixes + More OOM fixes + Improved documentation. - Switch to meson buildsystem: + Add meson BuildRequires and macros. + Replace gcc-c++ for generic c++_compiler BuildRequires. + Add meson_test macro in check section, run tests during build. + Drop pkgconfig(graphite2) BuildRequires: No longer build graphite2 support, following upstream that disables this by default. + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this way we might avoid a build-cycle and since we did not have a explicit docs subpackage, just silently drop them. - Re-enable graphite2 support: TexLive relies on this to be present: + Pass -Dgraphite=enabled to meson. + Add pkgconfig(graphite2) BuildRequires. - Update to version 2.8.0: + Shape joining scripts other than Arabic/Syriac using the Universal Shaping Engine. Previously these were shaped using the generalized Arabic shaper. + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE. + Update language tags. + Variations: reduce error: do not round each interpolated delta. + Documentation improvements. + Subsetter improvements: subsets most, if not all, lookup types now. + Fuzzer-found fixes and other improvements when memory failures happen. + Removed most atomic implementations now that we have C++11 atomic impl. + General codebase upkeep; using more C++11 features: constexpr constructors, etc. - Update to version 2.8.1: + Subsetter now fully supports GSUB/GPOS/GDEF tables (including variations); as such, layout tables are retained by subsetter by default + hb-view supports iTerm2 and kitty inline image protocols it can also use Chafa for terminal graphics if available - Add pkgconfig(chafa): new, optional depdency. - Update to version 2.8.2: + Shaping LTR digits for RTL scripts now makes the native direction of the digits LTR, applying shaping and positioning rules on the same glyph order as Uniscribe + Subsetting COLR v1 and CPAL tables is now supported + Various fixes and improvements to the subsetter + When applying morx table, mark glyph widths should not be zeroed + GPOS is preferred over kerx, if GSUB was applied + Regional_Indicator pairs are grouped together when clustering - Drop pkgconfig(chafa) BuildRequires for now: causes a cycle between chafa and harfbuzz, and disable it in meson - harfbuzz 2.9.1: + Subsetter API close to stable + Various fuzzer-found bug fixes + hb_buffer_append() now handles the pre- and post-context which previously were left unchanged in the destination buffer + hb-view / hb-shape now accept following new arguments: - -unicodes: takes a list of hex numbers that represent Unicode codepoints. + Undeprecated API: hb_set_invert() - includes changes from 2.9.0: + Support multiple variation axes with same tag, aka HOI + The coretext testing shaper now passes font variations to CoreText + hb-shape/hb-view does not break line at new lines unless text is read from file + hb-view and hb-subset has a --batch now, similar to hb-shape + The --batch mode now uses ; as argument separator instead of : used previously + The --batch in hb-shape does not expect 0th argument anymore. That is, the lines read are interpreted as argv[1:], instead of argv[0:]. + The --batch option has been undocumented. We are ready to document it; send feedback if you find it useful + hb-subset got arguments revamps. Added much-requested - -gids-file, --glyphs, --glyphs-file, --unicodes-file, supporting ranges in --unicodes. + Various bug fixes - harfbuzz 3.0.0: + Unicode 14.0 support + hb-subset API and harfbuzz-subset ABI now declared stable + hb-style API is now stable - harfbuzz 3.1.0: * Better offset-overflow handling in the subsetter library * Improved Unicode 14 properties in the USE shaper, and various other USE shaper fixes * MATH and COLR v1 tables subsetting support, and various other subsetter fixes * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens) * Apply GPOS positioning when substituting with morx table, if kerx is missing * Apply calt and clig features across syllable boundaries in Indic shaper * Meson option for enabling Graphite 2 has been renamed to graphite2 * Build and documentation fixes - add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to version 3.1.1: + Work around GCC cast-align error/warning on some platforms. + Documentation improvements. - Drop patch fixed upstream: + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch - Update to 3.1.2: + hb-shape / hb-view: revert treating text on the commandline as single paragraph (was introduced in 3.0.0); add new - -single-par to do that + Subsetter bug fixes - Update to 3.2.0: + Fixed shaping of Apple Color Emoji flags in right-to-left context + Fixed positioning of CFF fonts in HB_TINY profile + OpenType 1.9 language tags update + Add HB_NO_VERTICAL config option + Add HB_CONFIG_OVERRIDE_H for easier configuration + Improved packing of cmap, loca, and Ligature tables + Significantly improved overflow-resolution strategy in the repacker - update to 3.3.2: + Revert splitting of pair positioning values introduced in 3.3.0 as it proved problematic - includes changes from 3.3.1: + Fix heap-use-after-free in harfbuzz-subset introduced in previous release - includes changes from 3.3.0: + Improved documentation, code cleanup + The low 16-bits of face index will be used by hb_face_create() to select a face inside a font collection file format, while the high 16-bits will be used by hb_font_create() to load the named instance + Glyph positions and other font metrics now apply synthetic slant set by hb_font_set_synthetic_slant(), for improved positioning for synthetically slanted fonts + Fixed unintentional locale dependency in hb_variation_to_string() for decimal point representation + When applying pair positioning (kerning) the positioning value is split between the two sides of the pair for improved cursor positioning between such pairs + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing re-shaping during line breaking. Check the documentation for further details + Improved handling of macrolanguages when mapping BCP 47 codes to OpenType tags - update to 3.4.0: + Perform sanity checks on shaping results is now part of “harfbuzz” library and can be enabled by setting the buffer flag HB_BUFFER_FLAG_VERIFY + Arabic Mark Transient Reordering Algorithm have been updated to revision 6 + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to the OpenType ‘math’ tag + It is now possible to get at once all math kerning values for a given glyph at a given corner + Fix locale_t portability issues on systems the typedef’s it to a void pointer - Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents (boo#1200900 CVE-2022-33068). - Add CVE-2023-25193.patch: limit how far we skip when looking back (bsc#1207922 CVE-2023-25193). - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 1.32.10: + core: fix the order of IPv6 addresses changing on service restart. + initrd: add command line option to configure link autonegotiation and speed. + ifcfg-rh: - fix crash when parsing invalid DNS address. - extend ifup/ifdown scripts to work with connection profile names. + udev: also react to "move" (and "change") udev actions in our rules. - Changes from version 1.32.8: + firewalld: configure zones on "Reloaded" signal. + core: fix wrong MTU for bridge interfaces. + cloud-setup: fix gateway address for Aliyun cloud. - Remove obsolete translation-update-upstream support (jsc#SLE-21105). - Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied by upstream maintainers. - Update to version 1.32.12: + Fix wrong order of addresses when restarting NetworkManager. + Preserve the IPv6 ff00::/8 route added by kernel in the local table, necessary for multicast communication. + Fix emitting the signal for changed metered status of devices. + Fix applying the ethtool autonegotiation and speed settings. + initrd: fix crash parsing plain '=' without key. + cloud-setup: use suppress_prefixlength rule to honor non-default-routes in the main table. - Update to version 1.34.0: + initrd: wait for both IPv4 and IPv6 with "ip=dhcp,dhcp6" + core: better handle sd-resolved errors when resolving hostnames + nmcli: fix import WireGuard profile with DNS domain and address family disabled + ndisc: send router solicitations before expiry + policy: send earlier the ip configs to the DNS manager + core: support linking with LLD 13 + wireguard: importing wg-quick configuration files with nmcli no longer sets a negative, exclusive "dns-priority". This plays better with common split DNS setups that use systemd-resolved. Adjust the "dns-priority" to your liking after import yourself. + NetworkManager no longer listens for netlink events for traffic control objects (qdiscs and filters). + core: add internal nm-priv-helper service for separating privileges and have a way to drop capabilities from NetworkManager daemon. + bond: add support for setting queue-id of bond port. + dns: support configuring DNS over TLS (DoT) with systemd-resolved. + nmtui: add support for WireGuard profiles. + nmcli: add aliases `nmcli device up|down` beside connect|disconnect. + conscious language: Deprecate 'Device.Slaves' D-Bus property in favor of new 'Device.Ports' property. Depracate 'nm_device_*_get_slaves()' in favor of 'nm_device_get_ports()' in libnm. + nmcli: invoking nmcli command without arguments will now show 'default' instead of null address in route4 or route6 section. - Refresh patches with quilt. - Replace addFilter("suse-branding-unversioned-requires*") from rpmlintrc, with the current branding-requires-unversioned. - Update our Supplements to current standard. - Add the new internal nm-priv-helper.service to pre(un)/post(un) handling. - Split out NetworkManager-pppoe, needed to configure regular PPPoE connections (Not very common, as most users have PPPoE routers for the DSL connections). - Packaging additions with Autotools replacement: + Add Meson build requirement and replace Automake macros with Meson equivalent ones as autotools will be deprecated in the future. + Options passed to Meson to mimmic our default preferences: systemdsystemunitdir=%{_unitdir}, udev_dir=%{_udevdir}, dbus_conf_dir=%{_dbusconfdir}, iptables=%{_sbindir}/iptables, dnsmasq=%{_sbindir}/dnsmasq, dnssec_trigger=%{_libexecdir}\ /dnssec-trigger-script, dist_version=%{version}, polkit_agent_helper_1=%{_libexecdir}/polkit-1\ /polkit-agent-helper-1, hostname_persist=suse, switchable libaudit=%{libaudit_meson_opt}, iwd=true, pppd=%{_sbindir}\ /pppd, pppd_plugin_dir=%{_pppddir}, nm_cloud_setup=true, bluez5_dun=true, netconfig=%{_sbindir}/netconfig, dhclient=%{_sbindir}/dhclient, docs=true, switchable tests=%{tests_meson_opt}, more_asserts=0, more_logging=false, qt=false, and switchable teamdctl=true (teamctl is about to be deprecated). + Add conditionalized audit pkgconfig module build requirement to allow easier feature testing, and pass 'yes-disabled-by-default' to 'libaudit' Meson option. As an observation: Meson defaults passing 'yes' to this feature. + Add explicit c++_compiler build requirement to avoid build abortion. + Add explicit libselinux pkgconfig module build requirement checked by Meson and was already being pulled in by some other package. + Add polkit-gobject-1 pkgconfig module build requirement checked by Meson and needed for user auth-polkit support. + Add mobile-broadband-provider-info pkgconfig module build requirement checked by Meson and needed for ModemManager1 interface support. + Add sed command to fix server.conf config file location from defaultdocdir/NetworkManager/examples to defaultdocdir/NetworkManager. + Add useful %{_pppddir} and %{_dbusconfdir} macros to spec file, while dropping no longed needed pppddir shell variable definition and 'test -n "$pppddir" || exit 1' construct. + Add "< 1.21" version to libnm-glib-vpn1, libnm-glib4, and libnm-util2 < 1.21 to main package's Obsoletes tags, following packaging good practices to avoid future unwated behavior regarding versioning schemes. + Replace %version macro with hardcoded "0.9.1" version to the devel subpackage's %name-doc Obsoletes tag following packaging good practices to avoid future unwanted behaviors regarding versioning schemes (the doc subpackage was merged with the devel one in the 0.9.0 release). + Pass "%{?no_lang_C}" to %find_lang macro to avoid stripping any English translations (the default language) from main package. - Packaging deletions with Autotools replacement: + Remove data/server.conf from %doc macro in files section as it no longer works with Meson. + Remove "rm" command on server.conf file following sed command addition to fix the right location of the file. + Remove no longer useful conditional build abortion depending whether or not netconfig support was found 'grep "with_netconfig='no'" config.log' since this file isn't generated by Meson. + Remove no longer needed "find" command for GNU Libtool LA files deletion. + Drop no longer needed libtool build requirement as Meson does not use it. + Drop redundant sysconfig-netconfig build requirement as it does not add anything to the build anymore. + Drop comment about suse-release build requirement not being needed anymore, it's been deprecated for almost a decade now. + Drop setBadness for 'dbus-file-unauthorized' in the rpmlintrc: the new dbus file has been whitelisted already (bsc#1194799). - Use meson LTO setup as NM makes changes to CFLAGS - Add upstream bug fix patches: + 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix nm_ref_string_equal_str() Fix comparison with a NULL string + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests: fix maybe-uninitialized warning in "test-setting" + aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests: fix maybe-uninitialized warning in "test-libnmc-setting" + 471e987add98b36520ece72ee493176fc7bc863c.patch: device: initialize nm_auto variable in _ethtool_features_reset() + 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux: workaround maybe-uninitialized warning with LTO in nm_uuid_generate_from_string_str() - Update to version 1.36.0: + The handling of Layer 3 configurations has been substantially reworked. While this is mostly internal change, it results in more robust behavior when addressing information from multiple sources (DHCP, manually configured, VPN) need to be applied simultaneously. Overall performance and memory use have also slightly improved. + Manually configured addresses can no longer expire even if the same addresses are also obtained dynamically. + Code for systemd-based DHCP and DHCPv6 clients has been updated from upstream. + NTP servers obtained via DHCPv6 are now exposed on the DBus API, visible in nmcli and available for use by dispatcher scripts. + 5G NR (New Radio) modems are now supported. + The "rd.znet_ifnames" kernel command line option is now honored on network bootups on an IBM s390 platform. + Wi-Fi P2P support does now work with the IWD backend, in addition to wpa_supplicant backend. + Support for special route types have been added: "prohibit", "blackhole" and "unreachable". + Routes managed by routing daemons are now ignored. This is done to address a performance bottleneck on specialized routers. + Handling of IP addressing and routing information is now slightly more efficient and uses less memory. This is apparent on systems with large amount of IP configuration information. + It is now possible to start NetworkManager without root user privileges. This is experimental doesn't necessarily result in a working daemon. NetworkManager service already drops many of capabilities available to the root user. + WPA3 Wi-FI network security have been improved by enabling new H2E (hash to element) method for generating SAE password element. + It is now possible to select the default Wi-Fi backend (wpa_supplicant or IWD) at build-time. + Replies from broken DHCP servers that send duplicate address or mask options are now handled gracefully. + Bridge support has gained the possibility of turning off MAC ageing. + "configure-and-quit" mode and nm-iface-helper have been removed. + A number of bugs that could cause NetworkManager to crash in rare conditions have been fixed. - Drop pkgconfig(libteam) BuildRequires and stop passing teamdctl=true to meson: No longer build teamdctl support. - Drop patches fixed upstream: + 4685651e7671e064b911a3a05f096908e5ef0580.patch + 471e987add98b36520ece72ee493176fc7bc863c.patch + 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch + 634e023e72d4729788a022ea1fae665af28d1b0f.patch + aadf0fb64f491f94b2771058621dc140c562b62b.patch - Drop nm-dhcp-use-valid-lease-on-timeout.patch: Patch was rejected upstream. - Rebase patches with quilt. - Update to version 1.36.2: + When the list of plugins is not specified via "main.plugins" in NetworkManager.conf and no build-time default is set with "--with-config-plugins-default" configure argument, now all known plugins found in the plugin directory are loaded (and the built-in "keyfile" plugin is preferred over others). + Preserve external ports during checkpoint rollback. + Fix removal of ovsdb entry when an OVS interface goes away. + Fix DNS configuration for WWAN connections. - Do not requires dhcp-client, NM is using its internal client by default for a long time now. - Convert iproute2 and iputils requires to recommends, they should not be hard requires. - Update to version 1.36.4: + The internal DHCPv4 client now discards NAKs packets coming from servers different from the one that sent the offer. + Fix activation of PPPoE connections with "pppoe.parent" unset. + Fix potential libnm crash when the client object initialization gets canceled. + Other various fixes and improvements. - Install nfs dispatcher script in /usr/lib/NetworkManager, not /etc - Modify NetworkManager.spec: Split into a few small subpackages (bsc#1198128). - Update to version 1.38.0: + Add support for route type "throw". + Fix bug setting priority for IP addresses. + Static IPv6 addresses from "ipv6.addresses" are now preferred over addresses from DHCPv6, which are preferred over addresses from autoconf. This affects IPv6 source address selection, if the rules from RFC 6724, section 5 don't give a exhaustive match. + Static IPv6 addresses from "ipv6.addresses" are now interpreted with first address being preferred. Their order got inverted. This is now consistent with IPv4. + Wi-Fi hotspots will use a (stable) random channel number unless one is chosen manually. + Don't use unsupported SAE/WPA3 mode for AP mode. + NetworkManager will no longer advertise frequencies as supported when they're disallowed in configured regulatory domain. + Attempt to connect to WEP-encrypted Wi-Fi network will now fail gracefully with a recent version of wpa_supplicant when built without WEP support. As long as wpa_supplicant supports WEP, NetworkManager will continue to work. + Disable WPA3 transition mode for wifi.key-mgmt=wpa-psk if the NIC does not support PMF. This is known to cause problems in some setups. It is still possible to explicitly configure wifi.key-mgmt=sae for WPA3. + Add new dummy crypto backend "null" that does nothing. NetworkManager uses the crypto library when handling certificates for 802.1x profiles. + Veth devices with name "eth*" are now managed by default via the udev rule. This is to support managing the network in LXD containers. + The hostname received from DHCP is now shortened to the first dot (or to 64 characters, whatever comes first) if it's too long. + As the insecure WEP encryption for Wi-Fi network is phased out, nmcli now discourages its use when activating or modifying a profile. + Fix connectivity checks in case the check endpoint address resolves to multiple addresses. + Workaround libcurl blocking NetworkManager while resolving DNS names. + nmcli: indicate missing Wi-Fi hardware when showing rfkill setting. + nmcli: add connection migrate command to move a profile to a specified settings plugin. This allows to convert profiles in the deprecated ifcfg-rh format to keyfile. + Set "src" attribute for routes from DHCPv4 to the leased address. This helps with source address selection. + Various bugfixes and internal improvements. + Updated translations. - Recommend NetworkNanager-wifi from the main package: after the split, there is currently nothing pulling in NM-wifi. Preferably this would happen based on wifi chips prsence, but that is not yet done (boo#1199550). - Fold NetworkManager-wifi back into the main package: The dep chain is not really different and it causes too many problems for users having that split. Not worth the pain (boo#1199710, boo#1199706). - As a consequence, also drop the recommends fro the main package to -wifi. - Update to version 1.38.2: + Fix race condition with pppd that caused failures when activating PPPoE connections. + Unbreak DHCPv6 over PPP. + Don't ignore IPv6 DNS servers received from PPP. + Fix crash while checking WEP capability of Wi-Fi interfaces. + Ensure DHCP is restarted every time the link goes up. + Fix struct alignment issues seen on some architectures. + Various other bugfixes and improvements. - Bring back /sbin/netconfig as build option since the netconfig in SLE is not ready for usrmerge. - Update to version 1.38.6 (bsc#1208631): + Fix honoring DNS priority. + Decline DHCPv6 lease when DAD fails. + Various bugfixes. - Changes from version 1.38.4: + Fix DAD for DHCPv6 addresses. + Wi-Fi: improvements for OWE networks. + Support EC private keys. + Fix nmcli tab completion support for embedded quote characters. + Fix reapply for lldp/mdns/llmnr/dns-over-tls settings. + Various bugfixes. - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20240809 (bsc#1229069, CVE-2023-31315) - Update to version 20221216 (git commit c9c19583f717): * rtw89: 8852c: update fw to v0.27.56.9 * rtw89: 8852c: update fw to v0.27.56.8 * amdgpu: updated navi10 firmware for amd-5.4 * amdgpu: updated yellow carp firmware for amd-5.4 * amdgpu: updated raven2 firmware for amd-5.4 * amdgpu: updated raven firmware for amd-5.4 * amdgpu: updated PSP 13.0.8 firmware for amd-5.4 * amdgpu: updated GC 10.3.7 RLC firmware for amd-5.4 * amdgpu: updated vega20 firmware for amd-5.4 * amdgpu: updated PSP 13.0.5 firmware for amd-5.4 * amdgpu: add VCN 4.0.0 firmware for amd-5.4 * amdgpu: add SMU 13.0.0 firmware for amd-5.4 * amdgpu: Add SDMA 6.0.0 firmware for amd-5.4 * amdgpu: add PSP 13.0.0 firmware for amd-5.4 * amdgpu: add GC 11.0.0 firmware for amd-5.4 * amdgpu: add DCN 3.2.0 firmware for amd-5.4 * amdgpu: updated vega10 firmware for amd-5.4 * amdgpu: updated beige goby firmware for amd-5.4 * amdgpu: updated dimgrey cavefish firmware for amd-5.4 * amdgpu: updated vangogh firmware for amd-5.4 * amdgpu: updated picasso firmware for amd-5.4 * amdgpu: updated navy flounder firmware for amd-5.4 * amdgpu: updated green sardine firmware for amd-5.4 * amdgpu: updated sienna cichlid firmware for amd-5.4 * amdgpu: updated arcture firmware for amd-5.4 * amdgpu: updated navi14 firmware for amd-5.4 * amdgpu: updated renoir firmware for amd-5.4 * amdgpu: updated navi12 firmware for amd-5.4 * amdgpu: updated aldebaran firmware for amd-5.4 * sr150 : Add NXP SR150 UWB firmware * brcm: add/update firmware files for brcmfmac driver * rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x75b8_f098 - Update to version 20230110 (git commit a1ad1d5b5062): (preparation for jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: add VCN4.0.4 firmware from amd-5.4 * amdgpu: add SMU13.0.7 firmware from amd-5.4 * amdgpu: add SDMA6.0.2 firmware from amd-5.4 * amdgpu: add PSP13.0.7 firmware from amd-5.4 * amdgpu: add GC11.0.2 firmware from amd-5.4 * amdgpu: add DCN3.2.1 firmware from amd-5.4 * amdgpu: update VCN4.0.0 firmware from amd-5.4 * amdgpu: update SMU13.0.0 firmware from amd-5.4 * amdgpu: update SDMA6.0.0 firmware from amd-5.4 * amdgpu: update PSP13.0.0 firmware from amd-5.4 * amdgpu: update GC11.0.0 firmware from amd-5.4 * iwlwifi: add new FWs from core76-35 release * iwlwifi: update cc/Qu/QuZ firmwares for core76-35 release * iwlwifi: add new FWs from core75-47 release * iwlwifi: update 9000-family firmwares to core75-47 * amdgpu: update renoir DMCUB firmware * amdgpu: Update renoir PSP firmware * amdgpu: update copyright date for LICENSE.amdgpu * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * cxgb4: Update firmware to revision 1.27.1.0 * qca: Update firmware files for BT chip WCN6750 - Correct alias list for ACPI entries (bsc#1207211) - Update to version 20230125 (git commit 5c11a3742947): (jsc#PED-1167, jsc#PED-1169, jsc#PED-1171) * amdgpu: Add VCN 4.0.2 firmware * amdgpu: Add PSP 13.0.4 firmware * amdgpu: Add SDMA 6.0.1 fimware * amdgpu: Add GC 11.0.1 firmware * amdgpu: Add DCN 3.1.4 firmware * iwlwifi: remove old intermediate 5.15+ firmwares * iwlwifi: remove 5.10 and 5.15 intermediate old firmwares * iwlwifi: remove 5.4 and 5.10 intermediate old firmwares * iwlwifi: remove 4.19 and 5.4 intermediate old firmwares * iwlwifi: remove old unsupported older than 4.14 LTS * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * amdgpu: update vangogh firmware * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9260 * brcm: add configuration files for CyberTan WC121 * qcom: add firmware files for Adreno A200 * rtw89: 8852c: update fw to v0.27.56.10 * QCA: Add Bluetooth firmware for QCA2066 - Update to version 20230210 (git commit bf4115c1aa2b): * linux-firmware: Update AMD cpu microcode * brcm: revert firmware files for Cypress devices * brcm: restore previous firmware file for BCM4329 device * rtw88: 8822c: Update normal firmware to v9.9.14 * i915: Add DMC v2.11 for MTL (jsc#PED-1225) * linux-firmware: Add firmware for Cirrus CS35L41 on UM3402 ASUS Laptop * linux-firmware: Add missing tuning files for HP Laptops using Cirrus Amps (bsc#1203699) * i915: Add DMC v2.18 for ADLP (jsc#PED-1225) - set psuffix to deduplicate src.rpms - spec-cleaner induced cleanups - Update to version 20230313 (git commit 5bc279fb161d): * iwlwifi: update core69 and core72 firmwares for So device * qat: update licence text * rtl_bt: Update RTL8822C BT USB firmware to 0x0CC6_D2E3 * rtl_bt: Update RTL8822C BT UART firmware to 0x05C6_D2E3 * WHENCE: remove duplicate File entries * WHENCE: remove trailing white space * linux-firmware: add fw for qat_4xxx (jsc#PED-3699) * Fix symlinks for Intel firmware * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update firmware for MT7921 WiFi device * iwlwifi: update core69 and core72 firmwares for Ty device * rtlwifi: Add firmware v16.0 for RTL8710BU aka RTL8188GU * brcm: Add nvram for the Lenovo Yoga Book X90F / X90L convertible * brcm: Fix Xiaomi Inc Mipad2 nvram/.txt file macaddr * brcm: Add nvram for the Advantech MICA-071 tablet * rtl_bt: Update RTL8852C BT USB firmware to 0xD7B8_FABF * rtl_bt: Add firmware and config files for RTL8821CS * rtw89: 8852b: update fw to v0.29.29.0 * rtw89: 8852b: update fw to v0.29.26.0 * liquidio: remove lio_23xx_vsw.bin * intel: avs: Add AudioDSP base firmware for CNL-based platforms * intel: avs: Add AudioDSP base firmware for APL-based platforms * intel: avs: Add AudioDSP base firmware for SKL-based platforms * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update board-2.bin * ath11k: IPQ5018 hw1.0: add to WLAN.HK.2.6.0.1-00861-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ5018 hw1.0: add board-2.bin * ath10k: QCA6174 hw3.0: update firmware-sdio-6.bin to version WLAN.RMH.4.4.1-00174 * ath10k: WCN3990 hw1.0: update board-2.bin * cnm: update chips&media wave521c firmware. * amdgpu: Update GC 11.0.1 firmware * intel: catpt: Add AudioDSP base firmware for BDW platforms - Update topics for catpt/avs - Update aliases - Update spec template - Revert the broken rtw89/rtw8852b_fw.bin firmware temporarily (bsc#1209449) - Revert pssufix change that caused the package renaming and broke dependencies from other packages - Update to version 20230320 (git commit bcdcfbcf0a8f): * linux-firmware: Update firmware file for Intel Bluetooth AX101 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9462 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth 9560 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: add firmware files for NXP BT chipsets * rtw89: 8852b: update format-1 fw to v0.29.29.0 * rtw89: 8852b: add format-1 fw v0.29.26.0 * rtw89: 8852b: rollback firmware to v0.27.32.1 * i915: Update MTL DMC to v2.12 * i915: Update ADLP DMC to v2.19 * mediatek: Update mt8192/mt8195 SCP firmware to support MM21 and MT21 - Update topics list - Drop the manual revert of 8852b firmware file, as it's merged into the upstream - Revive the old iwlwifi-*-71 ucode for compatibility with SLE15-SP4 kernel (bsc#1209681): WHENCE updated by iwlwifi-WHENCE-fix.patch - Update to version 20230406 (git commit 86da2ac9b4e5): * linux-firmware: update firmware for MT7916 * rtw89: 8852b: update format-1 fw to v0.29.29.1 * rtw89: 8852c: update fw to v0.27.56.13 * ath11k: WCN6855 hw2.0: update board-2.bin * ath11k: WCN6750 hw1.0: update to WLAN.MSL.1.0.1-01160-QCAMSLSWPLZ-1 * ath11k: QCN9074 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ8074 hw2.0: update board-2.bin * ath11k: IPQ6018 hw1.0: update to WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 * ath11k: IPQ6018 hw1.0: update board-2.bin * ath10k: QCA99X0 hw2.0: update board-2.bin * ath10k: QCA9984 hw1.0: update board-2.bin * ath10k: QCA9888 hw2.0: update board-2.bin * ath10k: QCA6174 hw3.0: update board-2.bin * ath10k: QCA4019 hw1.0: update board-2.bin * nvidia: update Tu10x and Tu11x signed firmware to support newer Turing HW * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: Amphion: Update vpu firmware * iwlwifi: add new FWs from core78-32 release * iwlwifi: update 9000-family firmwares to core78-32 * amdgpu: Update SDMA 6.0.1 firmware * amdgpu: Add PSP 13.0.11 firmware * amdgpu: Update PSP 13.0.4 firmware * amdgpu: Update GC 11.0.1 firmware * amdgpu: Update DCN 3.1.4 firmware * amdgpu: Add GC 11.0.4 firmware * rtw88: 8822c: Update normal firmware to v9.9.15 - Update to version 20230427 (git commit fab149657d8d): * Group all Conexant V4L devices together * rtl_nic: update firmware of USB devices * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: update firmware for MT7981 * qca: Update firmware files for BT chip WCN6750 * mt76xx: Move the old Mediatek WiFi firmware to mediatek * rtl_bt: Add firmware and config files for RTL8851B * linux-firmware: Update AMD cpu microcode * linux-firmware: add firmware for MT7981 * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * linux-firmware: update qat firmware * linux-firmware: Add firmware for Cirrus CS35L41 on Lenovo Laptops - Update to version 20230517 (git commit 08b854f02066): * rtlwifi: Add firmware v6.0 for RTL8192FU * rtlwifi: Update firmware for RTL8188EU to v28.0 * cirrus: Add firmware and tuning files for HP G10 series laptops * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * WHENCE: Cleanup Realtek BT firmware provenance * linux-firmware: update firmware for MT7922 WiFi device * cnm: update chips&media wave521c firmware. * cirrus: Add firmware and tuning files for Lenovo ThinkPad P1 Gen 6 * check_whence: error on directory listed as File * check_whence: error on duplicate file entries * WHENCE: comment out duplicate MediaTek firmware * i915: Add GuC v70.6.6 for MTL * amdgpu: update DCN 3.1.6 DMCUB firmware * rtl_bt: Update RTL8852B BT USB firmware to 0xDBC6_B20F * rtl_bt: Update RTL8761B BT USB firmware to 0xDFC6_D922 * rtl_bt: Update RTL8761B BT UART firmware to 0x9DC6_D922 - Update aliases from 6.4-rc3 - Update to version 20230531 (git commit 9d4c9a52c237): * qcom: apq8016: add Dragonboard 410c WiFi and modem firmware * cirrus: Add firmware for new Asus ROG Laptops * brcm: Add symlinks from Pine64 devices to AW-CM256SM.txt * amdgpu: Update GC 11.0.1 and 11.0.4 * rtw89: 8851b: add firmware v0.29.41.0 * amdgpu: update yellow carp firmware for amd.5.5 release * amdgpu: update navi14 firmware for amd.5.5 release * amdgpu: update navi12 firmware for amd.5.5 release * amdgpu: update vega20 firmware for amd.5.5 release * amdgpu: update vega12 firmware for amd.5.5 release * amdgpu: update navi10 firmware for amd.5.5 release * amdgpu: update vega10 firmware for amd.5.5 release * amdgpu: update PSP 13.0.11 firmware for amd.5.5 release * amdgpu: update GC 11.0.4 firmware for amd.5.5 release * amdgpu: update SDMA 6.0.1 firmware for amd.5.5 release * amdgpu: update PSP 13.0.4 firmware for amd.5.5 release * amdgpu: update GC 11.0.1 firmware for amd.5.5 release * amdgpu: update 13.0.8 firmware for amd.5.5 release * amdgpu: update GC 10.3.7 firmware for amd.5.5 release * amdgpu: update vangogh firmware for amd.5.5 release * amdgpu: update VCN 4.0.4 firmware for amd.5.5 release * amdgpu: update SMU 13.0.7 firmware for amd.5.5 release * amdgpu: update PSP 13.0.7 firmware for amd.5.5 release * amdgpu: update GC 11.0.2 firmware for amd.5.5 release * amdgpu: update renoir firmware for amd.5.5 release * amdgpu: update VCN 4.0.0 firmware for amd.5.5 release * amdgpu: update SMU 13.0.0 firmware for amd.5.5 release * amdgpu: update PSP 13.0.0 firmware for amd.5.5 release * amdgpu: update GC 11.0.0 firmware for amd.5.5 release * amdgpu: update green sardine firmware for amd.5.5 release * amdgpu: update beige goby firmware for amd.5.5 release * amdgpu: update dimgrey cavefish firmware for amd.5.5 release * amdgpu: update arcturus firmware for amd.5.5 release * amdgpu: update vcn 3.1.2 firmware for amd.5.5 release * amdgpu: update psp 13.0.5 firmware for amd.5.5 release * amdgpu: update GC 10.3.6 firmware for amd.5.5 release * amdgpu: update navy flounder firmware for amd.5.5 release * amdgpu: update sienna cichlid firmware for amd.5.5 release * amdgpu: update aldebaran firmware for amd.5.5 release * amdgpu: DMCUB updates for various AMDGPU asics * ice: update ice DDP comms package to 1.3.40.0 * cxgb4: Update firmware to revision 1.27.3.0 - Fix the broken symlink targets for cirrus firmware: cirrus-WHENCE-link-fixes.patch - Clean up spec template to match with the actual output - Update to version 20230620 (git commit 045b2136a619): * amdgpu: update DMCUB to v0.0.172.0 for various AMDGPU ASICs * fix broken cirrus firmware symlinks * qcom: Update the microcode files for Adreno a630 GPUs. * qcom: sdm845: rename the modem firmware * qcom: sdm845: update remoteproc firmware * rtl_bt: Update RTL8852A BT USB firmware to 0xDAC7_480D * rtl_bt: Update RTL8852C BT USB firmware to 0x040D_7225 * amdgpu: DMCUB updates for various AMDGPU asics * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: update firmware for MT7921 WiFi device * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for mediatek bluetooth chip (MT7921) * i915: Add HuC v8.5.0 for MTL * mediatek: Update mt8195 SCP firmware to support hevc - Drop obsoleted patch for WHENCE: cirrus-WHENCE-link-fixes.patch - Update aliases - Update to version 20230707 (git commit d3f66064cf43): * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * linux-firmware: update firmware for mediatek bluetooth chip (MT7922) * linux-firmware: update firmware for MT7922 WiFi device * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX203 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX211 * linux-firmware: Update firmware file for Intel Bluetooth AX210 * linux-firmware: Update firmware file for Intel Bluetooth AX200 * linux-firmware: Update firmware file for Intel Bluetooth AX201 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s * Makefile, copy-firmware: support xz/zstd compressed firmware * copy-firmware: silence the last shellcheck warnings * copy-firmware: drop obsolete backticks, quote * copy-firmware: tweak sed invocation * copy-firmware: quote deskdir and dirname * check_whence: error if symlinks are in-tree * check_whence: error if File: is actually a link * check_whence: strip quotation marks * linux-firmware: wilc1000: update WILC1000 firmware to v16.0 * ice: update ice DDP wireless_edge package to 1.3.10.0 * amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5 - Update aliases - Update to version 20230724 (git commit 59fbffa9ec8e): including the amd-ucode update for "ZenBleed" (CVE-2023-20593, bsc#1213286) * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * linux-firmware: Update AMD fam17h cpu microcode * linux-firmware: Update AMD cpu microcode * amdgpu: update green sardine VCN firmware * amdgpu: update renoir VCN firmware * amdgpu: update raven VCN firmware * amdgpu: update raven2 VCN firmware * amdgpu: update Picasso VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Update AMD 19h ucode for "Inception" (bsc#1213287, CVE-2023-20569) amd-ucode-CVE-2023-20569.patch - Update AMD ucode to 20231030 (bsc#1215831, CVE-2021-26345, CVE-2021-46766, CVE-2021-46774, CVE-2022-23820, CVE-2022-23830, CVE-2023-20519, CVE-2023-20521, CVE-2023-20526, CVE-2023-20533, CVE-2023-20566, bsc#1215823, CVE-2023-20592 "CacheWarpAttack") - Drop the previous amd-ucode update patch: amd-ucode-CVE-2023-20569.patch - Updated to 20191115 release (bsc#1157004) - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old->New - ---- updated platforms ------------------------------------ - SKL-U/Y D0 6-4e-3/c0 000000d4->000000d6 Core Gen6 Mobile - SKL-U23e K1 6-4e-3/c0 000000d4->000000d6 Core Gen6 Mobile - SKL-H/S/E3 N0/R0/S0 6-5e-3/36 000000d4->000000d6 Core Gen6 - AML-Y22 H0 6-8e-9/10 000000c6->000000ca Core Gen8 Mobile - KBL-U/Y H0 6-8e-9/c0 000000c6->000000ca Core Gen7 Mobile - KBL-U23e J1 6-8e-9/c0 000000c6->000000ca Core Gen7 Mobile - CFL-U43e D0 6-8e-a/c0 000000c6->000000ca Core Gen8 Mobile - KBL-R U Y0 6-8e-a/c0 000000c6->000000ca Core Gen8 Mobile - WHL-U W0 6-8e-b/d0 000000c6->000000ca Core Gen8 Mobile - AML-Y42 V0 6-8e-c/94 000000c6->000000ca Core Gen10 Mobile - WHL-U V0 6-8e-c/94 000000c6->000000ca Core Gen8 Mobile - CML-U42 V0 6-8e-c/94 000000c6->000000ca Core Gen10 Mobile - KBL-G/H/S/X/E3 B0 6-9e-9/2a 000000c6->000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6 - CFL-H/S/E3 U0 6-9e-a/22 000000c6->000000ca Core Gen8 Desktop, Mobile, Xeon E - CFL-S B0 6-9e-b/02 000000c6->000000ca Core Gen8 - CFL-S P0 6-9e-c/22 000000c6->000000ca Core Gen9 Desktop - CFL-H/S/E3 R0 6-9e-d/22 000000c6->000000ca Core Gen9 Desktop, Mobile, Xeon E - CML-U62 A0 6-a6-0/80 000000c6->000000ca Core Gen10 Mobile - Updated to 20191113 release - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old->New - ---- updated platforms ------------------------------------ - CFL-S P0 6-9e-c/22 000000a2->000000c6 Core Gen9 Desktop - reverted the entry below to 02000064 due to occasional faults (bsc#1160478) - SKX-SP H0/M0/U0 6-55-4/b7 02000064->02000065 Xeon Scalable - updated skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to 20191115 release (bsc#1157004) - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old->New - ---- updated platforms ------------------------------------ - SKL-U/Y D0 6-4e-3/c0 000000d4->000000d6 Core Gen6 Mobile - SKL-U23e K1 6-4e-3/c0 000000d4->000000d6 Core Gen6 Mobile - SKL-H/S/E3 N0/R0/S0 6-5e-3/36 000000d4->000000d6 Core Gen6 - AML-Y22 H0 6-8e-9/10 000000c6->000000ca Core Gen8 Mobile - KBL-U/Y H0 6-8e-9/c0 000000c6->000000ca Core Gen7 Mobile - KBL-U23e J1 6-8e-9/c0 000000c6->000000ca Core Gen7 Mobile - CFL-U43e D0 6-8e-a/c0 000000c6->000000ca Core Gen8 Mobile - KBL-R U Y0 6-8e-a/c0 000000c6->000000ca Core Gen8 Mobile - WHL-U W0 6-8e-b/d0 000000c6->000000ca Core Gen8 Mobile - AML-Y42 V0 6-8e-c/94 000000c6->000000ca Core Gen10 Mobile - WHL-U V0 6-8e-c/94 000000c6->000000ca Core Gen8 Mobile - CML-U42 V0 6-8e-c/94 000000c6->000000ca Core Gen10 Mobile - KBL-G/H/S/X/E3 B0 6-9e-9/2a 000000c6->000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6 - CFL-H/S/E3 U0 6-9e-a/22 000000c6->000000ca Core Gen8 Desktop, Mobile, Xeon E - CFL-S B0 6-9e-b/02 000000c6->000000ca Core Gen8 - CFL-S P0 6-9e-c/22 000000c6->000000ca Core Gen9 Desktop - CFL-H/S/E3 R0 6-9e-d/22 000000c6->000000ca Core Gen9 Desktop, Mobile, Xeon E - CML-U62 A0 6-a6-0/80 000000c6->000000ca Core Gen10 Mobile - Updated to 20191113 release - Processor Identifier Version Products - Model Stepping F-MO-S/PI Old->New - ---- updated platforms ------------------------------------ - CFL-S P0 6-9e-c/22 000000a2->000000c6 Core Gen9 Desktop - reverted the entry below to 02000064 due to occasional faults (bsc#1160478) - SKX-SP H0/M0/U0 6-55-4/b7 02000064->02000065 Xeon Scalable - updated skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - reverted the entry below to 02000064 due to occasional faults (bsc#1160478) - SKX-SP H0/M0/U0 6-55-4/b7 02000064->02000065 Xeon Scalable - updated skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - reverted the entry below to 02000064 due to occasional faults (bsc#1160478) - SKX-SP H0/M0/U0 6-55-4/b7 02000064->02000065 Xeon Scalable - updated skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - updated skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - updated skylake microcode to the current version. (bsc#1169570) - 02000064->02006901 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466) Fixes for: - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824). - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack" attacks. (bsc#1156353) == 20200602_DEMO Release == - - Updates upon 20200520 release -- Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ HSW C0 6-3c-3/32 00000027->00000028 Core Gen4 BDW-U/Y E0/F0 6-3d-4/c0 0000002e->0000002f Core Gen5 HSW-U C0/D0 6-45-1/72 00000025->00000026 Core Gen4 HSW-H C0 6-46-1/32 0000001b->0000001c Core Gen4 BDW-H/E3 E0/G0 6-47-1/22 00000021->00000022 Core Gen5 SKL-U/Y D0 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKL-U23e K1 6-4e-3/c0 000000d6->000000dc Core Gen6 Mobile SKX-SP B1 6-55-3/97 01000151->01000157 Xeon Scalable SKX-SP H0/M0/U0 6-55-4/b7 02000065->02006906 Xeon Scalable SKX-D M1 6-55-4/b7 02000065->02006906 Xeon D-21xx CLX-SP B0 6-55-6/bf 0400002c->04002f01 Xeon Scalable Gen2 CLX-SP B1 6-55-7/bf 0500002c->04002f01 Xeon Scalable Gen2 SKL-H/S R0/N0 6-5e-3/36 000000d6->000000dc Core Gen6; Xeon E3 v5 AML-Y22 H0 6-8e-9/10 000000ca->000000d6 Core Gen8 Mobile KBL-U/Y H0 6-8e-9/c0 000000ca->000000d6 Core Gen7 Mobile CFL-U43e D0 6-8e-a/c0 000000ca->000000d6 Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000ca->000000d6 Core Gen8 Mobile AML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile CML-Y42 V0 6-8e-c/94 000000ca->000000d6 Core Gen10 Mobile WHL-U V0 6-8e-c/94 000000ca->000000d6 Core Gen8 Mobile KBL-G/H/S/E3 B0 6-9e-9/2a 000000ca->000000d6 Core Gen7; Xeon E3 v6 CFL-H/S/E3 U0 6-9e-a/22 000000ca->000000d6 Core Gen8 Desktop, Mobile, Xeon E CFL-S B0 6-9e-b/02 000000ca->000000d6 Core Gen8 CFL-H/S P0 6-9e-c/22 000000ca->000000d6 Core Gen9 CFL-H R0 6-9e-d/22 000000ca->000000d6 Core Gen9 Mobile - Updated Intel CPU Microcode to 20200520 Processor Identifier Version Products Model Stepping F-MO-S/PI Old->New - --- new platforms ---------------------------------------- - --- updated platforms ------------------------------------ SNB-E/EN/EP C1/M0 6-2d-6/6d 0000061f->00000621 Xeon E3/E5, Core X SNB-E/EN/EP C2/M1 6-2d-7/6d 00000718->0000071a Xeon E3/E5, Core X - Updated Intel CPU Microcode to 20200609 official release (bsc#1172466) - no changes to 20200602 prerelease - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - update to 20240531: * Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GLK | B0 | 06-7a-01/01 | 00000040 | 00000042 | Pentium Silver N/J5xxx, Celeron N/J4xxx - Intel CPU Microcode was updated to the 20240813 release (bsc#1229129) - CVE-2024-24853: Security updates for [INTEL-SA-01083](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html) - CVE-2024-25939: Security updates for [INTEL-SA-01118](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html) - CVE-2024-24980: Security updates for [INTEL-SA-01100](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html) - CVE-2023-42667: Security updates for [INTEL-SA-01038](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html) - CVE-2023-49141: Security updates for [INTEL-SA-01046](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html) Other issues fixed: - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications](https://cdrdv2.intel.com/v1/dl/getContent/636674) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | AML-Y22 | H0 | 06-8e-09/10 | 000000f4 | 000000f6 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000fc | 00000100 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f6 | 000000f8 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f4 | 000000f6 | Core Gen8 | CFL-S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 Desktop | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | CLX-SP | B1 | 06-55-07/bf | 05003605 | 05003707 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000fa | 000000fc | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000fa | 000000fc | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000fa | 000000fc | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000fa | 000000fe | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000fa | 000000fc | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002802 | 07002904 | Xeon Scalable Gen3 | EHL | B1 | 06-96-01/01 | 00000019 | 0000001a | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | ICL-D | B0 | 06-6c-01/10 | 01000290 | 010002b0 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c4 | 000000c6 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003d1 | 0d0003e7 | Xeon Scalable Gen3 | KBL-R U | Y0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | KBL-U23e | J1 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | MTL | C-0 | 06-aa-04/e6 | 0000001c | 0000001e | Core™ Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 0000005e | 00000062 | Core Gen11 | TGL | B0/B1 | 06-8c-01/80 | 000000b6 | 000000b8 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000050 | 00000052 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000036 | 00000038 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000f4 | 000000f6 | Core Gen8 Mobile - Updated Intel CPU Microcode to 20200616 official release (bsc#1172856) - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release, as both cause stability issues. (bsc#1172856) - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - update to 20240531: * Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GLK | B0 | 06-7a-01/01 | 00000040 | 00000042 | Pentium Silver N/J5xxx, Celeron N/J4xxx - Intel CPU Microcode was updated to the 20240813 release (bsc#1229129) - CVE-2024-24853: Security updates for [INTEL-SA-01083](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html) - CVE-2024-25939: Security updates for [INTEL-SA-01118](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html) - CVE-2024-24980: Security updates for [INTEL-SA-01100](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html) - CVE-2023-42667: Security updates for [INTEL-SA-01038](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html) - CVE-2023-49141: Security updates for [INTEL-SA-01046](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html) Other issues fixed: - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications](https://cdrdv2.intel.com/v1/dl/getContent/636674) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | AML-Y22 | H0 | 06-8e-09/10 | 000000f4 | 000000f6 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000fc | 00000100 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f6 | 000000f8 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f4 | 000000f6 | Core Gen8 | CFL-S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 Desktop | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | CLX-SP | B1 | 06-55-07/bf | 05003605 | 05003707 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000fa | 000000fc | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000fa | 000000fc | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000fa | 000000fc | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000fa | 000000fe | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000fa | 000000fc | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002802 | 07002904 | Xeon Scalable Gen3 | EHL | B1 | 06-96-01/01 | 00000019 | 0000001a | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | ICL-D | B0 | 06-6c-01/10 | 01000290 | 010002b0 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c4 | 000000c6 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003d1 | 0d0003e7 | Xeon Scalable Gen3 | KBL-R U | Y0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | KBL-U23e | J1 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | MTL | C-0 | 06-aa-04/e6 | 0000001c | 0000001e | Core™ Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 0000005e | 00000062 | Core Gen11 | TGL | B0/B1 | 06-8c-01/80 | 000000b6 | 000000b8 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000050 | 00000052 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000036 | 00000038 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000f4 | 000000f6 | Core Gen8 Mobile - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - update to 20240531: * Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GLK | B0 | 06-7a-01/01 | 00000040 | 00000042 | Pentium Silver N/J5xxx, Celeron N/J4xxx - Intel CPU Microcode was updated to the 20240813 release (bsc#1229129) - CVE-2024-24853: Security updates for [INTEL-SA-01083](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html) - CVE-2024-25939: Security updates for [INTEL-SA-01118](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html) - CVE-2024-24980: Security updates for [INTEL-SA-01100](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html) - CVE-2023-42667: Security updates for [INTEL-SA-01038](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html) - CVE-2023-49141: Security updates for [INTEL-SA-01046](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html) Other issues fixed: - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications](https://cdrdv2.intel.com/v1/dl/getContent/636674) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | AML-Y22 | H0 | 06-8e-09/10 | 000000f4 | 000000f6 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000fc | 00000100 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f6 | 000000f8 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f4 | 000000f6 | Core Gen8 | CFL-S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 Desktop | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | CLX-SP | B1 | 06-55-07/bf | 05003605 | 05003707 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000fa | 000000fc | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000fa | 000000fc | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000fa | 000000fc | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000fa | 000000fe | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000fa | 000000fc | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002802 | 07002904 | Xeon Scalable Gen3 | EHL | B1 | 06-96-01/01 | 00000019 | 0000001a | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | ICL-D | B0 | 06-6c-01/10 | 01000290 | 010002b0 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c4 | 000000c6 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003d1 | 0d0003e7 | Xeon Scalable Gen3 | KBL-R U | Y0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | KBL-U23e | J1 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | MTL | C-0 | 06-aa-04/e6 | 0000001c | 0000001e | Core™ Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 0000005e | 00000062 | Core Gen11 | TGL | B0/B1 | 06-8c-01/80 | 000000b6 | 000000b8 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000050 | 00000052 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000036 | 00000038 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000f4 | 000000f6 | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240910 release (bsc#1230400) - CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel Processors may allow a privileged user to potentially enable information disclosure via local access. [INTEL-SA-01103](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html) - CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel Processors may allow an privileged user to potentially enable a denial of service via local access [INTEL-SA-01097](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html) - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. [#]## New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TWL | N0 | 06-be-00/19 | | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E [#]## Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000035 | 00000036 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000035 | 00000036 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000433 | 00000434 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000433 | 00000434 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000017 | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | MTL | C0 | 06-aa-04/e6 | 0000001e | 0000001f | Core™ Ultra Processor | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000123 | 00000129 | Core Gen13/Gen14 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004121 | 00004122 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004121 | 00004122 | Core Gen13 - Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446) - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) [#] New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#] Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201110 official release. - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446) - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594) - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592) - Releasenotes: - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html). - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html). - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel® Core™ Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel® Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel® Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel® Xeon® E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CPX-SP | A1 | 06-55-0b/bf | | 0700001e | Xeon Scalable Gen3 | LKF | B2/B3 | 06-8a-01/10 | | 00000028 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | | 00000068 | Core Gen11 Mobile | CML-H | R1 | 06-a5-02/20 | | 000000e0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | | 000000e0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | | 000000e0 | Core Gen10 | CML-U62 V2 | K0 | 06-a6-01/80 | | 000000e0 | Core Gen10 Mobile [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2 | APL | D0 | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5 | GKL-R | R0 | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile | CML-U62 | A0 | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - update to 20240531: * Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GLK | B0 | 06-7a-01/01 | 00000040 | 00000042 | Pentium Silver N/J5xxx, Celeron N/J4xxx - Intel CPU Microcode was updated to the 20240813 release (bsc#1229129) - CVE-2024-24853: Security updates for [INTEL-SA-01083](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html) - CVE-2024-25939: Security updates for [INTEL-SA-01118](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html) - CVE-2024-24980: Security updates for [INTEL-SA-01100](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html) - CVE-2023-42667: Security updates for [INTEL-SA-01038](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html) - CVE-2023-49141: Security updates for [INTEL-SA-01046](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html) Other issues fixed: - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications](https://cdrdv2.intel.com/v1/dl/getContent/636674) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | AML-Y22 | H0 | 06-8e-09/10 | 000000f4 | 000000f6 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000fc | 00000100 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f6 | 000000f8 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f4 | 000000f6 | Core Gen8 | CFL-S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 Desktop | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | CLX-SP | B1 | 06-55-07/bf | 05003605 | 05003707 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000fa | 000000fc | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000fa | 000000fc | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000fa | 000000fc | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000fa | 000000fe | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000fa | 000000fc | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002802 | 07002904 | Xeon Scalable Gen3 | EHL | B1 | 06-96-01/01 | 00000019 | 0000001a | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | ICL-D | B0 | 06-6c-01/10 | 01000290 | 010002b0 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c4 | 000000c6 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003d1 | 0d0003e7 | Xeon Scalable Gen3 | KBL-R U | Y0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | KBL-U23e | J1 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | MTL | C-0 | 06-aa-04/e6 | 0000001c | 0000001e | Core™ Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 0000005e | 00000062 | Core Gen11 | TGL | B0/B1 | 06-8c-01/80 | 000000b6 | 000000b8 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000050 | 00000052 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000036 | 00000038 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000f4 | 000000f6 | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240910 release (bsc#1230400) - CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel Processors may allow a privileged user to potentially enable information disclosure via local access. [INTEL-SA-01103](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html) - CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel Processors may allow an privileged user to potentially enable a denial of service via local access [INTEL-SA-01097](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html) - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. [#]## New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TWL | N0 | 06-be-00/19 | | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E [#]## Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000035 | 00000036 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000035 | 00000036 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000433 | 00000434 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000433 | 00000434 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000017 | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | MTL | C0 | 06-aa-04/e6 | 0000001e | 0000001f | Core™ Ultra Processor | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000123 | 00000129 | Core Gen13/Gen14 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004121 | 00004122 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004121 | 00004122 | Core Gen13 - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - update to 20240531: * Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GLK | B0 | 06-7a-01/01 | 00000040 | 00000042 | Pentium Silver N/J5xxx, Celeron N/J4xxx - Intel CPU Microcode was updated to the 20240813 release (bsc#1229129) - CVE-2024-24853: Security updates for [INTEL-SA-01083](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html) - CVE-2024-25939: Security updates for [INTEL-SA-01118](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html) - CVE-2024-24980: Security updates for [INTEL-SA-01100](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html) - CVE-2023-42667: Security updates for [INTEL-SA-01038](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html) - CVE-2023-49141: Security updates for [INTEL-SA-01046](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html) Other issues fixed: - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications](https://cdrdv2.intel.com/v1/dl/getContent/636674) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | AML-Y22 | H0 | 06-8e-09/10 | 000000f4 | 000000f6 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000fc | 00000100 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f6 | 000000f8 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f4 | 000000f6 | Core Gen8 | CFL-S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 Desktop | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | CLX-SP | B1 | 06-55-07/bf | 05003605 | 05003707 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000fa | 000000fc | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000fa | 000000fc | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000fa | 000000fc | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000fa | 000000fe | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000fa | 000000fc | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002802 | 07002904 | Xeon Scalable Gen3 | EHL | B1 | 06-96-01/01 | 00000019 | 0000001a | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | ICL-D | B0 | 06-6c-01/10 | 01000290 | 010002b0 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c4 | 000000c6 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003d1 | 0d0003e7 | Xeon Scalable Gen3 | KBL-R U | Y0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | KBL-U23e | J1 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | MTL | C-0 | 06-aa-04/e6 | 0000001c | 0000001e | Core™ Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 0000005e | 00000062 | Core Gen11 | TGL | B0/B1 | 06-8c-01/80 | 000000b6 | 000000b8 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000050 | 00000052 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000036 | 00000038 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000f4 | 000000f6 | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240910 release (bsc#1230400) - CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel Processors may allow a privileged user to potentially enable information disclosure via local access. [INTEL-SA-01103](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html) - CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel Processors may allow an privileged user to potentially enable a denial of service via local access [INTEL-SA-01097](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html) - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. [#]## New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TWL | N0 | 06-be-00/19 | | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E [#]## Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000035 | 00000036 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000035 | 00000036 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000433 | 00000434 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000433 | 00000434 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000017 | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | MTL | C0 | 06-aa-04/e6 | 0000001e | 0000001f | Core™ Ultra Processor | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000123 | 00000129 | Core Gen13/Gen14 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004121 | 00004122 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004121 | 00004122 | Core Gen13 - Intel CPU Microcode was updated to the 20241029 release Update for functional issues. Refer to [14th/13th Generation Intel Core Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000129 | 0000012b | Core Gen13/Gen14 - Intel CPU Microcode was updated to the 20241112 release (bsc#1233313) - CVE-2024-21853: Faulty finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel Xeon Processors may allow an authorized user to potentially enable denial of service via local access. Security updates for [INTEL-SA-01101](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01101.html) - CVE-2024-23918: Improper conditions check in some Intel Xeon processor memory controller configurations when using Intel SGX may allow a privileged user to potentially enable escalation of privilege via local access. Security updates for [INTEL-SA-01079](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html) - CVE-2024-21820: Incorrect default permissions in some Intel Xeon processor memory controller configurations when using Intel SGX may allow a privileged user to potentially enable escalation of privilege via local access. Security updates for [INTEL-SA-01079](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html) - CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel Processors may allow an privileged user to potentially enable a denial of service via local access. Updated security updates for [INTEL-SA-01097](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html) - CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel Processors may allow a privileged user to potentially enable information disclosure via local access Updated security updates for [INTEL-SA-01103](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html) - Update for functional issues. Refer to [Intel Core Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [14th/13th Generation Intel Core Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel Core Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [5th Gen Intel Xeon Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/793902) for details. - Update for functional issues. Refer to [4th Gen Intel Xeon Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel Xeon D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel Xeon D-1700 and D-1800 Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714069) for details New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000036 | 00000037 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000036 | 00000037 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000434 | 00000435 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000434 | 00000435 | Core Gen12 | EMR-SP | A0 | 06-cf-01/87 | 21000230 | 21000283 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000230 | 21000283 | Xeon Scalable Gen5 | MTL | C0 | 06-aa-04/e6 | 0000001f | 00000020 | Core™ Ultra Processor | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004122 | 00004123 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 00000036 | 00000037 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000036 | 00000037 | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004122 | 00004123 | Core Gen13 | SPR-SP | E3 | 06-8f-06/87 | 2b0005c0 | 2b000603 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0005c0 | 2b000603 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0005c0 | 2b000603 | Xeon Scalable Gen4 New Disclosures Updated in Prior Releases: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ICL-D | B0 | 06-6c-01/10 | 010002b0 | N/A | Xeon D-17xx/D-18xx, D-27xx/D-28xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003e7 | N/A | Xeon Scalable Gen3 - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. - Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224) - SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable - SKX-D | M1 | 06-55-04/b7 | 02006906 | Xeon D-21xx - CLX-SP | B0 | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2 - CLX-SP | B1 | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2 - Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224) | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2 - Updated to Intel CPU Microcode 20210525 release. - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833) See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html) - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839) See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details. - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details. - Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details. - Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details. - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details. - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details. - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CLX-SP | A0 | 06-55-05/b7 | | 03000010 | Xeon Scalable Gen2 | ICX-SP | C0 | 06-6a-05/87 | | 0c0002f0 | Xeon Scalable Gen3 | ICX-SP | D0 | 06-6a-06/87 | | 0d0002a0 | Xeon Scalable Gen3 | SNR | B0 | 06-86-04/01 | | 0b00000f | Atom P59xxB | SNR | B1 | 06-86-05/01 | | 0b00000f | Atom P59xxB | TGL | B1 | 06-8c-01/80 | | 00000088 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | | 00000016 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | | 0000002c | Core Gen11 Mobile | EHL | B1 | 06-96-01/01 | | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | RKL-S | B0 | 06-a7-01/02 | | 00000040 | Core Gen11 - Updated platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | HSX-E/EP | Cx/M1 | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3 | HSX-EX | E0 | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3 | SKL-U/Y | D0 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | SKL-U23e | K1 | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile | BDX-ML | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx | SKX-SP | B1 | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3 | BDX-DE | V2/V3 | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 | BDX-DE | Y0 | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87 | BDX-NS | A0 | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53 | APL | D0 | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series | GLK | B0 | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology | AML-Y22 | H0 | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10 | CML-U62 | A0 | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile | CML-U62 V2 | K0 | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile - Updated to Intel CPU Microcode 20220207 release. - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615) - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779) - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780) - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781) - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html) - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html) - Update for functional issues. Refer to [Third Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Second Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [11th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details. - Update for functional issues. Refer to [10th Gen Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th Generation Intel® Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [8th Gen Intel® Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [6th Generation Intel® Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details. - Update for functional issues. Refer to [Intel® Pentium® Silver and Intel® Celeron® Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details. - Updated to Intel CPU Microcode 20220419 release. (bsc#1198717) - Update for functional issues. Refer to errata APLI-11 in [Intel Atom Processor E3900 Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - Changed Microcodes: - | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx - Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html) - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details. - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details. - New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-97-05/03 | | 0000001f | Core Gen12 | ADL | L0 | 06-9a-03/80 | | 0000041c | Core Gen12 | ADL | L0 | 06-9a-04/80 | | 0000041c | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 | ADL | C0 | 06-bf-02/03 | | 0000001f | Core Gen12 - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | VLV | D0 | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx | SKL-U/Y | D0 | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile | SKX-SP | B1 | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx | CLX-SP | B0 | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3 | APL | D0 | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx | APL | E0 | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx | SKL-H/S | R0/N0 | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5 | DNV | B0 | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series | ICX-SP | D0 | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx | GKL-R | R0 | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile | LKF | B2/B3 | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology | TGL | B1 | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile | AML-Y22 | H0 | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile | CFL-U43e | D0 | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile | EHL | B1 | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | JSL | A0/A1 | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8 | CFL-H/S | P0 | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9 | CFL-H | R0 | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile | CML-H | R1 | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile | CML-S62 | G1 | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10 | CML-S102 | Q0 | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11 - Updated to Intel CPU Microcode 20220809 release. (bsc#1201727) - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html). - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SKX-SP | B1 | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable | SKX-D | M1 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx | ICX-SP | D0 | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-U/Y | D1 | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile | RKL-S | B0 | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11 | ADL | C0 | 06-97-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-97-05/03 | 0000001f | 00000022 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12 | ADL | C0 | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12 | ADL | C0 | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12 - Updated to Intel CPU Microcode 20230214 release. Security issues fixed: - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275) - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276) - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277) - CVE-2022-33972: Security updates for [INTEL-SA-00730](http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00730.html) (bsc#1208479) New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | SPR-SP | E2 | 06-8f-05/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | | 2b000181 | Xeon Scalable Gen4 | SPR-HBM | B3 | 06-8f-08/10 | | 2c000170 | Xeon Max | RPL-P 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-H 6+8 | J0 | 06-ba-02/07 | | 0000410e | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-02/07 | | 0000410e | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-97-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12 | ADL | C0 | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12 | CLX-SP | B0 | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2 | CPX-SP | A1 | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3 | GLK | B0 | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | LKF | B2/B3 | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11 | RPL-S | S0 | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable - Updated to Intel CPU Microcode 20230512 release. (bsc#1211382) - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 | 06-be-00/01 | | 00000010 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | | 00000004 | Intel(R) Atom(R) C1100 - Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | L0 | 06-9a-03/80 | 00000429 | 0000042a | Core Gen12 | ADL | L0 | 06-9a-04/80 | 00000429 | 0000042a | Core Gen12 | AML-Y22 | H0 | 06-8e-09/10 | | 000000f2 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000f4 | 000000f8 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f0 | 000000f2 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f0 | 000000f2 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f0 | 000000f2 | Core Gen8 | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f0 | 000000f2 | Core Gen8 Mobile | CLX-SP | B0 | 06-55-06/bf | 04003303 | 04003501 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003303 | 05003501 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f4 | 000000f6 | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f4 | 000000f6 | Core Gen10 | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f4 | 000000f6 | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002503 | 07002601 | Xeon Scalable Gen3 | ICL-D | B0 | 06-6c-01/10 | 01000211 | 01000230 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000b8 | 000000ba | Core Gen10 Mobile | ICX-SP | D0 | 06-6a-06/87 | 0d000389 | 0d000390 | Xeon Scalable Gen3 | KBL-G/H/S/E3 | B0 | 06-9e-09/2a | 000000f0 | 000000f2 | Core Gen7; Xeon E3 v6 | KBL-U/Y | H0 | 06-8e-09/c0 | | 000000f2 | Core Gen7 Mobile | LKF | B2/B3 | 06-8a-01/10 | 00000032 | 00000033 | Core w/Hybrid Technology | RKL-S | B0 | 06-a7-01/02 | 00000057 | 00000058 | Core Gen11 | RPL-H 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-P 6+8 | J0 | 06-ba-02/07 | 0000410e | 00004112 | Core Gen13 | RPL-S | S0 | 06-b7-01/32 | 00000112 | 00000113 | Core Gen13 | RPL-U 2+8 | Q0 | 06-ba-03/07 | 0000410e | 00004112 | Core Gen13 | SKX-D | H0 | 06-55-04/b7 | | 02006f05 | Xeon D-21xx | SKX-SP | B1 | 06-55-03/97 | 01000161 | 01000171 | Xeon Scalable | SKX-SP | H0/M0/U0 | 06-55-04/b7 | | 02006f05 | Xeon Scalable | SPR-HBM | B3 | 06-8f-08/10 | 2c000170 | 2c0001d1 | Xeon Max | SPR-SP | E0 | 06-8f-04/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E4 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | E5 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S2 | 06-8f-07/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | SPR-SP | S3 | 06-8f-08/87 | 2b000181 | 2b000461 | Xeon Scalable Gen4 | TGL | B1 | 06-8c-01/80 | 000000a6 | 000000aa | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000042 | 00000044 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000028 | 0000002a | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f4 | 000000f6 | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | | 000000f2 | Core Gen8 Mobile - Updated to Intel CPU Microcode 20230808 release. (bsc#1214099) Security issues fixed: - CVE-2022-40982: Security updates for [INTEL-SA-00828](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00828.html) (bsc#1206418) - CVE-2023-23908: Security updates for [INTEL-SA-00836](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html) - CVE-2022-41804: Security updates for [INTEL-SA-00837](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00837.html) Functional issues fixed: - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details. - Update for functional issues. Refer to [Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2100 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338854) for details. New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | CML-U62 V2     | K1       | 06-a6-01/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | SKX-D          | H0       | 06-55-04/b7 | 02006f05 | 02007006 | Xeon D-21xx | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006e05 | 02007006 | Xeon Scalable | KBL-G/H/S/X/E3 | B0       | 06-9e-09/2a | 000000f2 | 000000f4 | Core Gen7; Xeon E3 v6 | ADL            | L0       | 06-9a-03/80 | 0000042a | 0000042c | Core Gen12 | ADL            | L0       | 06-9a-04/80 | 0000042a | 0000042c | Core Gen12 | ICX-SP         | Dx/M1    | 06-6a-06/87 | 0d000390 | 0d0003a5 | Xeon Scalable Gen3 | CML-S102       | Q0       | 06-a5-05/22 | 000000f6 | 000000f8 | Core Gen10 | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | KBL-R U        | Y0       | 06-8e-0a/c0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CFL-H          | R0       | 06-9e-0d/22 | 000000f8 | 000000fa | Core Gen9 Mobile | RKL-S          | B0       | 06-a7-01/02 | 00000058 | 00000059 | Core Gen11 | ICL-U/Y        | D1       | 06-7e-05/80 | 000000ba | 000000bc | Core Gen10 Mobile | TGL-H          | R0       | 06-8d-01/c2 | 00000044 | 00000046 | Core Gen11 Mobile | SPR-SP         | E5/S3    | 06-8f-08/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E4/S2    | 06-8f-07/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E3       | 06-8f-06/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E2       | 06-8f-05/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | SPR-SP         | E0       | 06-8f-04/87 | 2b000461 | 2b0004b1 | Xeon Scalable Gen4 | CML-S62        | G1       | 06-a5-03/22 | 000000f6 | 000000f8 | Core Gen10 | AML-Y22        | H0       | 06-8e-09/10 | 000000f0 | 000000f4 | Core Gen8 Mobile | RPL-S          | B0       | 06-b7-01/32 | 00000113 | 00000119 | Core Gen13 | CML-U62 V1     | A0       | 06-a6-00/80 | 000000f6 | 000000f8 | Core Gen10 Mobile | ADL-N          | A0       | 06-be-00/11 |          | 00000011 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | CPX-SP         | A1       | 06-55-0b/bf | 07002601 | 07002703 | Xeon Scalable Gen3 | CLX-SP         | B0       | 06-55-06/bf | 04003501 | 04003604 | Xeon Scalable Gen2 | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000f2 | 000000f4 | Core Gen8 Desktop, Mobile, Xeon E | SPR-HBM        | Bx       | 06-8f-08/10 | 2c0001d1 | 2c000271 | Xeon Max | WHL-U          | W0       | 06-8e-0b/d0 | 000000f2 | 000000f4 | Core Gen8 Mobile | CLX-SP         | B1       | 06-55-07/bf | 05003501 | 05003604 | Xeon Scalable Gen2 | CFL-S          | B0       | 06-9e-0b/02 | 000000f2 | 000000f4 | Core Gen8 | TGL-R          | C0       | 06-8c-02/c2 | 0000002a | 0000002c | Core Gen11 Mobile | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | KBL-U23e       | J1       | 06-8e-09/c0 | 000000f2 | 000000f4 | Core Gen7 Mobile | AML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-U42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | CML-Y42        | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen10 Mobile | WHL-U          | V0       | 06-8e-0c/94 | 000000f6 | 000000f8 | Core Gen8 Mobile | SKX-SP         | B1       | 06-55-03/97 | 01000171 | 01000181 | Xeon Scalable | CFL-H/S        | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 | CFL-S          | P0       | 06-9e-0c/22 | 000000f2 | 000000f4 | Core Gen9 Desktop | TGL            | B0/B1    | 06-8c-01/80 | 000000aa | 000000ac | Core Gen11 Mobile | ADL            | C0       | 06-97-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-97-05/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-02/07 | 0000002c | 0000002e | Core Gen12 | ADL            | C0       | 06-bf-05/07 | 0000002c | 0000002e | Core Gen12 | CML-H          | R1       | 06-a5-02/20 | 000000f6 | 000000f8 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0       | 06-ba-02/e0 |          | 00004119 | Core Gen13 | RPL-U 2+8      | Q0       | 06-ba-03/e0 |          | 00004119 | Core Gen13 - Updated to Intel CPU Microcode 20231114 pre-release (labeled 20231113). (bsc#1215278) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Updated to Intel CPU Microcode 20231114 release. (bsc#1215278) - Security updates for [INTEL-SA-00950](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html) - CVE-2023-23583: Fixed potential CPU deadlocks or privilege escalation (bsc#1215278) - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [4th Gen Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 0000002e | 00000032 | Core Gen12 | ADL | H0 | 06-97-05/07 | 0000002e | 00000032 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 0000042c | 00000430 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 0000042c | 00000430 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000011 | 00000012 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000004 | 00000005 | Intel(R) Atom(R) C1100 | ICL-D | B0 | 06-6c-01/10 | 01000230 | 01000268 | Xeon D-17xx, D-27xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003a5 | 0d0003b9 | Xeon Scalable Gen3 | ICL-U/Y | D1 | 06-7e-05/80 | 000000bc | 000000c2 | Core Gen10 Mobile | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004119 | 0000411c | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 00000119 | 0000011d | Core Gen13 | RKL-S | B0 | 06-a7-01/02 | 00000059 | 0000005d | Core Gen11 | RPL-S | H0 | 06-bf-05/07 | 0000002e | 00000032 | Core Gen12 | RPL-S/HX | C0 | 06-bf-02/07 | 0000002e | 00000032 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004119 | 0000411c | Core Gen13 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-SP | E0 | 06-8f-04/87 | 2b0004b1 | 2b0004d0 | Xeon Scalable Gen4 | SPR-HBM | Bx | 06-8f-08/10 | 2c000271 | 2c000290 | Xeon Max | TGL | B0/B1 | 06-8c-01/80 | 000000ac | 000000b4 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000046 | 0000004e | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 0000002c | 00000034 | Core Gen11 Mobile - Updated to Intel CPU Microcode 20240312 release. (bsc#1221323) - Security updates for INTEL-SA-INTEL-SA-00972 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00972.html - CVE-2023-39368: Protection mechanism failure of bus lock regulator for some Intel Processors may allow an unauthenticated user to potentially enable denial of service via network access - Security updates for INTEL-SA-INTEL-SA-00982 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00982.html - CVE-2023-38575: Non-transparent sharing of return predictor targets between contexts in some Intel Processors may allow an authorized user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00898 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00898.html - CVE-2023-28746: Information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors may allow an authenticated user to potentially enable information disclosure via local access. - Security updates for INTEL-SA-INTEL-SA-00960 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00960.html - CVE-2023-22655 Protection mechanism failure in some 3rd and 4th Generation Intel Xeon Processors when using Intel SGX or Intel TDX may allow a privileged user to potentially enable escalation of privilege via local access. - Security updates for INTEL-SA-INTEL-SA-01045 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01045.html - CVE-2023-43490: Incorrect calculation in microcode keying mechanism for some Intel Xeon D Processors with Intel® SGX may allow a privileged user to potentially enable information disclosure via local access. - Update for functional issues. Refer to Intel Core Ultra Processor https://cdrdv2.intel.com/v1/dl/getContent/792254 for details. - Update for functional issues. Refer to 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Core Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to 11th Gen Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/631123 for details. - Update for functional issues. Refer to 10th Gen Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/341079 for details. - Update for functional issues. Refer to 10th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/615213 for details. - Update for functional issues. Refer to 8th and 9th Generation Intel Core Processor Family Spec Update https://cdrdv2.intel.com/v1/dl/getContent/337346 for details. - Update for functional issues. Refer to 8th Generation Intel Core Processor Families Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338025 for details. - Update for functional issues. Refer to 7th and 8th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/334663 for details. - Update for functional issues. Refer to 5th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634897 for details. - Update for functional issues. Refer to 3rd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/637780 for details. - Update for functional issues. Refer to 2nd Generation Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/338848 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Update for functional issues. Refer to Intel Xeon D-2700 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/714071 for details. - Update for functional issues. Refer to Intel Xeon E-2300 Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/709192 for details. - Update for functional issues. Refer to Intel Xeon Processor Scalable Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/613537 for details. - Update for functional issues. Refer to Intel Atom C3000 Processor Product Family Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336345 for details. - Update for functional issues. Refer to Intel Atom x6000E Series, and Intel Pentium and Celeron N and J Series Processors for Internet of Things (IoT) Applications https://cdrdv2.intel.com/v1/dl/getContent/636674 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/336562 for details. - Update for functional issues. Refer to Intel Pentium Silver and Intel Celeron Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/634542 for details. [#]## New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | EMR-SP | A-1 | 06-cf-02/87 | | 21000200 | Xeon Scalable Gen5 | EMR-SP | A-0 | 06-cf-01/87 | | 21000200 | Xeon Scalable Gen5 | MTL | C-0 | 06-aa-04/e6 | | 0000001c | Core Ultra Processor [#]## Updated Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000032 | 00000034 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000032 | 00000034 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000430 | 00000432 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000430 | 00000432 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000012 | 00000015 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | BDX-NS | A1 | 06-56-05/10 | 0e000014 | 0e000015 | Xeon D-1513N/23/33/43/53 | CFL-H | R0 | 06-9e-0d/22 | 000000fa | 000000fc | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f4 | 000000f6 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | P0 | 06-9e-0c/22 | 000000f4 | 000000f6 | Core Gen9 Desktop | CLX-SP | B0 | 06-55-06/bf | 04003604 | 04003605 | Xeon Scalable Gen2 | CLX-SP | B1 | 06-55-07/bf | 05003604 | 05003605 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000f8 | 000000fa | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000f8 | 000000fa | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000f8 | 000000fa | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002703 | 07002802 | Xeon Scalable Gen3 | DNV | B0 | 06-5f-01/01 | 00000038 | 0000003e | Atom C Series | EHL | B1 | 06-96-01/01 | 00000017 | 00000019 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | GLK | B0 | 06-7a-01/01 | 0000003e | 00000040 | Pentium Silver N/J5xxx, Celeron N/J4xxx | GLK-R | R0 | 06-7a-08/01 | 00000022 | 00000024 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 | ICL-D | B0 | 06-6c-01/10 | 01000268 | 01000290 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c2 | 000000c4 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003b9 | 0d0003d1 | Xeon Scalable Gen3 | JSL | A0/A1 | 06-9c-00/01 | 24000024 | 24000026 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 | KBL-G/H/S/X/E3 | B0 | 06-9e-09/2a | 000000f4 | 000000f8 | Core Gen7; Xeon E3 v6 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 0000411c | 00004121 | Core Gen13 | RPL-S | B0 | 06-b7-01/32 | 0000011d | 00000122 | Core Gen13 | RPL-S | H0 | 06-bf-05/07 | 00000032 | 00000034 | Core Gen12 | RKL-S | B0 | 06-a7-01/02 | 0000005d | 0000005e | Core Gen11 | RPL-S/HX | C0 | 06-bf-02/07 | 00000032 | 00000034 | Core Gen12 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 0000411c | 00004121 | Core Gen13 | SKX-SP | B1 | 06-55-03/97 | 01000181 | 01000191 | Xeon Scalable | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | SPR-SP | E2 | 06-8f-05/87 | 2b0004d0 | 2b000590 | Xeon Scalable Gen4 | TGL | B0/B1 | 06-8c-01/80 | 000000b4 | 000000b6 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 0000004e | 00000050 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000034 | 00000036 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000f8 | 000000fa | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240514 release (bsc#1224277) - CVE-2023-45733: Security updates for INTEL-SA-01051 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01051.html - CVE-2023-46103: Security updates for INTEL-SA-01052 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01052.html - CVE-2023-45745,CVE-2023-47855: Security updates for INTEL-SA-01036 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01036.html - Update for functional issues. Refer to 5th Gen Intel Xeon Processor Scalable Family https://cdrdv2.intel.com/v1/dl/getContent/793902 for details. - Update for functional issues. Refer to 4th Gen Intel Xeon Scalable Processors Specification Update https://cdrdv2.intel.com/v1/dl/getContent/772415 for details. - Update for functional issues. Refer to 14th & 13th Generation Intel Core Processor Specification Update https://cdrdv2.intel.com/v1/dl/getContent/740518 for details. - Update for functional issues. Refer to 12th Generation Intel Cor™ Processor Family https://cdrdv2.intel.com/v1/dl/getContent/682436 for details. - Update for functional issues. Refer to Intel Processors and Intel Core i3 N-Series https://cdrdv2.intel.com/v1/dl/getContent/764616 for details. - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000034 | 00000035 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000034 | 00000035 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000432 | 00000433 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000432 | 00000433 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000015 | 00000017 | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | AZB | A0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | AZB | R0 | 06-9a-04/40 | 00000005 | 00000007 | Intel(R) Atom(R) C1100 | EMR-SP | A0 | 06-cf-01/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000200 | 21000230 | Xeon Scalable Gen5 | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000122 | 00000123 | Core Gen13/Gen14 | RPL-HX/S | C0 | 06-bf-02/07 | 00000034 | 00000035 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000034 | 00000035 | Core Gen13/Gen14 | SPR-HBM | Bx | 06-8f-08/10 | 2c000290 | 2c000390 | Xeon Max | SPR-SP | E2 | 06-8f-05/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E3 | 06-8f-06/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b000590 | 2b0005c0 | Xeon Scalable Gen4 - update to 20240531: * Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update - Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | GLK | B0 | 06-7a-01/01 | 00000040 | 00000042 | Pentium Silver N/J5xxx, Celeron N/J4xxx - Intel CPU Microcode was updated to the 20240813 release (bsc#1229129) - CVE-2024-24853: Security updates for [INTEL-SA-01083](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01083.html) - CVE-2024-25939: Security updates for [INTEL-SA-01118](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01118.html) - CVE-2024-24980: Security updates for [INTEL-SA-01100](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01100.html) - CVE-2023-42667: Security updates for [INTEL-SA-01038](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01038.html) - CVE-2023-49141: Security updates for [INTEL-SA-01046](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01046.html) Other issues fixed: - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [3rd Generation Intel® Xeon® Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634897) for details. - Update for functional issues. Refer to [2nd Generation Intel® Xeon® Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details - Update for functional issues. Refer to [Intel® Xeon® D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel® Xeon® E-2300 Processor Specification Update ](https://cdrdv2.intel.com/v1/dl/getContent/709192) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [11th Gen Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details. - Update for functional issues. Refer to [10th Gen Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details. - Update for functional issues. Refer to [10th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details. - Update for functional issues. Refer to [8th and 9th Generation Intel® Core™ Processor Family Spec Update](https://cdrdv2.intel.com/v1/dl/getContent/337346) for details. - Update for functional issues. Refer to [8th Generation Intel® Core™ Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details. - Update for functional issues. Refer to [7th and 8th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. - Update for functional issues. Refer to [Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications](https://cdrdv2.intel.com/v1/dl/getContent/636674) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | AML-Y22 | H0 | 06-8e-09/10 | 000000f4 | 000000f6 | Core Gen8 Mobile | AML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CFL-H | R0 | 06-9e-0d/22 | 000000fc | 00000100 | Core Gen9 Mobile | CFL-H/S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 | CFL-H/S/E3 | U0 | 06-9e-0a/22 | 000000f6 | 000000f8 | Core Gen8 Desktop, Mobile, Xeon E | CFL-S | B0 | 06-9e-0b/02 | 000000f4 | 000000f6 | Core Gen8 | CFL-S | P0 | 06-9e-0c/22 | 000000f6 | 000000f8 | Core Gen9 Desktop | CFL-U43e | D0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | CLX-SP | B1 | 06-55-07/bf | 05003605 | 05003707 | Xeon Scalable Gen2 | CML-H | R1 | 06-a5-02/20 | 000000fa | 000000fc | Core Gen10 Mobile | CML-S102 | Q0 | 06-a5-05/22 | 000000fa | 000000fc | Core Gen10 | CML-S62 | G1 | 06-a5-03/22 | 000000fa | 000000fc | Core Gen10 | CML-U42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CML-U62 V1 | A0 | 06-a6-00/80 | 000000fa | 000000fe | Core Gen10 Mobile | CML-U62 V2 | K1 | 06-a6-01/80 | 000000fa | 000000fc | Core Gen10 Mobile | CML-Y42 | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen10 Mobile | CPX-SP | A1 | 06-55-0b/bf | 07002802 | 07002904 | Xeon Scalable Gen3 | EHL | B1 | 06-96-01/01 | 00000019 | 0000001a | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E | ICL-D | B0 | 06-6c-01/10 | 01000290 | 010002b0 | Xeon D-17xx, D-27xx | ICL-U/Y | D1 | 06-7e-05/80 | 000000c4 | 000000c6 | Core Gen10 Mobile | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003d1 | 0d0003e7 | Xeon Scalable Gen3 | KBL-R U | Y0 | 06-8e-0a/c0 | 000000f4 | 000000f6 | Core Gen8 Mobile | KBL-U23e | J1 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | KBL-U/Y | H0 | 06-8e-09/c0 | 000000f4 | 000000f6 | Core Gen7 Mobile | MTL | C-0 | 06-aa-04/e6 | 0000001c | 0000001e | Core™ Ultra Processor | RKL-S | B0 | 06-a7-01/02 | 0000005e | 00000062 | Core Gen11 | TGL | B0/B1 | 06-8c-01/80 | 000000b6 | 000000b8 | Core Gen11 Mobile | TGL-H | R0 | 06-8d-01/c2 | 00000050 | 00000052 | Core Gen11 Mobile | TGL-R | C0 | 06-8c-02/c2 | 00000036 | 00000038 | Core Gen11 Mobile | WHL-U | V0 | 06-8e-0c/94 | 000000fa | 000000fc | Core Gen8 Mobile | WHL-U | W0 | 06-8e-0b/d0 | 000000f4 | 000000f6 | Core Gen8 Mobile - Intel CPU Microcode was updated to the 20240910 release (bsc#1230400) - CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel Processors may allow a privileged user to potentially enable information disclosure via local access. [INTEL-SA-01103](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html) - CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel Processors may allow an privileged user to potentially enable a denial of service via local access [INTEL-SA-01097](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html) - Update for functional issues. Refer to [Intel® Core™ Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [13th Generation Intel® Core™ Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel® Core™ Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [Intel® Processors and Intel® Core™ i3 N-Series](https://cdrdv2.intel.com/v1/dl/getContent/764616) for details. [#]## New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | TWL | N0 | 06-be-00/19 | | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E [#]## Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000035 | 00000036 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000035 | 00000036 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000433 | 00000434 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000433 | 00000434 | Core Gen12 | ADL-N | N0 | 06-be-00/11 | 00000017 | 0000001a | Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E | MTL | C0 | 06-aa-04/e6 | 0000001e | 0000001f | Core™ Ultra Processor | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000123 | 00000129 | Core Gen13/Gen14 | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004121 | 00004122 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000035 | 00000036 | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004121 | 00004122 | Core Gen13 - Intel CPU Microcode was updated to the 20241029 release Update for functional issues. Refer to [14th/13th Generation Intel Core Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | RPL-E/HX/S | B0 | 06-b7-01/32 | 00000129 | 0000012b | Core Gen13/Gen14 - Intel CPU Microcode was updated to the 20241112 release (bsc#1233313) - CVE-2024-21853: Faulty finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel Xeon Processors may allow an authorized user to potentially enable denial of service via local access. Security updates for [INTEL-SA-01101](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01101.html) - CVE-2024-23918: Improper conditions check in some Intel Xeon processor memory controller configurations when using Intel SGX may allow a privileged user to potentially enable escalation of privilege via local access. Security updates for [INTEL-SA-01079](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html) - CVE-2024-21820: Incorrect default permissions in some Intel Xeon processor memory controller configurations when using Intel SGX may allow a privileged user to potentially enable escalation of privilege via local access. Security updates for [INTEL-SA-01079](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html) - CVE-2024-24968: Improper finite state machines (FSMs) in hardware logic in some Intel Processors may allow an privileged user to potentially enable a denial of service via local access. Updated security updates for [INTEL-SA-01097](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01097.html) - CVE-2024-23984: Observable discrepancy in RAPL interface for some Intel Processors may allow a privileged user to potentially enable information disclosure via local access Updated security updates for [INTEL-SA-01103](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html) - Update for functional issues. Refer to [Intel Core Ultra Processor](https://cdrdv2.intel.com/v1/dl/getContent/792254) for details. - Update for functional issues. Refer to [14th/13th Generation Intel Core Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/740518) for details. - Update for functional issues. Refer to [12th Generation Intel Core Processor Family](https://cdrdv2.intel.com/v1/dl/getContent/682436) for details. - Update for functional issues. Refer to [5th Gen Intel Xeon Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/793902) for details. - Update for functional issues. Refer to [4th Gen Intel Xeon Scalable Processors Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/772415) for details. - Update for functional issues. Refer to [3rd Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details. - Update for functional issues. Refer to [Intel Xeon D-2700 Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714071) for details. - Update for functional issues. Refer to [Intel Xeon D-1700 and D-1800 Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/714069) for details New Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- Updated Platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL | C0 | 06-97-02/07 | 00000036 | 00000037 | Core Gen12 | ADL | H0 | 06-97-05/07 | 00000036 | 00000037 | Core Gen12 | ADL | L0 | 06-9a-03/80 | 00000434 | 00000435 | Core Gen12 | ADL | R0 | 06-9a-04/80 | 00000434 | 00000435 | Core Gen12 | EMR-SP | A0 | 06-cf-01/87 | 21000230 | 21000283 | Xeon Scalable Gen5 | EMR-SP | A1 | 06-cf-02/87 | 21000230 | 21000283 | Xeon Scalable Gen5 | MTL | C0 | 06-aa-04/e6 | 0000001f | 00000020 | Core™ Ultra Processor | RPL-H/P/PX 6+8 | J0 | 06-ba-02/e0 | 00004122 | 00004123 | Core Gen13 | RPL-HX/S | C0 | 06-bf-02/07 | 00000036 | 00000037 | Core Gen13/Gen14 | RPL-S | H0 | 06-bf-05/07 | 00000036 | 00000037 | Core Gen13/Gen14 | RPL-U 2+8 | Q0 | 06-ba-03/e0 | 00004122 | 00004123 | Core Gen13 | SPR-SP | E3 | 06-8f-06/87 | 2b0005c0 | 2b000603 | Xeon Scalable Gen4 | SPR-SP | E4/S2 | 06-8f-07/87 | 2b0005c0 | 2b000603 | Xeon Scalable Gen4 | SPR-SP | E5/S3 | 06-8f-08/87 | 2b0005c0 | 2b000603 | Xeon Scalable Gen4 New Disclosures Updated in Prior Releases: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ICL-D | B0 | 06-6c-01/10 | 010002b0 | N/A | Xeon D-17xx/D-18xx, D-27xx/D-28xx | ICX-SP | Dx/M1 | 06-6a-06/87 | 0d0003e7 | N/A | Xeon Scalable Gen3 - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36 - Conditionalize the use of /lib/modprobe.d only on systems with split usr support enabled (i.e. SLE). - Drop a workaround related to systemd-timesyncd that addressed a Factory issue. - Move systemd-boot and all components managing (secure) UEFI boot into udev sub-package: they may deserve a dedicated sub-package in the future but for now move them to udev so they aren't installed in systemd based containers. - Drop build requirement on libpci, it's not more needed since udev hwdb was introduced 11 years ago. - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Fix return non-zero value when disabling SysVinit service (bsc#1208432) - Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16) - Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and /dev/dvdrw could have no longer been created. Futhermore the rule added by this patch dealing with /dev/cdrom was redundant with the upstream one - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141) Optimize when hundred workers claim the same symlink with the same priority. - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Import commit 6441bb41141aaa8bfb63559917362748a3044c15 165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410) - Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741) That way "systemd --user" instances get their own session keyring instead of the user default session keyring. For some reasons cifscreds refuses to work with the latter. That's what is expected for every PAM session anyway. - kbd-model-map.legacy: drop some entries no longer needed by YaST Related to bsc#1194609. - kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long term (bsc#1210702) - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Move the persistent net rule fix in udev fixlet script. - Move more packaging fixups in the fixlet script. - Make sure to pre-install the groups systemd and udev rely on. This is needed when the tmpfiles are run at package installation time (i.e. when file-triggers are disabled). - Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606) - Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14 3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576) 6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576) 37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185) 02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576) 412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576) 16f897570a units: remove the restart limit on the modprobe@.service e4e85b08bd tests: add test case for long unit names 3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194) - Import commit b473c02cc08e093e370034425671cbc001c6748e 02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target 70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873) e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char* c9d3dd5954 udev: set description for device monitor 3f07f44fde test: use sd_device_monitor_set_description() b304a1e1a2 sd-device-monitor: logs description for device monitor 929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description() 340e523048 sd-device-monitor: fix inversed condition 02659c7b67 tree-wide: port various places over to new stat_inode_same() helper b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one d25219cbe3 libsystemd: ignore both EINTR and EAGAIN 648a151313 errno-util: introduce ERRNO_IS_TRANSIENT() - Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into 1013-strip-the-domain-part-from-etc-hostname-when-setting.patch - Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into 1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch - Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into 1015-networkd-make-network.service-an-alias-of-systemd-ne.patch - Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into 1016-core-disable-session-keyring-per-system-sevice-entir.patch - Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into 1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch Hence these patch files can be easily identified as SLE specific ones. - systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf` - Import commit e677079182c975ecdad88a76f657fecb4de523d9 7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty 29c3eb4681 utmp-wtmp: fix error in case isatty() fails 98970eb90b homed: handle EINTR gracefully when waiting for device node 0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better 40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success 5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll() 6bbd70f092 stdio-bridge: don't be bothered with EINTR f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241) 746962ff40 core: replace slice dependencies as they get added (bsc#1214668) - Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3 ba7f1df7a5 vconsole-setup: simplify error handling 94f4eaea77 Introduce RET_GATHER and use it in src/shared/ e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE 0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT 98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies() 73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive ba585a28d7 core: Add trace logging to mount_add_device_dependencies() 36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460) bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies ce4907c7c3 core: wrap some long comment - Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17) c8578cef7f resolved: actually check authenticated flag of SOA transaction (bsc#1218297 CVE-2023-7008) - Update 1011-sysv-generator-add-back-support-for-SysV-scripts-for.patch Really skip redundant dependencies specified the LSB description that references the file name of the service itself for early boot scripts (noticed in bsc#1221479). - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091) Otherwise pesign-obs-integration ends up re-packaging systemd with all macros inside comments unescaped leading to unpredictable behavior. Now why rpm expands rpm macros inside comments is the question... - Import commit a57a6d239c5d6b91fb3dcd269705e60804a03ae1 cd0c9ac4f4 unit: drop ProtectClock=yes from systemd-udevd.service (bsc#1226414) e1eaa86a49 udev: do not set ID_PATH and by-path symlink for nvmf disks a85d211874 man: Document ranges for distributions config files and local config files - Import commit cba472567893618e15b4ab95a3cb0a762ad3ed10 0e8c003e1f core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (bsc#1230272) 621e16c0b8 core/unit: add get_timeout_start_usec in UnitVTable and define it for service b4140d888a sd-bus: make bus_add_match_full accept timeout 81cb3a4fb5 udev-builtin-path_id: SAS wide ports must have num_phys > 1 (bsc#1231610) 533e98fc6b sd-device: add helper to read a unsigned int attribute - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - Rectify grammar issues in summaries - Fix BuildRequires/Requires tags related to libblockdev and libatasmart dependencies. - Drop storaged Provides tags since there is no need for them. - Switch libconfig-devel and libstoragemgmt-devel BuildRequires by their pkgconfig modules counterparts. - Add a Recommends tag for the btrfs module to offer support for the openSUSE's file system of choice by default. - Require specific libblockdev plugins in due udisks2's modules, following libblockdev's plugins split (bsc#1086447). - Drop redundant libblockdev-devel BuildRequires: it is not needed once its pkgconfig module is already a requirement. - Add missing libblockdev-loop Requires tag: it is needed by default. - Update to version 2.7.8: + Fix string format vulnerability (CVE-2018-17336) - Add explicit libblockdev-lvm-dbus-devel BuildRequires: Previously pulled in implicitly. - Update to version 2.8.1: + Mostly bugfixes. - Changes from version 2.8.0: + Introduce a new VDO module that is built on top of libblockdev-vdo. + General bugfixes. + Support creating LUKS 2 encrypted devices and other LUKS-related enhancements. - Add libblockdev-vdo-devel BuildRequires: Build the new vdo module. Following this, add new vdo sub-package. - Add more info to description of vdo. - Generalize VDO description. - Fix faulty grammar. - update to 2.8.2 + migration from intltool to gettext, udisks no longer depends on gnome-common + added 'windows_names' as a default mount option for ntfs-3g + fixed an issue potentially leading to open filedescriptors exhaustion - drop buildreq for intltool - Update to version 2.8.3: + This release brings many memory leak fixes with similar work done in libblockdev-2.22. While libblockdev version requirement remains unchanged, it's strongly recommended to use both releases together to get full coverage of the fixes. + Other notable changes include: - Default and supported encryption types are now exposed on the org.freedesktop.UDisks2.Manager interface. - Minor org.freedesktop.UDisks2.Filesystem improvements related to updating properties upon method call return. - Various test fixes and improvements. - Updated translations. - don't call systemd uninstall macro for clean-mount-point@.service template (boo#1139996) - Do not recommend lang package. The lang package already has a supplements. - Update to version 2.8.4: + This udisks-2.8.4 release brings couple of bugfixes, docs and test fixes and translation updates. With ongoing focus on development towards udisks-2.9.0, this is just a small maintenance release. - Update to version 2.9.1: + This is mostly a bugfix release, notable changes include: - active modules are now tracked in a daemon state file and are automatically reloaded on next startup in case of previous unclean daemon shutdown - further improvements in object property updates while handling method calls - zram module fixes: + compatibility improvements with existing zram generators and toolkits + the zram-setup@.service systemd unit has been renamed to udisks2-zram-setup@.service + related udev rules have been separated into 90-udisks2-zram.rules + the zram.conf.d path is now configurable and defaults to /usr/lib/zram.conf.d - Update to version 2.9.0: + This 2.9.0 release brings many changes to the daemon core, internal modularity and the libudisks2 library. No public API has been removed, there is a couple of deprecations however. + There's a major change in how and when D-Bus object properties are updated. As a general rule when a method call returns affected objects should now have their properties updated by that moment. This is an ongoing task and while majority of the daemon API has been covered, there are pending issues in some of the modules. + Configurable mount options is a new big feature for this release, allowing sysadmins to re-define default mount options for each filesystem type. Extensive documentation is available at http://storaged.org/doc/udisks2-api/latest/mount_options.html + Internal module API has been reworked, modules should now be enabled separately via the new EnableModule() call that also reports initialization failures. The old org.freedesktop.UDisks2.Manager.EnableModules() call has been deprecated. + Additional feature highlights: - building the daemon can now be disabled via configure switch, only libudisks2 will be built - removed the systemd mount cleanup service, mount state is now tracked separately for persistent and non-persistent mount points and cleanup of lingering persistent mount points is performed on daemon startup (e.g. on system boot) - new LVM-VDO integration, deprecated the standalone VDO module - added support for (un)locking BitLocker devices - libudisks2 now includes generated GDBus code for compiled-in modules, separate pkg-config files are provided as well - Add upstream bugfix patches: + udisks2-Fix-memory-leaks.patch + udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch - update to 2.9.2: * udiskslinuxblock: Survive a missing /etc/crypttab * lvm2: Fix leaking BDLVMVDOPooldata * tests: Test modules that are actually enabled during build * build: Exclude VDO module from distcheck build * udisksfstabentry: Add udisks_fstab_entry_has_opt() * udiskslinuxblock: Reflect fstab "noauto" mount option in HintAuto * udiskslinuxblock: Update hints after fstab change * tests: Add tests for Block hints * udiskslinuxfilesystemhelpers: Make TakeOwnership() race free * tests: Extend filesystem test_take_ownership tests with symlinks * mount options: Allow 'nosymfollow' mount option for unprivileged mounts * udisksstate: Silence the block device busy messages on cleanup lock * udev: Distinguish mmcblk-class device types * udev: Propagate mmcblk disk attributes to mmcblk_boot devices * udiskslinuxdrive: Tweak the 'removable'/'ejectable' hints for mmcblk-class devices * udiskslinuxblock: Tweak the hints for mmcblk-class devices * udisksdaemonutil: Refactor udisks_daemon_util_trigger_uevent() out of UDisksLinuxBlockObject * udiskslinuxmanager: Trigger uevent after loop device setup * tests: Remove scsi_debug serial number checks * tests: Skip zram tests if zram module is already loaded * treewide: Fix typos * AUTHORS: Add tbzatek as the maintainer * tests: Do not use nilfs2 as an example of non-resizable FS * Memory leak fixes * doc: Update config file path - drop udisks2-Fix-memory-leaks.patch, udisks2-lvm2-Fix-leaking-BDLVMVDOPooldata.patch (upstream) - CVE-2021-3802: fix insecure defaults in user-accessible mount helpers (bsc#1190606) + add 0001-mount-options-Always-use-errors-remount-ro-for-ext-f.patch - fix double free inside the g_static_resource_fini() atexit handler (bsc#1228290) + add 0001-udiskslinuxmountoptions-Do-not-free-static-daemon-re.patch - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609, util-linux-chcpu-document-zVM-limitations.patch, util-linux-chcpu-document-zVM-limitations-generated.patch). - lscpu: Add more ARM cores (bsc#1223605, util-linux-lscpu-add-more-ARM-cores-1.patch, util-linux-lscpu-add-more-ARM-cores-2.patch, util-linux-lscpu-add-more-ARM-cores-3.patch, util-linux-lscpu-add-more-ARM-cores-4.patch, util-linux-lscpu-add-more-ARM-cores-5.patch, util-linux-lscpu-add-more-ARM-cores-6.patch). - Don't delete binaries not common for all architectures. Create an util-linux-extra subpackage instead, so users of third party tools can use them. (bsc#1222285) - Document unexpected side effects of lazy destruction (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch, util-linux-umount-losetup-lazy-destruction-generated.patch). - agetty: Prevent login cursor escape (bsc#1194818, util-linux-agetty-prevent-cursor-escape.patch). - Skip aarch64 decode path for rest of the architectures (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch). - Update to version 2.36.2: * agetty: tty eol defaults to REPRINT * fsck.cramfs: fix fsck.cramfs crashes on blocksizes > 4K * lib/caputils: add fall back for last cap using prctl. * lib/signames: change license to public domain * libfdisk: * (dos) fix last possible sector calculation * (script) ignore empty values for start and size * ignore 33553920 byte optimal I/O size * libmount: * add vboxsf, virtiofs to pseudo filesystems * do not canonicalize ZFS source dataset * don't use "symfollow" for helpers on user mounts (boo#1181750, obsoletes util-linux-libmount-dont-use-symfollow.patch) * fix /{etc,proc}/filesystems use * login: use full tty path for PAM_TTY * lsblk: read SCSI_IDENT_SERIAL also from udev * rfkill: stop execution when rfkill device cannot be opened * setpriv: allow using [-+]all for capabilities. * su: use full tty path for PAM_TTY * switch_root: check if mount point to move even exists * umount: * ignore --no-canonicalize,-c for non-root users * Show the 'r' option in the help menu * Code cleanups and documentation improvements. * Translation updates. - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Update to version 2.36.2: * agetty: tty eol defaults to REPRINT * fsck.cramfs: fix fsck.cramfs crashes on blocksizes > 4K * lib/caputils: add fall back for last cap using prctl. * lib/signames: change license to public domain * libfdisk: * (dos) fix last possible sector calculation * (script) ignore empty values for start and size * ignore 33553920 byte optimal I/O size * libmount: * add vboxsf, virtiofs to pseudo filesystems * do not canonicalize ZFS source dataset * don't use "symfollow" for helpers on user mounts (boo#1181750, obsoletes util-linux-libmount-dont-use-symfollow.patch) * fix /{etc,proc}/filesystems use * login: use full tty path for PAM_TTY * lsblk: read SCSI_IDENT_SERIAL also from udev * rfkill: stop execution when rfkill device cannot be opened * setpriv: allow using [-+]all for capabilities. * su: use full tty path for PAM_TTY * switch_root: check if mount point to move even exists * umount: * ignore --no-canonicalize,-c for non-root users * Show the 'r' option in the help menu * Code cleanups and documentation improvements. * Translation updates. - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Update to version 2.36.2: * agetty: tty eol defaults to REPRINT * fsck.cramfs: fix fsck.cramfs crashes on blocksizes > 4K * lib/caputils: add fall back for last cap using prctl. * lib/signames: change license to public domain * libfdisk: * (dos) fix last possible sector calculation * (script) ignore empty values for start and size * ignore 33553920 byte optimal I/O size * libmount: * add vboxsf, virtiofs to pseudo filesystems * do not canonicalize ZFS source dataset * don't use "symfollow" for helpers on user mounts (boo#1181750, obsoletes util-linux-libmount-dont-use-symfollow.patch) * fix /{etc,proc}/filesystems use * login: use full tty path for PAM_TTY * lsblk: read SCSI_IDENT_SERIAL also from udev * rfkill: stop execution when rfkill device cannot be opened * setpriv: allow using [-+]all for capabilities. * su: use full tty path for PAM_TTY * switch_root: check if mount point to move even exists * umount: * ignore --no-canonicalize,-c for non-root users * Show the 'r' option in the help menu * Code cleanups and documentation improvements. * Translation updates. - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Update to version 2.36.2: * agetty: tty eol defaults to REPRINT * fsck.cramfs: fix fsck.cramfs crashes on blocksizes > 4K * lib/caputils: add fall back for last cap using prctl. * lib/signames: change license to public domain * libfdisk: * (dos) fix last possible sector calculation * (script) ignore empty values for start and size * ignore 33553920 byte optimal I/O size * libmount: * add vboxsf, virtiofs to pseudo filesystems * do not canonicalize ZFS source dataset * don't use "symfollow" for helpers on user mounts (boo#1181750, obsoletes util-linux-libmount-dont-use-symfollow.patch) * fix /{etc,proc}/filesystems use * login: use full tty path for PAM_TTY * lsblk: read SCSI_IDENT_SERIAL also from udev * rfkill: stop execution when rfkill device cannot be opened * setpriv: allow using [-+]all for capabilities. * su: use full tty path for PAM_TTY * switch_root: check if mount point to move even exists * umount: * ignore --no-canonicalize,-c for non-root users * Show the 'r' option in the help menu * Code cleanups and documentation improvements. * Translation updates. - ipcs: Avoid overflows (bsc#1178236, util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - ipcutils: Avoid potential memory allocation overflow (bsc#1188921, CVE-2021-37600, util-linux-ipcutils-overflow-CVE-2021-37600.patch). - Add bc to BuildRequires to run more complete testsuite, fix testsuite (bsc#1178236#c19, util-linux-ipcs-shmall-overflow-ts.patch). - Update to version 2.37.2: * No longer uses Groff to maintain man-pages. * New implementation of hardlink. * lscpu reimplemented. * uclampset: new util to manipulate the utilization clamping attributes of the system or a process. * hexdump automatically uses -C when called as "hd". * dmesg supports new command-line options --since and --until. * findmnt supports new command-line options --shadowed to print only filesystems over-mounted by another filesystem. * mount supports --read-only command-line option for non-root users too. * umount(8) can umount also all over-mounted filesystems (more filesystems on the the same mount point) when executed with - -recursive. * libfdisk (and fdisk, sfdisk, cfdisk) supports partition type names on input, ignoring the case of the characters and all non-alphanumeric and non-digit characters in the name (e.g. type="Linux /usr x86" is the same as type="linux usr-x86" for sfdisk). * libmount no longer contains a workaround to detect inconsistent /proc/self/mountinfo reads. * libblkid supports "probing hints" now. The hints are the optional way how to force probing functions to check for example another location -- for example specific session on multi-session UDF. The command blkid(8) supports this functionality with a new --hint option. The library has been also extended to support others ISO9660 and UDF identifiers. * blkzone provides a new "capacity" command. * cfdisk is possible to start in read-only mode by a new command-line option --read-only * lsblk provides new columns FSROOTS, and MOUNTPOINTS. The column MOUNTPOINTS is used in the default output now and this new column prints all mount points where the device is used (btrfs subvolumes, bind mounts, etc). * losetup uses LOOP_CONFIG ioctl now. * column supports a new command-line option --table-columns-limit to specify a maximal number of the input columns. The last column will contain all remaining line data if the limit is smaller than the number of the columns in the input data. * Obsoletes util-linux-ipcs-shmall-overflow-1.patch, util-linux-ipcs-shmall-overflow-2.patch, util-linux-ipcs-shmall-overflow-ts.patch, util-linux-ipcutils-overflow-CVE-2021-37600.patch. * Many other new features and fixes. For the complete list see https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.1-ReleaseNotes https://www.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.2-ReleaseNotes - Update util-linux-login_defs-check.sh and login_defs-support-for-util-linux to version 2.37 (new variable LOGIN_KEEP_USERNAME). - INCOMPATIBLE CHANGE: Remove the raw utility altogether, as it is not even built any more with the latest kernel. - The legacy code does not support /etc/login.defs.d used by YaST. Enable libeconf to read it (bsc#1192954). - blockdev: Remove NBSP character in values (bsc#1188507#c31, blockdev-remove-nbsp.patch). - Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996, bsc#1194976, util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch, util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch). - Implement "X-fstrim.notrim" fstab mount option that skips fstrim for selected device (jsc#SLE-17942, util-linux-fstrim-implement-X-fstrim.notrim.patch). - Fix "su -s" bash completion (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch). - Make uuidd lock state file usable and time based UUIDs safe again (bsc#1194642, util-linux-uuidd-fix-lock-state.patch). - Prevent root owning of /var/lib/libuuid/clock.txt (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch). - Extend cache in uuid_generate_time_generic() (bsc#1194642#c51, util-linux-libuuid-extend-cache.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). - libuuid improvements (bsc#1201959, PED-1150): * libuuid: Fix range when parsing UUIDs (util-linux-libuuid-uuid_parse-overrun.patch). * Improve cache handling for short running applications-increment the cache size over runtime (util-linux-libuuid-improve-cache-handling.patch). * Implement continuous clock handling for time based UUIDs (util-linux-libuuid-continuous-clock-handling.patch). * Check clock value from clock file to provide seamless libuuid update (util-linux-libuuid-check-clock-value.patch). - Update to version 2.37.4 (PED-1869): * Fix security issue in chsh(1) and chfn(8) (CVE-2022-0563). SUSE is not affected (bsc#1196241). * CVE-2021-3996 (bsc#1194976, obsoletes util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch) Improper UID check in libmount allows an unprivileged user to unmount FUSE filesystems of users with similar UID. * CVE-2021-3995 (bsc#1194976, obsoletes util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch) This issue is related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other user's filesystems that are either world-writable themselves or mounted in a world-writable directory. - linux-fs.patch: Fix conflict between <linux/fs.h> and <sys/mount.h> - Fix file conflict during upgrade (boo#1204211). - libuuid continuous clock handling for time based UUIDs: Prevent use of the new libuuid ABI by uuidd %post before update of libuuid1 (bsc#1205646). - util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet to prevent error message if /var/lib/libuuid/clock.txt does not exist. - Fix tests not passing when '@' character is in build path: Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038). - Add util-linux-fix-tests-when-at-symbol-in-path.patch - Disable broken test in IBS (builds fine locally) (bsc#1206740) - added patches [bsc#1197437] fix https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/patch/?id=f4d9018183ff9a6cd6a77bf33461b60570ec7622 + util-linux-flock-limitations.patch - Add upstream patch util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch bsc#1207987 gh#util-linux/util-linux@1d98827edde4 - Properly neutralize escape sequences in wall (util-linux-CVE-2024-28085.patch, bsc#1221831, CVE-2024-28085, and its prerequisites: util-linux-fputs_careful1.patch, util-linux-wall-migrate-to-memstream.patch util-linux-fputs_careful2.patch). - Pre-convert gvim icons, otherwise building vim depends on rsvg-convert -> librsvg -> cargo -> Rust -> LLVM - Cleanup SVG icon, make lines pixel-grid aligned - Correct RPM Group - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Fix for bsc#1231373 / CVE-2024-47814. - Fix for bsc#1229238 / CVE-2024-43374. - update to 9.1.0836 * 9.1.0836: The vimtutor can be improved * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu' * 9.1.0834: tests: 2html test fails * 9.1.0833: CI: recent ASAN changes do not work for indent tests * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal * runtime(doc): update help-toc description * runtime(2html): Make links use color scheme colors in TOhtml * 9.1.0831: 'findexpr' can't be used as lambad or Funcref * Filelist: include helptoc package * runtime(doc): include a TOC Vim9 plugin * Filelist: ignore .git-blame-ignore-revs * 9.1.0830: using wrong highlight group for spaces for popupmenu * runtime(typst): synchronize updates from the upstream typst.vim * git: ignore reformatting commit for git-blame (after v9.1.0829) * 9.1.0829: Vim source code uses a mix of tabs and spaces * 9.1.0828: string_T struct could be used more often * 9.1.0827: CI: tests can be improved * runtime(doc): remove stray sentence in pi_netrw.txt * 9.1.0826: filetype: sway files are not recognized * runtime(doc): Include netrw-gp in TOC * runtime(doc): mention 'iskeyword' at :h charclass() * runtime(doc): update help tags * 9.1.0825: compile error for non-diff builds * runtime(netrw): fix E874 when browsing remote directory which contains `~` character * runtime(doc): update coding style documentation * runtime(debversions): Add plucky (25.04) as Ubuntu release name * 9.1.0824: too many strlen() calls in register.c * 9.1.0823: filetype: Zephyr overlay files not recognized * runtime(doc): Clean up minor formatting issues for builtin functions * runtime(netrw): make :Launch/Open autoloadable * runtime(netrw): fix regression with x mapping on Cygwin * runtime(netrw): fix filetype detection for remote files * 9.1.0822: topline might be changed in diff mode unexpectedly * CI: huge linux builds should also run syntax & indent tests * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument * 9.1.0820: tests: Mac OS tests are too flaky * runtime(awk): Highlight more awk comments in syntax script * runtime(netrw): add missing change for s:redir() * 9.1.0819: tests: using findexpr and imported func not tested * runtime(netrw): improve netrw's open-handling further * runtime(netrw): fix syntax error in netrwPlugin.vim * runtime(netrw): simplify gx file handling * 9.1.0818: some global functions are only used in single files * 9.1.0817: termdebug: cannot evaluate expr in a popup * runtime(defaults): Detect putty terminal and switch to dark background * 9.1.0816: tests: not clear what tests cause asan failures * runtime(doc): Remove some completed items from todo.txt * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position * runtime(syntax-tests): tiny vim fails because of line-continuation * 9.1.0814: mapset() may remove unrelated mapping * 9.1.0813: no error handling with setglobal and number types * 9.1.0812: Coverity warns about dereferencing NULL ptr * 9.1.0811: :find expansion does not consider 'findexpr' * 9.1.0810: cannot easily adjust the |:find| command * 9.1.0809: filetype: petalinux config files not recognized * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll' * 9.1.0807: tests: having 'nolist' in modelines isn't always desired * 9.1.0806: tests: no error check when setting global 'briopt' * 9.1.0805: tests: minor issues in gen_opt_test.vim * 9.1.0804: tests: no error check when setting global 'cc' * 9.1.0803: tests: no error check when setting global 'isk' * 9.1.0802: tests: no error check when setting global 'fdm' to empty value * 9.1.0801: tests: no error check when setting global 'termwinkey' * 9.1.0800: tests: no error check when setting global 'termwinsize' * runtime(doc): :ownsyntax also resets 'spelloptions' * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive * runtime(doc): Fix wrong Mac default options * 9.1.0798: too many strlen() calls in cmdhist.c * 9.1.0797: testing of options can be further improved * 9.1.0796: filetype: libtool files are not recognized * (typst): add folding to typst ftplugin * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke() * 9.1.0795: filetype: Vivado memory info file are not recognized * 9.1.0794: tests: tests may fail on Windows environment * runtime(doc): improve the :colorscheme documentation * 9.1.0793: xxd: -e does add one extra space * 9.1.0792: tests: Test_set_values() is not comprehensive enough * runtime(swayconfig): add flag for bindsym/bindcode to syntax script * 9.1.0791: tests: errors in gen_opt_test.vim are not shown * runtime(compiler): check for compile_commands in build dirs for cppcheck * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib) * runtime(help): Update help syntax * runtime(help): fix end of sentence highlight in code examples * runtime(jinja): Support jinja syntax as secondary filetype * 9.1.0789: tests: ':resize + 5' has invalid space after '+' * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot * 9.1.0787: cursor position changed when using hidden terminal * 9.1.0786: tests: quickfix update test does not test location list * runtime(doc): add some docs for file-watcher programs * CI: uploading failed screendumps still fails on Cirrus CI * 9.1.0785: cannot preserve error position when setting quickfix list * 9.1.0784: there are several problems with python 3.13 * 9.1.0783: 'spell' option setting has problems * 9.1.0782: tests: using wrong neomuttlog file name * runtime(doc): add preview flag to statusline example * 9.1.0781: tests: test_filetype fails * 9.1.0780: MS-Windows: incorrect Win32 error checking * 9.1.0779: filetype: neomuttlog files are not recognized * 9.1.0778: filetype: lf config files are not recognized * runtime(comment): fix commment toggle with mixed tabs & spaces * runtime(misc): Use consistent "Vim script" spelling * runtime(gleam): add ftplugin for gleam files * runtime(doc): link help-writing from write-local-help * 9.1.0777: filetype: Some upstream php files are not recognized * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups * runtime(doc): mention conversion rules for remote_expr() * runtime(tutor): Fix missing :s command in spanish translation section 4.4 * 9.1.0776: test_strftime may fail because of missing TZ data * translation(am): Add Armenian language translation * 9.1.0775: tests: not enough tests for setting options * 9.1.0774: "shellcmdline" doesn't work with getcompletion() * 9.1.0773: filetype: some Apache files are not recognized * 9.1.0772: some missing changes from v9.1.0771 * 9.1.0771: completion attribute hl_group is confusing * 9.1.0770: current command line completion is a bit limited * 9.1.0769: filetype: MLIR files are not recognized * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen * runtime(nasm): Update nasm syntax script * 9.1.0767: A condition is always true in ex_getln.c * runtime(skill): Update syntax file to fix string escapes * runtime(help): highlight CTRL-<Key> correctly * runtime(doc): add missing usr_52 entry to toc * 9.1.0766: too many strlen() calls in ex_getln.c * runtime(doc): correct `vi` registers 1-9 documentation error * 9.1.0765: No test for patches 6.2.418 and 7.3.489 * runtime(spec): set comments and commentstring options * NSIS: Include libgcc_s_sjlj-1.dll again * runtime(doc): clarify the effect of 'startofline' option * 9.1.0764: [security]: use-after-free when closing a buffer * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting * 9.1.0763: tests: cannot run single syntax tests * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly * 9.1.0761: :cd completion fails on Windows with backslash in path * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails * 9.1.0759: screenpos() may return invalid position * runtime(misc): unset compiler in various ftplugins * runtime(doc): update formatting and syntax * runtime(compiler): add cppcheck linter compiler plugin * runtime(doc): Fix style in documents * runtime(doc): Fix to two-space convention in user manual * runtime(comment): consider &tabstop in lines after whitespace indent * 9.1.0758: it's possible to set an invalid key to 'wildcharm' * runtime(java): Manage circularity for every :syn-included syntax file * 9.1.0757: tests: messages files contains ANSI escape sequences * 9.1.0756: missing change from patch v9.1.0754 * 9.1.0755: quickfix list does not handle hardlinks well * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters * runtime(systemd): small fixes to &keywordprg in ftplugin * CI: macos-12 runner is being sunset, switch to 13 * 9.1.0754: fixed order of items in insert-mode completion menu * runtime(comment): commenting might be off by one column * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll' * 9.1.0752: can set 'cedit' to an invalid value * runtime(doc): add `usr` tag to usr_toc.txt * 9.1.0751: Error callback for term_start() not used * 9.1.0750: there are some Win9x legacy references * runtime(java): Recognise the CommonMark form (///) of Javadoc comments * 9.1.0749: filetype: http files not recognized * runtime(comment): fix syntax error * CI: uploading failed screendump tests does not work Cirrus * 9.1.0748: :keep* commmands are sometimes misidentified as :k * runtime(indent): allow matching negative numbers for gnu indent config file * runtime(comment): add gC mapping to (un)comment rest of line * 9.1.0747: various typos in repo found * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals * runtime(doc): reformat gnat example * runtime(doc): reformat ada_standard_types section * 9.1.0745: filetype: bun and deno history files not recognized * runtime(glvs): Correct the tag name of glvs-autoinstal * runtime(doc): include short form for :earlier/:later * runtime(doc): remove completed TODO * 9.1.0744: filetype: notmuch configs are not recognised * 9.1.0743: diff mode does not handle overlapping diffs correctly * runtime(glvs): fix a few issues * runtime(doc): Fix typo in :help :command-modifiers * 9.1.0742: getcmdprompt() implementation can be improved * runtime(docs): update `:set?` command behavior table * runtime(doc): update vim90 to vim91 in docs * runtime(doc): fix typo in :h dos-colors * 9.1.0741: No way to get prompt for input()/confirm() * runtime(doc): fix typo in version9.txt nrformat -> nrformats * runtime(rmd,rrst): 'fex' option not properly restored * runtime(netrw): remove extraneous closing bracket * 9.1.0740: incorrect internal diff with empty file * 9.1.0739: [security]: use-after-free in ex_getln.c * runtime(filetype): tests: Test_filetype_detection() fails * runtime(dist): do not output a message if executable is not found * 9.1.0738: filetype: rapid files are not recognized * runtime(modconf): remove erroneous :endif in ftplugin * runtime(lyrics): support multiple timestamps in syntax script * runtime(java): Optionally recognise _module_ import declarations * runtime(vim): Update base-syntax, improve folding function matches * CI: upload failed screendump tests also for Cirrus * 9.1.0737: tests: screendump tests may require a bit more time * runtime(misc): simplify keywordprg in various ftplugins * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels * runtime(zsh,sh): set and unset compiler in ftplugin * runtime(netrw): using inefficient highlight pattern for 'mf' * 9.1.0736: Unicode tables are outdated * 9.1.0735: filetype: salt files are not recognized * 9.1.0734: filetype: jinja files are not recognized * runtime(zathurarc): add double-click-follow to syntax script * translation(ru): Updated messages translation * translation(it): updated xxd man page * translation(ru): updated xxd man page * 9.1.0733: keyword completion does not work with fuzzy * 9.1.0732: xxd: cannot use -b and -i together * runtime(java): Highlight javaConceptKind modifiers with StorageClass * runtime(doc): reword and reformat how to use defaults.vim * 9.1.0731: inconsistent case sensitive extension matching * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return * runtime(netrw): delete confirmation not strict enough * 9.1.0730: Crash with cursor-screenline and narrow window * 9.1.0729: Wrong cursor-screenline when resizing window * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data * runtime(doc): clarify the effect of the timeout for search()-functions * runtime(idlang): update syntax script * runtime(spec): Recognize epoch when making spec changelog in ftplugin * runtime(spec): add file triggers to syntax script * 9.1.0727: too many strlen() calls in option.c * runtime(make): add compiler/make.vim to reset compiler plugin settings * runtime(java): Recognise all available standard doclet tags * 9.1.0726: not using correct python3 API with dynamic linking * runtime(dosini): Update syntax script, spellcheck comments only * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation * 9.1.0725: filetype: swiftinterface files are not recognized * runtime(pandoc): Update compiler plugin to use actual 'spelllang' * runtime(groff): Add compiler plugin for groff * 9.1.0724: if_python: link error with python 3.13 and stable ABI * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13 * 9.1.0722: crash with large id in text_prop interface * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME * runtime(glvs): update GetLatestVimScripts plugin * runtime(doc): Fix typo in :help :hide text * runtime(doc): buffers can be re-used * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid * runtime(doc): Update version9.txt and mention $MYVIMDIR - Update to 9.1.0718: * v9.1.0718: hard to know the users personal Vim Runtime Directory * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers() Maintainers: fix typo in author name * v9.1.0716: resetting setcellwidth( doesn't update the screen runtime(hcl,terraform): Add runtime files for HCL and Terraform runtime(tmux): Update syntax script * v9.1.0715: Not correctly parsing color names (after v9.1.0709) * v9.1.0714: GuiEnter_Turkish test may fail * v9.1.0713: Newline causes E749 in Ex mode * v9.1.0712: missing dependency of Test_gettext_makefile * v9.1.0711: test_xxd may file when using different xxd * v9.1.0710: popup window may hide part of Command line runtime(vim): Update syntax, improve user-command matching * v9.1.0709: GUIEnter event not found in Turkish locale runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items * v9.1.0708: Recursive window update does not account for reset skipcol runtime(nu): include filetype plugin * v9.1.0707: invalid cursor position may cause a crash * v9.1.0706: test_gettext fails when using shadow dir CI: Install locales-all package * v9.1.0705: Sorting of fuzzy filename completion is not stable translation(pt): update Portuguese/Brazilian menu translation runtime(vim): Update base-syntax, match bracket mark ranges runtime(doc): Update :help :command-complete list * v9.1.0704: inserting with a count is inefficient runtime(doc): use mkdir -p to save a command * v9.1.0703: crash with 2byte encoding and glob2regpat() runtime(hollywood): update syn highlight for If-Then statements and For-In-Loops * v9.1.0702: Patch 9.1.0700 broke CI * v9.1.0701: crash with NFA regex engine when searching for composing chars * v9.1.0700: crash with 2byte encoding and glob2regpat() * v9.1.0699: "dvgo" is not always an inclusive motion runtime(java): Provide support for syntax preview features * v9.1.0698: "Untitled" file not removed when running Test_crash1_3 alone * v9.1.0697: heap-buffer-overflow in ins_typebuf * v9.1.0696: installing runtime files fails when using SHADOWDIR runtime(doc): fix typo * v9.1.0695: test_crash leaves Untitled file around translation(br): Update Brazilian translation translation(pt): Update menu_pt_br * v9.1.0694: matchparen is slow on a long line * v9.1.0693: Configure doesn't show result when not using python3 stable abi * v9.1.0692: Wrong patlen value in ex_substitute() * v9.1.0691: stable-abi may cause segfault on Python 3.11 runtime(vim): Update base-syntax, match :loadkeymap after colon and bar runtime(mane): Improve <Plug>ManBS mapping * v9.1.0690: cannot set special highlight kind in popupmenu translation(pt): Revert and fix wrong Portuguese menu translation files translation(pt): revert Portuguese menu translation translation(br): Update Brazilian translations runtime(vim): Update base-syntax, improve :let-heredoc highlighting * v9.1.0689: buffer-overflow in do_search( with 'rightleft' runtime(vim): Improve heredoc handling for all embedded scripts * v9.1.0688: dereferences NULL pointer in check_type_is_value() * v9.1.0687: Makefile may not install desktop files runtime(man): Fix <Plug>ManBS runtime(java): Make the bundled &foldtext function optional runtime(netrw): Change line on `mx` if command output exists runtime(netrw): Fix `mf`-selected entry highlighting runtime(htmlangular): add html syntax highlighting translation(it): Fix filemode of Italian manpages runtime(doc): Update outdated man.vim plugin information runtime(zip): simplify condition to detect MS-Windows * v9.1.0686: zip-plugin has problems with special characters runtime(pandoc): escape quotes in &errorformat for pandoc translation(it): updated Italian manpage * v9.1.0685: too many strlen( calls in usercmd.c runtime(doc): fix grammar in :h :keeppatterns runtime(pandoc): refine pandoc compiler settings * v9.1.0684: completion is inserted on Enter with "noselect" translation(ru): update man pages * v9.1.0683: mode( returns wrong value with <Cmd> mapping runtime(doc): remove trailing whitespace in cmdline.txt * v9.1.0682: Segfault with uninitialized funcref * v9.1.0681: Analyzing failed screendumps is hard runtime(doc): more clarification for the :keeppatterns needed * v9.1.0680: VMS does not have defined uintptr_t runtime(doc): improve typedchar documentation for KeyInputPre autocmd runtime(dist): verify that executable is in $PATH translation(it): update Italian manpages runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677 runtime(doc): update Makefile and make it portable between GNU and BSD * v9.1.0679: Rename from w_closing to w_locked is incomplete runtime(colors): update colorschemes runtime(vim): Update base-syntax, improve :let-heredoc highlighting runtime(doc): Updating the examples in the xxd manpage translation(ru): Updated uganda.rux runtime(yaml): do not re-indent when commenting out lines * v9.1.0678: use-after-free in alist_add() * v9.1.0677 :keepp does not retain the substitute pattern translation(ja): Update Japanese translations to latest release runtime(netrw): Drop committed trace lines runtime(netrw): Error popup not always used runtime(netrw): ErrorMsg( may throw E121 runtime(tutor): update Makefile and make it portable between GNU and BSD translation: improve the po/cleanup.vim script runtime(lang): update Makefile and make it portable between GNU and BSD * v9.1.0676: style issues with man pages * v9.1.0675: Patch v9.1.0674 causes problems runtime(dosbatch): Show %%i as an argument in syntax file runtime(dosbatch): Add syn-sync to syntax file runtime(sql, mysql): fix E169: Command too recursive with sql_type_default = "mysql" * v9.1.0674: compiling abstract method fails because of missing return runtime(javascript): fix a few issues with syntax higlighting runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var runtime(termdebug): Fix wrong test for balloon feature runtime(doc): Remove mentioning of the voting feature runtime(doc): add help tags for json + markdown global variables * v9.1.0673: too recursive func calls when calling super-class method runtime(syntax-tests): Facilitate the viewing of rendered screendumps runtime(doc): fix a few style issues * v9.1.0672: marker folds may get corrupted on undo * v9.1.0671 Problem: crash with WinNewPre autocommand * v9.1.0670: po file encoding fails on *BSD during make translation(it): Update Italian translation translation: Stop using msgconv * v9.1.0669: stable python ABI not used by default Update .gitignore and .hgignore files * v9.1.0668: build-error with python3.12 and stable ABI translations: Update generated po files * v9.1.0667: Some other options reset curswant unnecessarily when set * v9.1.0666: assert_equal( doesn't show multibyte string correctly runtime(doc): clarify directory of Vim's executable vs CWD * v9.1.0665 :for loop runtime(proto): Add indent script for protobuf filetype * v9.1.0664: console vim did not switch back to main screen on exit runtime(zip): zip plugin does not work with Vim 9.0 * v9.1.0663: zip test still resets 'shellslash' option runtime(zip): use defer to restore old settings runtime(zip): add a generic Message function runtime(zip): increment base version of zip plugin runtime(zip): raise minimum Vim version to * v9.0 runtime(zip): refactor save and restore of options runtime(zip): remove test for fnameescape runtime(zip): use :echomsg instead of :echo runtime(zip): clean up and remove comments * v9.1.0662: filecopy( may return wrong value when readlink( fails * v9.1.0661: the zip plugin is not tested. runtime(zip): Fix for FreeBSD's unzip command runtime(doc): capitalize correctly * v9.1.0660: Shift-Insert does work on old conhost translation(it): update Italian manpage runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr runtime(zip): escape '[' on Unix as well * v9.1.0659: MSVC Makefile is a bit hard to read runtime(doc): fix typo in syntax.txt runtime(doc): -x is only available when compiled with crypt feature * v9.1.0658: Coverity warns about dereferencing NULL pointer. runtime(colors): update Todo highlight in habamax colorscheme * v9.1.0657: MSVC build time can be optimized * v9.1.0656: MSVC Makefile CPU handling can be improved * v9.1.0655: goaccess config file not recognized CI: update clang compiler to version 20 runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore` * v9.1.0654: completion does not respect completeslash with fuzzy * v9.1.0653: Patch v9.1.0648 not completely right * v9.1.0652: too many strlen( calls in syntax.c * v9.1.0651 :append * v9.1.0650: Coverity warning in cstrncmp() * v9.1.0649: Wrong comment for "len" argument of call_simple_func() * v9.1.0648: [security] double-free in dialog_changed() * v9.1.0647: [security] use-after-free in tagstack_clear_entry runtime(doc): re-format tag example lines, mention ctags --list-kinds * v9.1.0646: imported function may not be found runtime(java): Document "g:java_space_errors" and "g:java_comment_strings" runtime(java): Cluster optional group definitions and their group links runtime(java): Tidy up the syntax file runtime(java): Tidy up the documentation for "ft-java-syntax" runtime(colors): update habamax scheme - tweak diff/search/todo colors runtime(nohlsearch): add missing loaded_hlsearch guard runtime(kivy): Updated maintainer info for syntax script Maintainers: Add maintainer for ondir ftplugin + syntax files runtime(netrw): removing trailing slash when copying files in same directory * v9.1.0645: wrong match when searching multi-byte char case-insensitive runtime(html): update syntax script to sync by 250 minlines by default * v9.1.0644: Unnecessary STRLEN( when applying mapping runtime(zip): Opening a remote zipfile don't work runtime(cuda): source c and cpp ftplugins * v9.1.0643: cursor may end up on invalid position * v9.1.0642: Check that mapping rhs starts with lhs fails if not simplified * v9.1.0641: OLE enabled in console version runtime(thrift): add ftplugin, indent and syntax scripts * v9.1.0640: Makefile can be improved * v9.1.0639: channel timeout may wrap around * v9.1.0638: E1510 may happen when formatting a message for smsg() * v9.1.0637: Style issues in MSVC Makefile - Update apparmor.vim to latest version (from AppArmor 4.0.2) - add support for "all" and "userns" rules, and new profile flags - Update to 9.1.0636: * 9.1.0636: filetype: ziggy files are not recognized * 9.1.0635: filetype: SuperHTML template files not recognized * 9.1.0634: Ctrl-P not working by default * 9.1.0633: Compilation warnings with `-Wunused-parameter` * 9.1.0632: MS-Windows: Compiler Warnings Add support for Files-Included in syntax script tweak documentation style a bit * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme * 9.1.0629: Rename of pum hl_group is incomplete * 9.1.0628: MinGW: coverage files are not cleaned up * 9.1.0627: MinGW: build-error when COVERAGE is enabled * 9.1.0626: Vim9: need more tests with null objects include initial filetype plugin * 9.1.0625: tests: test output all translated messages for all translations * 9.1.0624: ex command modifiers not found * 9.1.0623: Mingw: errors when trying to delete non-existing files * 9.1.0622: MS-Windows: mingw-build can be optimized * 9.1.0621: MS-Windows: startup code can be improved * 9.1.0620: Vim9: segfauls with null objects * 9.1.0619: tests: test_popup fails * 9.1.0618: cannot mark deprecated attributes in completion menu * 9.1.0617: Cursor moves beyond first line of folded end of buffer * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles * 9.1.0615: Unnecessary STRLEN() in make_percent_swname() Add single-line comment syntax Add syntax test for comments Update maintainer info * 9.1.0614: tests: screendump tests fail due to recent syntax changes * 9.1.0613: tests: termdebug test may fail and leave file around Update base-syntax, improve :set highlighting Optionally highlight the :: token for method references * 9.1.0612: filetype: deno.lock file not recognized Use delete() for deleting directory escape filename before trying to delete it * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys correctly extract file from zip browser * 9.1.0610: filetype: OpenGL Shading Language files are not detected Fix endless recursion in netrw#Explore() * 9.1.0609: outdated comments in Makefile update syntax script Fix flow mapping key detection Remove orphaned YAML syntax dump files * 9.1.0608: Coverity warns about a few potential issues Update syntax script and remove syn sync * 9.1.0607: termdebug: uses inconsistent style * 9.1.0606: tests: generated files may cause failure in test_codestyle * 9.1.0605: internal error with fuzzy completion * 9.1.0604: popup_filter during Press Enter prompt seems to hang translation: Update Serbian messages translation * 9.1.0603: filetype: use correct extension for Dracula * 9.1.0602: filetype: Prolog detection can be improved fix more inconsistencies in assert function docs * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit Update base-syntax, improve :map highlighting * 9.1.0600: Unused function and unused error constants * 9.1.0599: Termdebug: still get E1023 when specifying arguments correct wrong comment options fix typo "a xterm" -> "an xterm" * 9.1.0598: fuzzy completion does not work with default completion * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key * 9.1.0596: filetype: devscripts config files are not recognized gdb file/folder check is now performed only in CWD. quote filename arguments using double quotes update syntax to SDC-standard 2.1 minor updates. Cleanup :match and :loadkeymap syntax test files Update base-syntax, match types in Vim9 variable declarations * 9.1.0595: make errors out with the po Makefile * 9.1.0594: Unnecessary redraw when setting 'winfixbuf' using wrong highlight for UTF-8 include simple syntax plugin * 9.1.0593: filetype: Asymptote files are not recognized add recommended indent options to ftplugin add recommended indent options to ftplugin add recommended indent options to ftplugin * 9.1.0592: filetype: Mediawiki files are not recognized * 9.1.0591: filetype: *.wl files are not recognized * 9.1.0590: Vim9: crash when accessing getregionpos() return value 'cpoptions': Include "z" in the documented default * 9.1.0589: vi: d{motion} and cw work differently than expected update included colorschemes grammar fixes in options.txt - Add "Keywords" to gvim.desktop to make searching for gvim easier - Removed patches, as they're no longer required (refreshing them deleted their contents): * vim-7.3-help_tags.patch * vim-7.4-highlight_fstab.patch - Reorganise all applied patches in the spec file. - Update to 9.1.0588: * 9.1.0588: The maze program no longer compiles on newer clang runtime(typst): Add typst runtime files * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky * 9.1.0586: ocaml runtime files are outdated runtime(termdebug): fix a few issues * 9.1.0585: tests: test_cpoptions leaves swapfiles around * 9.1.0584: Warning about redeclaring f_id() non-static runtime(doc): Add hint how to load termdebug from vimrc runtime(doc): document global insert behavior * 9.1.0583: filetype: *.pdf_tex files are not recognized * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode * 9.1.0581: Various lines are indented inconsistently * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode * 9.1.0579: Ex command is still executed after giving E1247 * 9.1.0578: no tests for :Tohtml * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim * 9.1.0576: tests: still an issue with test_gettext_make * 9.1.0575: Wrong comments in alt_tabpage() * 9.1.0574: ex: wrong handling of commands after bar runtime(doc): add a note for netrw bug reports * 9.1.0573: ex: no implicit print for single addresses runtime(vim): make &indentexpr available from the outside * 9.1.0572: cannot specify tab page closing behaviour runtime(doc): remove obsolete Ex insert behavior * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky runtime(logindefs): update syntax with new keywords * 9.1.0570: tests: test_gettext_make can be improved runtime(filetype): Fix Prolog file detection regex * 9.1.0569: fnamemodify() treats ".." and "../" differently runtime(mojo): include mojo ftplugin and indent script * 9.1.0568: Cannot expand paths from 'cdpath' setting * 9.1.0567: Cannot use relative paths as findfile() stop directories * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash * 9.1.0565: Stop directory doesn't work properly in 'tags' * 9.1.0564: id() can be faster * 9.1.0563: Cannot process any Key event * 9.1.0562: tests: inconsistency in test_findfile.vim runtime(fstab): Add missing keywords to fstab syntax * 9.1.0561: netbeans: variable used un-initialized (Coverity) * 9.1.0560: bindtextdomain() does not indicate an error * 9.1.0559: translation of vim scripts can be improved * 9.1.0558: filetype: prolog detection can be improved * 9.1.0557: moving in the buffer list doesn't work as documented runtime(doc): fix inconsistencies in :h file-searching * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages runtime(htmlangular): correct comment * 9.1.0555: filetype: angular ft detection is still problematic * 9.1.0554: :bw leaves jumplist and tagstack data around * 9.1.0553: filetype: *.mcmeta files are not recognized * 9.1.0552: No test for antlr4 filetype * 9.1.0551: filetype: htmlangular files are not properly detected * 9.1.0550: filetype: antlr4 files are not recognized * 9.1.0549: fuzzycollect regex based completion not working as expected runtime(doc): autocmd_add() accepts a list not a dict * 9.1.0548: it's not possible to get a unique id for some vars runtime(tmux): Update syntax script * 9.1.0547: No way to get the arity of a Vim function * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A runtime(hlsplaylist): include hlsplaylist ftplugin file runtime(doc): fix typo in :h ft-csv-syntax runtime(doc): Correct shell command to get $VIMRUNTIME into shell * 9.1.0545: MSVC conversion warning * 9.1.0544: filetype: ldapconf files are not recognized runtime(cmakecache): include cmakecache ftplugin file runtime(lex): include lex ftplugin file runtime(yacc): include yacc ftplugin file runtime(squirrel): include squirrel ftplugin file runtime(objcpp): include objcpp ftplugin file runtime(tf): include tf ftplugin file runtime(mysql): include mysql ftplugin file runtime(javacc): include javacc ftplugin file runtime(cabal): include cabal ftplugin file runtime(cuda): include CUDA ftplugin file runtime(editorconfig): include editorconfig ftplugin file runtime(kivy): update kivy syntax, include ftplugin runtime(syntax-tests): Stop generating redundant "*_* 99.dump" files * 9.1.0543: Behavior of CursorMovedC is strange runtime(vim): Update base-syntax, improve :match command highlighting * 9.1.0542: Vim9: confusing string() output for object functions * 9.1.0541: failing test with Vim configured without channel * 9.1.0540: Unused assignment in sign_define_cmd() runtime(doc): add page-scrolling keys to index.txt runtime(doc): add reference to xterm-focus-event from FocusGained/Lost * 9.1.0539: Not enough tests for what v9.1.0535 fixed runtime(doc): clarify how to re-init csv syntax file * 9.1.0538: not possible to assign priority when defining a sign * 9.1.0537: signed number detection for CTRL-X/A can be improved * 9.1.0536: filetype: zone files are not recognized * 9.1.0535: newline escape wrong in ex mode runtime(man): honor cmd modifiers before `g:ft_man_open_mode` runtime(man): use `nnoremap` to map to Ex commands * 9.1.0534: completion wrong with fuzzy when cycling back to original runtime(syntax-tests): Abort and report failed cursor progress runtime(syntax-tests): Introduce self tests for screen dumping runtime(syntax-tests): Clear and redraw the ruler line with the shell info runtime(syntax-tests): Allow for folded and wrapped lines in syntax test files * 9.1.0533: Vim9: need more tests for nested objects equality CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries runtime(doc): Remove wrong help tag CTRL-SHIFT-CR * 9.1.0532: filetype: Cedar files not recognized runtime(doc): document further keys that scroll page up/down * 9.1.0531: resource leak in mch_get_random() runtime(tutor): Fix wrong spanish translation runtime(netrw): fix remaining case of register clobber * 9.1.0530: xxd: MSVC warning about non-ASCII character * 9.1.0529: silent! causes following try/catch to not work runtime(rust): use shiftwidth() in indent script * 9.1.0528: spell completion message still wrong in translations * 9.1.0527: inconsistent parameter in Makefiles for Vim executable * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config * 9.1.0525: Right release selects immediately when pum is truncated. * 9.1.0524: the recursive parameter in the *_equal functions can be removed runtime(termdebug): Add Deprecation warnings * 9.1.0523: Vim9: cannot downcast an object * 9.1.0522: Vim9: string(object) hangs for recursive references * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13 * 9.1.0520: Vim9: incorrect type checking for modifying lists runtime(manpager): avoid readonly prompt * 9.1.0519: MS-Windows: libvterm compilation can be optimized * 9.1.0518: initialize the random buffer can be improved * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak runtime(terraform): Add filetype plugin for terraform runtime(dockerfile): enable spellchecking of comments in syntax script runtime(doc): rename variable for pandoc markdown support runtime(doc): In builtin overview use {buf} as param for appendbufline/setbufline runtime(doc): clarify, that register 1-* 9 will always be shifted runtime(netrw): save and restore register 0-* 9, a and unnamed runtime(termdebug): Refactored StartDebug_term and EndDebug functions runtime(java): Compose "g:java_highlight_signature" and "g:java_highlight_functions" * 9.1.0516: need more tests for nested dicts and list comparision * 9.1.0515: Vim9: segfault in object_equal() * 9.1.0514: Vim9: issue with comparing objects recursively runtime(termdebug): Change some variables to Enums runtime(vim): Update base-syntax, fix function tail comments * 9.1.0513: Vim9: segfault with object comparison - Update to 9.1.0512: * Mode message for spell completion doesn't match allowed keys * CursorMovedC triggered wrongly with setcmdpos() * update runtime files * CI: test_gettext fails on MacOS14 + MSVC Win * not possible to translate Vim script messages * termdebug plugin can be further improved * add gomod filetype plugin * hard to detect cursor movement in the command line * Optionally highlight parameterised types * filetype: .envrc & .prettierignore not recognized * filetype: Faust files are not recognized * inner-tag textobject confused about ">" in attributes * cannot use fuzzy keyword completion * Remove the group exclusion list from @javaTop * wrong return type for execute() function * MS-Windows: too much legacy code * too complicated mapping restore in termdebug * simplify mapping * cannot switch buffer in a popup * MS-Windows: doesn't handle symlinks properly * getcmdcompltype() interferes with cmdline completion * termdebug can be further improved * update htmldjango detection * Improve Turkish documentation * include a simple csv filetype and syntax plugin * include the the simple nohlsearch package * matched text is highlighted case-sensitively * Matched text isn't highlighted in cmdline pum * Fix typos in several documents * clarify when text properties are cleared * improve the vim-shebang example * revert unintended formatting changes for termdebug * Add a config variable for commonly used compiler options * Wrong matched text highlighted in pum with 'rightleft' * bump length of character references in syntax script * properly check mapping variables using null_dict * fix KdlIndent and kdlComment in indent script * Test for patch 9.1.0489 doesn't fail without the fix * Fold multi-line comments with the syntax kind of &fdm * using wrong type for PlaceSign() * filetype: Vim-script files not detected by shebang line * revert unintended change to zip#Write() * add another tag for vim-shebang feature * Cmdline pum doesn't work properly with 'rightleft' * minor style problems with patch 9.1.0487 * default completion may break with fuzzy * Wrong padding for pum "kind" with 'rightleft' * Update base-syntax, match shebang lines * MS-Windows: handle files with spaces properly * Restore HTML syntax file tests * completed item not update on fuzzy completion * filetype: Snakemake files are not recognized * make TermDebugSendCommand() a global function again * close all buffers in the same way * Matched text shouldn't be highlighted in "kind" and "menu" * fix wrong helptag for :defer * Update base-syntax, match :sleep arg * include Georgian keymap * Sorting of completeopt+=fuzzy is not stable * correctly test for windows in NetrwGlob() * glob() on windows fails with [] in directory name * rewrite mkdir() doc and simplify {flags} meaning * glob() not sufficiently tested * update return type for job_info() * termdebug plugin needs more love * correct return types for job_start() and job_status() * Update base-syntax, match :catch and :throw args * Include element values in non-marker annotations * Vim9: term_getjob() throws an exception on error * fuzzy string matching executed when not needed * fuzzy_match_str_with_pos() does unnecessary list operations * restore description of "$" in col() and virtcol() * deduplicate getpos(), line(), col(), virtcol() * Update g:vimsyn_comment_strings dump file tests * Use string interpolation instead of string concat * potential deref of NULL pointer in fuzzy_match_str_with_pos * block_editing errors out when using <enter> * Update base-syntax, configurable comment string highlighting * fix typos in syntax.txt * Cannot see matched text in popup menu * Update base-syntax, match multiline continued comments * clarify documentation for "v" position at line() * cmod_split modifier is always reset in term_start() * remove line-continuation characters * use shiftwidth() instead of &tabstop in indent script * Remove orphaned screen dump files * include syntax, indent and ftplugin files * CI: Test_ColonEight() fails on github runners * add missing Enabled field in syntax script * basic svelte ftplugin file * term_start() does not clear vertical modifier * fix mousemodel restoration by comparing against null_string * Added definitions of Vim scripts and plugins * Exclude lambda expressions from _when_ _switch-case_ label clauses * Fix saved_mousemodel check * Inconsistencies between functions for option flags * Crash when using autocmd_get() after removing event inside autocmd * Fix small style issues * add return type info for Vim function descriptions * Update Italian Vim manpage * disable the q mapping * Change 'cms' for C++ to '// %s' * fix type mismatch error * Fix wrong email address * convert termdebug plugin to Vim9 script - Update to 9.1.0470: * tests Test_ColonEight_MultiByte() fails sporadically * Cannot have buffer-local value for 'completeopt' * GvimExt does not consult HKEY_CURRENT_USER * typos in some comments * runtime(vim): Update base-syntax, allow whitespace before :substitute pattern * Missing comments for fuzzy completion * runtime(man): update Vim manpage * runtime(comment): clarify the usage of 'commentstring' option value * runtime(doc): clarify how fuzzy 'completeopt' should work * runtime(netrw): prevent accidental data loss * missing filecopy() function * no whitespace padding in commentstring option in ftplugins * no fuzzy-matching support for insert-completion * eval5() and eval7 are too complex * too many strlen() calls in drawline.c * filetype lintstagedrc files are not recognized * Vim9 import autoload does not work with symlink * Coverity complains about division by zero * tests test_gui fails on Wayland * Left shift is incorrect with vartabstop and shiftwidth=0 * runtime(doc): clarify 'shortmess' flag "S" * MS-Windows compiler warning for size_t to int conversion * runtime(doc): include some vim9 script examples in the help * minor issues in test_filetype with rasi test * filetype rasi files are not recognized * runtime(java): Improve the matching of lambda expressions * Configure checks for libelf unnecessarily * No test for escaping '<' with shellescape() * check.vim complains about overlong comment lines * translation(it): Update Italian translation * evalc. code too complex * MS-Windows Compiler warnings - Update to 9.1.0448: * compiler warning in eval.c * remove remaining css code * Add ft_hare.txt to Reference Manual TOC * re-generate vim syntax from generator * fix syntax vim bug * completion may be wrong when deleting all chars * getregionpos() inconsistent for partly-selected multibyte char * fix highlighting nested and escaped quotes in string props * remove the indent plugin since it has too many issues * update Debian runtime files * Coverity warning after 9.1.0440 * Not enough tests for getregion() with multibyte chars * Can't use blockwise selection with width for getregion() * update outdated syntax files * fix floating_modifier highlight * hare runtime files outdated * getregionpos() can't properly indicate positions beyond eol * function get_lval() is too long * Cannot filter the history * Wrong Ex command executed when :g uses '?' as delimiter * support floating_modifier none; revert broken highlighting * Motif requires non-const char pointer for XPM data * Crash when using '?' as separator for :s * filetype: cygport files are not recognized * make errors trying to access autoload/zig * Wrong yanking with exclusive selection and ve=all * add missing help tags file * Ancient XPM preprocessor hack may cause build errors * include basic rescript ftplugin file * eval.c is too long * getregionpos() doesn't handle one char selection * check for gdb file/dir before using as buffer name * refactor zig ftplugin, remove auto format * Coverity complains about eval.c refactor * Tag guessing leaves wrong search history with very short names * some issues with termdebug mapping test * update matchit plugin to v1.20 * too many strlen() calls in search.c * set commentstring option * update vb indent plugin as vim9script * filetype: purescript files are not recognized * filetype: slint files are not recognized * basic nim ftplugin file for comments * Add Arduino ftplugin and indent files * include basic typst ftplugin file * include basic prisma ftplugin file * include basic v ftplugin for comment support * getregionpos() wrong with blockwise mode and multibyte * function echo_string_core() is too long * hyprlang files are not recognized * add basic dart ftplugin file * basic ftplugin file for graphql * mention comment plugin at :h 'commentstring' * set commentstring for sql files in ftplugin * :browse oldfiles prompts even with single entry * eval.c not sufficiently tested * clarify why E195 is returned * clarify temporary file clean up * fix :NoMatchParen not working * Cannot move to previous/next rare word * add basic ftplugin file for sshdconfig * if_py: find_module has been removed in Python 3.12.0a7 * some screen dump tests can be improved * Some functions are not tested * clarify instal instructions for comment package * Unable to leave long line with 'smoothscroll' and 'scrolloff' * fix typo in vim9script help file * Remove trailing spaces * clarify {special} argument for shellescape() - update to 9.1.0413 * smoothscroll may cause infinite loop * add missing entries for the keys CTRL-W g<Tab> and <C-Tab> * update vi_diff.txt: add default value for 'flash' * typo in regexp_bt.c in DEBUG code * allow indented commands * Fix wrong define regex in ftplugin * Filter out non-Latin-1 characters for syntax tests * prefer scp over pscp * fix typo in usr_52.txt * too long functions in eval.c * warning about uninitialized variable * too many strlen() calls in the regexp engine * E16 fix, async keyword support for define * Stuck with long line and half-page scrolling * Divide by zero with getmousepos() and 'smoothscroll' * update and remove some invalid links * update translation of xxd manpage * Recursively delete directories by default with netrw delete command * Strive to remain compatible for at least Vim 7.0 * tests: xxd buffer overflow fails on 32-bit * Stop handpicking syntax groups for @javaTop * [security] xxd: buffer-overflow with specific flags * Vim9: not able to import file from start dir * filetype: mdd files detected as zsh filetype * filetype: zsh module files are not recognized * Remove hardcoded private.ppk logic from netrw * Vim9: confusing error message for unknown type * block_editing errors out when using del * add new items to scripts section in syntax plugin * Vim9: imported vars are not properly type checked * Wrong display with 'smoothscroll' when changing quickfix list * filetype: jj files are not recognized * getregionpos() may leak memory on error * The CODEOWNERS File is not useful * Remove and cleanup Win9x legacy from netrw * add MsgArea to 'highlight' option description * Cannot get a list of positions describing a region * Fix digit separator in syntax script for octals and floats * Update link to Wikipedia Vi page * clear $MANPAGER in ftplugin before shelling out * Fix typos in help documents * 'viewdir' not respecting $XDG_CONFIG_HOME * tests: Vim9 debug tests may be flaky * correct getscriptinfo() example * Vim9: could improve testing * test_sound fails on macos-12 * update Serbian menu * update Slovak menu * update Slovenian menu * update Portuguese menu * update Dutch menu * update Korean menu * update Icelandic menu * update Czech menu * update Afrikaans menu * update German menu * filetype: inko files are not recognized * filetype: templ files are not recognized * cursor() and getregion() don't handle v:maxcol well * Vim9: null value tests not sufficient * update Catalan menu * filetype: stylus files not recognized * update spanish menu localization * regenerate helptags * Vim9: crash with null_class and null_object * Add tags about lazyloading of menu * tests: vt420 terminfo entry may not be found * filetype: .out files recognized as tex files * filetype: Kbuild files are not recognized * cbuffer and similar commands don't accept a range * Improve the recognition of the "indent" method declarations * Fix a typo in usr_30.txt * remove undefined var s:save_cpoptions and add include setting * missing setlocal in indent plugin * Calculating line height for unnecessary amount of lines * improve syntax file performance * There are a few typos * Vim9: no comments allowed after class vars * CI: remove trailing white space in documentation * Formatting text wrong when 'breakindent' is set * Add oracular (24.10) as Ubuntu release name * Vim9: Trailing commands after class/enum keywords ignored * tests: 1-second delay after Test_BufEnter_botline() * update helptags for jq syntax * include syntax, ftplugin and compiler plugin * fix typo synconcealend -> synconcealed * include a simple comment toggling plugin * wrong botline in BufEnter * clarify syntax vs matching mechanism * fix undefined variable in indent plugin * ops.c code uses too many strlen() calls * Calling CLEAR_FIELD() on the same struct twice * Vim9: compile_def_function() still too long * Update Serbian messages * clarify the effect of setting the shell to powershell * Improve the recognition of the "style" method declarations * Vim9: problem when importing autoloaded scripts * compile_def_function is too long * filetype: ondir files are not recognized * Crash when typing many keys with D- modifier * tests: test_vim9_builtin is a bit slow * update documentation * change the download URL of "libsodium" * tests: test_winfixbuf is a bit slow * Add filetype, syntax and indent plugin for Astro * expanding rc config files does not work well * Vim9: vim9type.c is too complicated * Vim9: does not handle autoloaded variables well * minor spell fix in starting.txt * wrong drawing in GUI with setcellwidth() * Add include and suffixesadd * Page scrolling should place cursor at window boundaries * align command line table * minor fixes to starting.txt * fix comment definition in filetype plugin * filetype: flake.lock files are not recognized * runtime(uci): No support for uci file types * Support "g:ftplugin_java_source_path" with archived files * tests: Test_autoload_import_relative_compiled fails on Windows * Finding cmd modifiers and cmdline-specials is inefficient * No test that completing a partial mapping clears 'showcmd' * tests: test_vim9_dissamble may fail * Vim9: need static type for typealias * X11 does not ignore smooth scroll event * A few typos in test_xdg when testing gvimrc * Patch v9.1.0338 fixed sourcing a script with import * Problem: gvimrc not sourced from XDG_CONFIG_HOME * Cursor wrong after using setcellwidth() in terminal * 'showcmd' wrong for partial mapping with multibyte * tests: test_taglist fails when 'helplang' contains non-english * Problem: a few memory leaks are found * Problem: Error with matchaddpos() and empty list * tests: xdg test uses screen dumps * Vim9: import through symlinks not correctly handled * Missing entry for XDG vimrc file in :version * tests: typo in test_xdg * runtime(i3config/swayconfig): update syntax scripts * document pandoc compiler and enable configuring arguments * String interpolation fails for List type * No test for highlight behavior with 'ambiwidth' * tests: test_xdg fails on the appimage repo * tests: some assert_equal() calls have wrong order of args * make install does not install all files * runtime(doc): fix typos in starting.txt - Pre-convert gvim icons, otherwise building vim depends on rsvg-convert -> librsvg -> cargo -> Rust -> LLVM - Cleanup SVG icon, make lines pixel-grid aligned - Correct RPM Group - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Fix for bsc#1231373 / CVE-2024-47814. - Fix for bsc#1229238 / CVE-2024-43374. - update to 9.1.0836 * 9.1.0836: The vimtutor can be improved * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu' * 9.1.0834: tests: 2html test fails * 9.1.0833: CI: recent ASAN changes do not work for indent tests * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal * runtime(doc): update help-toc description * runtime(2html): Make links use color scheme colors in TOhtml * 9.1.0831: 'findexpr' can't be used as lambad or Funcref * Filelist: include helptoc package * runtime(doc): include a TOC Vim9 plugin * Filelist: ignore .git-blame-ignore-revs * 9.1.0830: using wrong highlight group for spaces for popupmenu * runtime(typst): synchronize updates from the upstream typst.vim * git: ignore reformatting commit for git-blame (after v9.1.0829) * 9.1.0829: Vim source code uses a mix of tabs and spaces * 9.1.0828: string_T struct could be used more often * 9.1.0827: CI: tests can be improved * runtime(doc): remove stray sentence in pi_netrw.txt * 9.1.0826: filetype: sway files are not recognized * runtime(doc): Include netrw-gp in TOC * runtime(doc): mention 'iskeyword' at :h charclass() * runtime(doc): update help tags * 9.1.0825: compile error for non-diff builds * runtime(netrw): fix E874 when browsing remote directory which contains `~` character * runtime(doc): update coding style documentation * runtime(debversions): Add plucky (25.04) as Ubuntu release name * 9.1.0824: too many strlen() calls in register.c * 9.1.0823: filetype: Zephyr overlay files not recognized * runtime(doc): Clean up minor formatting issues for builtin functions * runtime(netrw): make :Launch/Open autoloadable * runtime(netrw): fix regression with x mapping on Cygwin * runtime(netrw): fix filetype detection for remote files * 9.1.0822: topline might be changed in diff mode unexpectedly * CI: huge linux builds should also run syntax & indent tests * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument * 9.1.0820: tests: Mac OS tests are too flaky * runtime(awk): Highlight more awk comments in syntax script * runtime(netrw): add missing change for s:redir() * 9.1.0819: tests: using findexpr and imported func not tested * runtime(netrw): improve netrw's open-handling further * runtime(netrw): fix syntax error in netrwPlugin.vim * runtime(netrw): simplify gx file handling * 9.1.0818: some global functions are only used in single files * 9.1.0817: termdebug: cannot evaluate expr in a popup * runtime(defaults): Detect putty terminal and switch to dark background * 9.1.0816: tests: not clear what tests cause asan failures * runtime(doc): Remove some completed items from todo.txt * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position * runtime(syntax-tests): tiny vim fails because of line-continuation * 9.1.0814: mapset() may remove unrelated mapping * 9.1.0813: no error handling with setglobal and number types * 9.1.0812: Coverity warns about dereferencing NULL ptr * 9.1.0811: :find expansion does not consider 'findexpr' * 9.1.0810: cannot easily adjust the |:find| command * 9.1.0809: filetype: petalinux config files not recognized * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll' * 9.1.0807: tests: having 'nolist' in modelines isn't always desired * 9.1.0806: tests: no error check when setting global 'briopt' * 9.1.0805: tests: minor issues in gen_opt_test.vim * 9.1.0804: tests: no error check when setting global 'cc' * 9.1.0803: tests: no error check when setting global 'isk' * 9.1.0802: tests: no error check when setting global 'fdm' to empty value * 9.1.0801: tests: no error check when setting global 'termwinkey' * 9.1.0800: tests: no error check when setting global 'termwinsize' * runtime(doc): :ownsyntax also resets 'spelloptions' * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive * runtime(doc): Fix wrong Mac default options * 9.1.0798: too many strlen() calls in cmdhist.c * 9.1.0797: testing of options can be further improved * 9.1.0796: filetype: libtool files are not recognized * (typst): add folding to typst ftplugin * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke() * 9.1.0795: filetype: Vivado memory info file are not recognized * 9.1.0794: tests: tests may fail on Windows environment * runtime(doc): improve the :colorscheme documentation * 9.1.0793: xxd: -e does add one extra space * 9.1.0792: tests: Test_set_values() is not comprehensive enough * runtime(swayconfig): add flag for bindsym/bindcode to syntax script * 9.1.0791: tests: errors in gen_opt_test.vim are not shown * runtime(compiler): check for compile_commands in build dirs for cppcheck * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib) * runtime(help): Update help syntax * runtime(help): fix end of sentence highlight in code examples * runtime(jinja): Support jinja syntax as secondary filetype * 9.1.0789: tests: ':resize + 5' has invalid space after '+' * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot * 9.1.0787: cursor position changed when using hidden terminal * 9.1.0786: tests: quickfix update test does not test location list * runtime(doc): add some docs for file-watcher programs * CI: uploading failed screendumps still fails on Cirrus CI * 9.1.0785: cannot preserve error position when setting quickfix list * 9.1.0784: there are several problems with python 3.13 * 9.1.0783: 'spell' option setting has problems * 9.1.0782: tests: using wrong neomuttlog file name * runtime(doc): add preview flag to statusline example * 9.1.0781: tests: test_filetype fails * 9.1.0780: MS-Windows: incorrect Win32 error checking * 9.1.0779: filetype: neomuttlog files are not recognized * 9.1.0778: filetype: lf config files are not recognized * runtime(comment): fix commment toggle with mixed tabs & spaces * runtime(misc): Use consistent "Vim script" spelling * runtime(gleam): add ftplugin for gleam files * runtime(doc): link help-writing from write-local-help * 9.1.0777: filetype: Some upstream php files are not recognized * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups * runtime(doc): mention conversion rules for remote_expr() * runtime(tutor): Fix missing :s command in spanish translation section 4.4 * 9.1.0776: test_strftime may fail because of missing TZ data * translation(am): Add Armenian language translation * 9.1.0775: tests: not enough tests for setting options * 9.1.0774: "shellcmdline" doesn't work with getcompletion() * 9.1.0773: filetype: some Apache files are not recognized * 9.1.0772: some missing changes from v9.1.0771 * 9.1.0771: completion attribute hl_group is confusing * 9.1.0770: current command line completion is a bit limited * 9.1.0769: filetype: MLIR files are not recognized * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen * runtime(nasm): Update nasm syntax script * 9.1.0767: A condition is always true in ex_getln.c * runtime(skill): Update syntax file to fix string escapes * runtime(help): highlight CTRL-<Key> correctly * runtime(doc): add missing usr_52 entry to toc * 9.1.0766: too many strlen() calls in ex_getln.c * runtime(doc): correct `vi` registers 1-9 documentation error * 9.1.0765: No test for patches 6.2.418 and 7.3.489 * runtime(spec): set comments and commentstring options * NSIS: Include libgcc_s_sjlj-1.dll again * runtime(doc): clarify the effect of 'startofline' option * 9.1.0764: [security]: use-after-free when closing a buffer * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting * 9.1.0763: tests: cannot run single syntax tests * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly * 9.1.0761: :cd completion fails on Windows with backslash in path * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails * 9.1.0759: screenpos() may return invalid position * runtime(misc): unset compiler in various ftplugins * runtime(doc): update formatting and syntax * runtime(compiler): add cppcheck linter compiler plugin * runtime(doc): Fix style in documents * runtime(doc): Fix to two-space convention in user manual * runtime(comment): consider &tabstop in lines after whitespace indent * 9.1.0758: it's possible to set an invalid key to 'wildcharm' * runtime(java): Manage circularity for every :syn-included syntax file * 9.1.0757: tests: messages files contains ANSI escape sequences * 9.1.0756: missing change from patch v9.1.0754 * 9.1.0755: quickfix list does not handle hardlinks well * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters * runtime(systemd): small fixes to &keywordprg in ftplugin * CI: macos-12 runner is being sunset, switch to 13 * 9.1.0754: fixed order of items in insert-mode completion menu * runtime(comment): commenting might be off by one column * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll' * 9.1.0752: can set 'cedit' to an invalid value * runtime(doc): add `usr` tag to usr_toc.txt * 9.1.0751: Error callback for term_start() not used * 9.1.0750: there are some Win9x legacy references * runtime(java): Recognise the CommonMark form (///) of Javadoc comments * 9.1.0749: filetype: http files not recognized * runtime(comment): fix syntax error * CI: uploading failed screendump tests does not work Cirrus * 9.1.0748: :keep* commmands are sometimes misidentified as :k * runtime(indent): allow matching negative numbers for gnu indent config file * runtime(comment): add gC mapping to (un)comment rest of line * 9.1.0747: various typos in repo found * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals * runtime(doc): reformat gnat example * runtime(doc): reformat ada_standard_types section * 9.1.0745: filetype: bun and deno history files not recognized * runtime(glvs): Correct the tag name of glvs-autoinstal * runtime(doc): include short form for :earlier/:later * runtime(doc): remove completed TODO * 9.1.0744: filetype: notmuch configs are not recognised * 9.1.0743: diff mode does not handle overlapping diffs correctly * runtime(glvs): fix a few issues * runtime(doc): Fix typo in :help :command-modifiers * 9.1.0742: getcmdprompt() implementation can be improved * runtime(docs): update `:set?` command behavior table * runtime(doc): update vim90 to vim91 in docs * runtime(doc): fix typo in :h dos-colors * 9.1.0741: No way to get prompt for input()/confirm() * runtime(doc): fix typo in version9.txt nrformat -> nrformats * runtime(rmd,rrst): 'fex' option not properly restored * runtime(netrw): remove extraneous closing bracket * 9.1.0740: incorrect internal diff with empty file * 9.1.0739: [security]: use-after-free in ex_getln.c * runtime(filetype): tests: Test_filetype_detection() fails * runtime(dist): do not output a message if executable is not found * 9.1.0738: filetype: rapid files are not recognized * runtime(modconf): remove erroneous :endif in ftplugin * runtime(lyrics): support multiple timestamps in syntax script * runtime(java): Optionally recognise _module_ import declarations * runtime(vim): Update base-syntax, improve folding function matches * CI: upload failed screendump tests also for Cirrus * 9.1.0737: tests: screendump tests may require a bit more time * runtime(misc): simplify keywordprg in various ftplugins * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels * runtime(zsh,sh): set and unset compiler in ftplugin * runtime(netrw): using inefficient highlight pattern for 'mf' * 9.1.0736: Unicode tables are outdated * 9.1.0735: filetype: salt files are not recognized * 9.1.0734: filetype: jinja files are not recognized * runtime(zathurarc): add double-click-follow to syntax script * translation(ru): Updated messages translation * translation(it): updated xxd man page * translation(ru): updated xxd man page * 9.1.0733: keyword completion does not work with fuzzy * 9.1.0732: xxd: cannot use -b and -i together * runtime(java): Highlight javaConceptKind modifiers with StorageClass * runtime(doc): reword and reformat how to use defaults.vim * 9.1.0731: inconsistent case sensitive extension matching * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return * runtime(netrw): delete confirmation not strict enough * 9.1.0730: Crash with cursor-screenline and narrow window * 9.1.0729: Wrong cursor-screenline when resizing window * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data * runtime(doc): clarify the effect of the timeout for search()-functions * runtime(idlang): update syntax script * runtime(spec): Recognize epoch when making spec changelog in ftplugin * runtime(spec): add file triggers to syntax script * 9.1.0727: too many strlen() calls in option.c * runtime(make): add compiler/make.vim to reset compiler plugin settings * runtime(java): Recognise all available standard doclet tags * 9.1.0726: not using correct python3 API with dynamic linking * runtime(dosini): Update syntax script, spellcheck comments only * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation * 9.1.0725: filetype: swiftinterface files are not recognized * runtime(pandoc): Update compiler plugin to use actual 'spelllang' * runtime(groff): Add compiler plugin for groff * 9.1.0724: if_python: link error with python 3.13 and stable ABI * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13 * 9.1.0722: crash with large id in text_prop interface * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME * runtime(glvs): update GetLatestVimScripts plugin * runtime(doc): Fix typo in :help :hide text * runtime(doc): buffers can be re-used * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid * runtime(doc): Update version9.txt and mention $MYVIMDIR - Update to 9.1.0718: * v9.1.0718: hard to know the users personal Vim Runtime Directory * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers() Maintainers: fix typo in author name * v9.1.0716: resetting setcellwidth( doesn't update the screen runtime(hcl,terraform): Add runtime files for HCL and Terraform runtime(tmux): Update syntax script * v9.1.0715: Not correctly parsing color names (after v9.1.0709) * v9.1.0714: GuiEnter_Turkish test may fail * v9.1.0713: Newline causes E749 in Ex mode * v9.1.0712: missing dependency of Test_gettext_makefile * v9.1.0711: test_xxd may file when using different xxd * v9.1.0710: popup window may hide part of Command line runtime(vim): Update syntax, improve user-command matching * v9.1.0709: GUIEnter event not found in Turkish locale runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items * v9.1.0708: Recursive window update does not account for reset skipcol runtime(nu): include filetype plugin * v9.1.0707: invalid cursor position may cause a crash * v9.1.0706: test_gettext fails when using shadow dir CI: Install locales-all package * v9.1.0705: Sorting of fuzzy filename completion is not stable translation(pt): update Portuguese/Brazilian menu translation runtime(vim): Update base-syntax, match bracket mark ranges runtime(doc): Update :help :command-complete list * v9.1.0704: inserting with a count is inefficient runtime(doc): use mkdir -p to save a command * v9.1.0703: crash with 2byte encoding and glob2regpat() runtime(hollywood): update syn highlight for If-Then statements and For-In-Loops * v9.1.0702: Patch 9.1.0700 broke CI * v9.1.0701: crash with NFA regex engine when searching for composing chars * v9.1.0700: crash with 2byte encoding and glob2regpat() * v9.1.0699: "dvgo" is not always an inclusive motion runtime(java): Provide support for syntax preview features * v9.1.0698: "Untitled" file not removed when running Test_crash1_3 alone * v9.1.0697: heap-buffer-overflow in ins_typebuf * v9.1.0696: installing runtime files fails when using SHADOWDIR runtime(doc): fix typo * v9.1.0695: test_crash leaves Untitled file around translation(br): Update Brazilian translation translation(pt): Update menu_pt_br * v9.1.0694: matchparen is slow on a long line * v9.1.0693: Configure doesn't show result when not using python3 stable abi * v9.1.0692: Wrong patlen value in ex_substitute() * v9.1.0691: stable-abi may cause segfault on Python 3.11 runtime(vim): Update base-syntax, match :loadkeymap after colon and bar runtime(mane): Improve <Plug>ManBS mapping * v9.1.0690: cannot set special highlight kind in popupmenu translation(pt): Revert and fix wrong Portuguese menu translation files translation(pt): revert Portuguese menu translation translation(br): Update Brazilian translations runtime(vim): Update base-syntax, improve :let-heredoc highlighting * v9.1.0689: buffer-overflow in do_search( with 'rightleft' runtime(vim): Improve heredoc handling for all embedded scripts * v9.1.0688: dereferences NULL pointer in check_type_is_value() * v9.1.0687: Makefile may not install desktop files runtime(man): Fix <Plug>ManBS runtime(java): Make the bundled &foldtext function optional runtime(netrw): Change line on `mx` if command output exists runtime(netrw): Fix `mf`-selected entry highlighting runtime(htmlangular): add html syntax highlighting translation(it): Fix filemode of Italian manpages runtime(doc): Update outdated man.vim plugin information runtime(zip): simplify condition to detect MS-Windows * v9.1.0686: zip-plugin has problems with special characters runtime(pandoc): escape quotes in &errorformat for pandoc translation(it): updated Italian manpage * v9.1.0685: too many strlen( calls in usercmd.c runtime(doc): fix grammar in :h :keeppatterns runtime(pandoc): refine pandoc compiler settings * v9.1.0684: completion is inserted on Enter with "noselect" translation(ru): update man pages * v9.1.0683: mode( returns wrong value with <Cmd> mapping runtime(doc): remove trailing whitespace in cmdline.txt * v9.1.0682: Segfault with uninitialized funcref * v9.1.0681: Analyzing failed screendumps is hard runtime(doc): more clarification for the :keeppatterns needed * v9.1.0680: VMS does not have defined uintptr_t runtime(doc): improve typedchar documentation for KeyInputPre autocmd runtime(dist): verify that executable is in $PATH translation(it): update Italian manpages runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677 runtime(doc): update Makefile and make it portable between GNU and BSD * v9.1.0679: Rename from w_closing to w_locked is incomplete runtime(colors): update colorschemes runtime(vim): Update base-syntax, improve :let-heredoc highlighting runtime(doc): Updating the examples in the xxd manpage translation(ru): Updated uganda.rux runtime(yaml): do not re-indent when commenting out lines * v9.1.0678: use-after-free in alist_add() * v9.1.0677 :keepp does not retain the substitute pattern translation(ja): Update Japanese translations to latest release runtime(netrw): Drop committed trace lines runtime(netrw): Error popup not always used runtime(netrw): ErrorMsg( may throw E121 runtime(tutor): update Makefile and make it portable between GNU and BSD translation: improve the po/cleanup.vim script runtime(lang): update Makefile and make it portable between GNU and BSD * v9.1.0676: style issues with man pages * v9.1.0675: Patch v9.1.0674 causes problems runtime(dosbatch): Show %%i as an argument in syntax file runtime(dosbatch): Add syn-sync to syntax file runtime(sql, mysql): fix E169: Command too recursive with sql_type_default = "mysql" * v9.1.0674: compiling abstract method fails because of missing return runtime(javascript): fix a few issues with syntax higlighting runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var runtime(termdebug): Fix wrong test for balloon feature runtime(doc): Remove mentioning of the voting feature runtime(doc): add help tags for json + markdown global variables * v9.1.0673: too recursive func calls when calling super-class method runtime(syntax-tests): Facilitate the viewing of rendered screendumps runtime(doc): fix a few style issues * v9.1.0672: marker folds may get corrupted on undo * v9.1.0671 Problem: crash with WinNewPre autocommand * v9.1.0670: po file encoding fails on *BSD during make translation(it): Update Italian translation translation: Stop using msgconv * v9.1.0669: stable python ABI not used by default Update .gitignore and .hgignore files * v9.1.0668: build-error with python3.12 and stable ABI translations: Update generated po files * v9.1.0667: Some other options reset curswant unnecessarily when set * v9.1.0666: assert_equal( doesn't show multibyte string correctly runtime(doc): clarify directory of Vim's executable vs CWD * v9.1.0665 :for loop runtime(proto): Add indent script for protobuf filetype * v9.1.0664: console vim did not switch back to main screen on exit runtime(zip): zip plugin does not work with Vim 9.0 * v9.1.0663: zip test still resets 'shellslash' option runtime(zip): use defer to restore old settings runtime(zip): add a generic Message function runtime(zip): increment base version of zip plugin runtime(zip): raise minimum Vim version to * v9.0 runtime(zip): refactor save and restore of options runtime(zip): remove test for fnameescape runtime(zip): use :echomsg instead of :echo runtime(zip): clean up and remove comments * v9.1.0662: filecopy( may return wrong value when readlink( fails * v9.1.0661: the zip plugin is not tested. runtime(zip): Fix for FreeBSD's unzip command runtime(doc): capitalize correctly * v9.1.0660: Shift-Insert does work on old conhost translation(it): update Italian manpage runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr runtime(zip): escape '[' on Unix as well * v9.1.0659: MSVC Makefile is a bit hard to read runtime(doc): fix typo in syntax.txt runtime(doc): -x is only available when compiled with crypt feature * v9.1.0658: Coverity warns about dereferencing NULL pointer. runtime(colors): update Todo highlight in habamax colorscheme * v9.1.0657: MSVC build time can be optimized * v9.1.0656: MSVC Makefile CPU handling can be improved * v9.1.0655: goaccess config file not recognized CI: update clang compiler to version 20 runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore` * v9.1.0654: completion does not respect completeslash with fuzzy * v9.1.0653: Patch v9.1.0648 not completely right * v9.1.0652: too many strlen( calls in syntax.c * v9.1.0651 :append * v9.1.0650: Coverity warning in cstrncmp() * v9.1.0649: Wrong comment for "len" argument of call_simple_func() * v9.1.0648: [security] double-free in dialog_changed() * v9.1.0647: [security] use-after-free in tagstack_clear_entry runtime(doc): re-format tag example lines, mention ctags --list-kinds * v9.1.0646: imported function may not be found runtime(java): Document "g:java_space_errors" and "g:java_comment_strings" runtime(java): Cluster optional group definitions and their group links runtime(java): Tidy up the syntax file runtime(java): Tidy up the documentation for "ft-java-syntax" runtime(colors): update habamax scheme - tweak diff/search/todo colors runtime(nohlsearch): add missing loaded_hlsearch guard runtime(kivy): Updated maintainer info for syntax script Maintainers: Add maintainer for ondir ftplugin + syntax files runtime(netrw): removing trailing slash when copying files in same directory * v9.1.0645: wrong match when searching multi-byte char case-insensitive runtime(html): update syntax script to sync by 250 minlines by default * v9.1.0644: Unnecessary STRLEN( when applying mapping runtime(zip): Opening a remote zipfile don't work runtime(cuda): source c and cpp ftplugins * v9.1.0643: cursor may end up on invalid position * v9.1.0642: Check that mapping rhs starts with lhs fails if not simplified * v9.1.0641: OLE enabled in console version runtime(thrift): add ftplugin, indent and syntax scripts * v9.1.0640: Makefile can be improved * v9.1.0639: channel timeout may wrap around * v9.1.0638: E1510 may happen when formatting a message for smsg() * v9.1.0637: Style issues in MSVC Makefile - Update apparmor.vim to latest version (from AppArmor 4.0.2) - add support for "all" and "userns" rules, and new profile flags - Update to 9.1.0636: * 9.1.0636: filetype: ziggy files are not recognized * 9.1.0635: filetype: SuperHTML template files not recognized * 9.1.0634: Ctrl-P not working by default * 9.1.0633: Compilation warnings with `-Wunused-parameter` * 9.1.0632: MS-Windows: Compiler Warnings Add support for Files-Included in syntax script tweak documentation style a bit * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme * 9.1.0629: Rename of pum hl_group is incomplete * 9.1.0628: MinGW: coverage files are not cleaned up * 9.1.0627: MinGW: build-error when COVERAGE is enabled * 9.1.0626: Vim9: need more tests with null objects include initial filetype plugin * 9.1.0625: tests: test output all translated messages for all translations * 9.1.0624: ex command modifiers not found * 9.1.0623: Mingw: errors when trying to delete non-existing files * 9.1.0622: MS-Windows: mingw-build can be optimized * 9.1.0621: MS-Windows: startup code can be improved * 9.1.0620: Vim9: segfauls with null objects * 9.1.0619: tests: test_popup fails * 9.1.0618: cannot mark deprecated attributes in completion menu * 9.1.0617: Cursor moves beyond first line of folded end of buffer * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles * 9.1.0615: Unnecessary STRLEN() in make_percent_swname() Add single-line comment syntax Add syntax test for comments Update maintainer info * 9.1.0614: tests: screendump tests fail due to recent syntax changes * 9.1.0613: tests: termdebug test may fail and leave file around Update base-syntax, improve :set highlighting Optionally highlight the :: token for method references * 9.1.0612: filetype: deno.lock file not recognized Use delete() for deleting directory escape filename before trying to delete it * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys correctly extract file from zip browser * 9.1.0610: filetype: OpenGL Shading Language files are not detected Fix endless recursion in netrw#Explore() * 9.1.0609: outdated comments in Makefile update syntax script Fix flow mapping key detection Remove orphaned YAML syntax dump files * 9.1.0608: Coverity warns about a few potential issues Update syntax script and remove syn sync * 9.1.0607: termdebug: uses inconsistent style * 9.1.0606: tests: generated files may cause failure in test_codestyle * 9.1.0605: internal error with fuzzy completion * 9.1.0604: popup_filter during Press Enter prompt seems to hang translation: Update Serbian messages translation * 9.1.0603: filetype: use correct extension for Dracula * 9.1.0602: filetype: Prolog detection can be improved fix more inconsistencies in assert function docs * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit Update base-syntax, improve :map highlighting * 9.1.0600: Unused function and unused error constants * 9.1.0599: Termdebug: still get E1023 when specifying arguments correct wrong comment options fix typo "a xterm" -> "an xterm" * 9.1.0598: fuzzy completion does not work with default completion * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key * 9.1.0596: filetype: devscripts config files are not recognized gdb file/folder check is now performed only in CWD. quote filename arguments using double quotes update syntax to SDC-standard 2.1 minor updates. Cleanup :match and :loadkeymap syntax test files Update base-syntax, match types in Vim9 variable declarations * 9.1.0595: make errors out with the po Makefile * 9.1.0594: Unnecessary redraw when setting 'winfixbuf' using wrong highlight for UTF-8 include simple syntax plugin * 9.1.0593: filetype: Asymptote files are not recognized add recommended indent options to ftplugin add recommended indent options to ftplugin add recommended indent options to ftplugin * 9.1.0592: filetype: Mediawiki files are not recognized * 9.1.0591: filetype: *.wl files are not recognized * 9.1.0590: Vim9: crash when accessing getregionpos() return value 'cpoptions': Include "z" in the documented default * 9.1.0589: vi: d{motion} and cw work differently than expected update included colorschemes grammar fixes in options.txt - Add "Keywords" to gvim.desktop to make searching for gvim easier - Removed patches, as they're no longer required (refreshing them deleted their contents): * vim-7.3-help_tags.patch * vim-7.4-highlight_fstab.patch - Reorganise all applied patches in the spec file. - Update to 9.1.0588: * 9.1.0588: The maze program no longer compiles on newer clang runtime(typst): Add typst runtime files * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky * 9.1.0586: ocaml runtime files are outdated runtime(termdebug): fix a few issues * 9.1.0585: tests: test_cpoptions leaves swapfiles around * 9.1.0584: Warning about redeclaring f_id() non-static runtime(doc): Add hint how to load termdebug from vimrc runtime(doc): document global insert behavior * 9.1.0583: filetype: *.pdf_tex files are not recognized * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode * 9.1.0581: Various lines are indented inconsistently * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode * 9.1.0579: Ex command is still executed after giving E1247 * 9.1.0578: no tests for :Tohtml * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim * 9.1.0576: tests: still an issue with test_gettext_make * 9.1.0575: Wrong comments in alt_tabpage() * 9.1.0574: ex: wrong handling of commands after bar runtime(doc): add a note for netrw bug reports * 9.1.0573: ex: no implicit print for single addresses runtime(vim): make &indentexpr available from the outside * 9.1.0572: cannot specify tab page closing behaviour runtime(doc): remove obsolete Ex insert behavior * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky runtime(logindefs): update syntax with new keywords * 9.1.0570: tests: test_gettext_make can be improved runtime(filetype): Fix Prolog file detection regex * 9.1.0569: fnamemodify() treats ".." and "../" differently runtime(mojo): include mojo ftplugin and indent script * 9.1.0568: Cannot expand paths from 'cdpath' setting * 9.1.0567: Cannot use relative paths as findfile() stop directories * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash * 9.1.0565: Stop directory doesn't work properly in 'tags' * 9.1.0564: id() can be faster * 9.1.0563: Cannot process any Key event * 9.1.0562: tests: inconsistency in test_findfile.vim runtime(fstab): Add missing keywords to fstab syntax * 9.1.0561: netbeans: variable used un-initialized (Coverity) * 9.1.0560: bindtextdomain() does not indicate an error * 9.1.0559: translation of vim scripts can be improved * 9.1.0558: filetype: prolog detection can be improved * 9.1.0557: moving in the buffer list doesn't work as documented runtime(doc): fix inconsistencies in :h file-searching * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages runtime(htmlangular): correct comment * 9.1.0555: filetype: angular ft detection is still problematic * 9.1.0554: :bw leaves jumplist and tagstack data around * 9.1.0553: filetype: *.mcmeta files are not recognized * 9.1.0552: No test for antlr4 filetype * 9.1.0551: filetype: htmlangular files are not properly detected * 9.1.0550: filetype: antlr4 files are not recognized * 9.1.0549: fuzzycollect regex based completion not working as expected runtime(doc): autocmd_add() accepts a list not a dict * 9.1.0548: it's not possible to get a unique id for some vars runtime(tmux): Update syntax script * 9.1.0547: No way to get the arity of a Vim function * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A runtime(hlsplaylist): include hlsplaylist ftplugin file runtime(doc): fix typo in :h ft-csv-syntax runtime(doc): Correct shell command to get $VIMRUNTIME into shell * 9.1.0545: MSVC conversion warning * 9.1.0544: filetype: ldapconf files are not recognized runtime(cmakecache): include cmakecache ftplugin file runtime(lex): include lex ftplugin file runtime(yacc): include yacc ftplugin file runtime(squirrel): include squirrel ftplugin file runtime(objcpp): include objcpp ftplugin file runtime(tf): include tf ftplugin file runtime(mysql): include mysql ftplugin file runtime(javacc): include javacc ftplugin file runtime(cabal): include cabal ftplugin file runtime(cuda): include CUDA ftplugin file runtime(editorconfig): include editorconfig ftplugin file runtime(kivy): update kivy syntax, include ftplugin runtime(syntax-tests): Stop generating redundant "*_* 99.dump" files * 9.1.0543: Behavior of CursorMovedC is strange runtime(vim): Update base-syntax, improve :match command highlighting * 9.1.0542: Vim9: confusing string() output for object functions * 9.1.0541: failing test with Vim configured without channel * 9.1.0540: Unused assignment in sign_define_cmd() runtime(doc): add page-scrolling keys to index.txt runtime(doc): add reference to xterm-focus-event from FocusGained/Lost * 9.1.0539: Not enough tests for what v9.1.0535 fixed runtime(doc): clarify how to re-init csv syntax file * 9.1.0538: not possible to assign priority when defining a sign * 9.1.0537: signed number detection for CTRL-X/A can be improved * 9.1.0536: filetype: zone files are not recognized * 9.1.0535: newline escape wrong in ex mode runtime(man): honor cmd modifiers before `g:ft_man_open_mode` runtime(man): use `nnoremap` to map to Ex commands * 9.1.0534: completion wrong with fuzzy when cycling back to original runtime(syntax-tests): Abort and report failed cursor progress runtime(syntax-tests): Introduce self tests for screen dumping runtime(syntax-tests): Clear and redraw the ruler line with the shell info runtime(syntax-tests): Allow for folded and wrapped lines in syntax test files * 9.1.0533: Vim9: need more tests for nested objects equality CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries runtime(doc): Remove wrong help tag CTRL-SHIFT-CR * 9.1.0532: filetype: Cedar files not recognized runtime(doc): document further keys that scroll page up/down * 9.1.0531: resource leak in mch_get_random() runtime(tutor): Fix wrong spanish translation runtime(netrw): fix remaining case of register clobber * 9.1.0530: xxd: MSVC warning about non-ASCII character * 9.1.0529: silent! causes following try/catch to not work runtime(rust): use shiftwidth() in indent script * 9.1.0528: spell completion message still wrong in translations * 9.1.0527: inconsistent parameter in Makefiles for Vim executable * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config * 9.1.0525: Right release selects immediately when pum is truncated. * 9.1.0524: the recursive parameter in the *_equal functions can be removed runtime(termdebug): Add Deprecation warnings * 9.1.0523: Vim9: cannot downcast an object * 9.1.0522: Vim9: string(object) hangs for recursive references * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13 * 9.1.0520: Vim9: incorrect type checking for modifying lists runtime(manpager): avoid readonly prompt * 9.1.0519: MS-Windows: libvterm compilation can be optimized * 9.1.0518: initialize the random buffer can be improved * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak runtime(terraform): Add filetype plugin for terraform runtime(dockerfile): enable spellchecking of comments in syntax script runtime(doc): rename variable for pandoc markdown support runtime(doc): In builtin overview use {buf} as param for appendbufline/setbufline runtime(doc): clarify, that register 1-* 9 will always be shifted runtime(netrw): save and restore register 0-* 9, a and unnamed runtime(termdebug): Refactored StartDebug_term and EndDebug functions runtime(java): Compose "g:java_highlight_signature" and "g:java_highlight_functions" * 9.1.0516: need more tests for nested dicts and list comparision * 9.1.0515: Vim9: segfault in object_equal() * 9.1.0514: Vim9: issue with comparing objects recursively runtime(termdebug): Change some variables to Enums runtime(vim): Update base-syntax, fix function tail comments * 9.1.0513: Vim9: segfault with object comparison - Update to 9.1.0512: * Mode message for spell completion doesn't match allowed keys * CursorMovedC triggered wrongly with setcmdpos() * update runtime files * CI: test_gettext fails on MacOS14 + MSVC Win * not possible to translate Vim script messages * termdebug plugin can be further improved * add gomod filetype plugin * hard to detect cursor movement in the command line * Optionally highlight parameterised types * filetype: .envrc & .prettierignore not recognized * filetype: Faust files are not recognized * inner-tag textobject confused about ">" in attributes * cannot use fuzzy keyword completion * Remove the group exclusion list from @javaTop * wrong return type for execute() function * MS-Windows: too much legacy code * too complicated mapping restore in termdebug * simplify mapping * cannot switch buffer in a popup * MS-Windows: doesn't handle symlinks properly * getcmdcompltype() interferes with cmdline completion * termdebug can be further improved * update htmldjango detection * Improve Turkish documentation * include a simple csv filetype and syntax plugin * include the the simple nohlsearch package * matched text is highlighted case-sensitively * Matched text isn't highlighted in cmdline pum * Fix typos in several documents * clarify when text properties are cleared * improve the vim-shebang example * revert unintended formatting changes for termdebug * Add a config variable for commonly used compiler options * Wrong matched text highlighted in pum with 'rightleft' * bump length of character references in syntax script * properly check mapping variables using null_dict * fix KdlIndent and kdlComment in indent script * Test for patch 9.1.0489 doesn't fail without the fix * Fold multi-line comments with the syntax kind of &fdm * using wrong type for PlaceSign() * filetype: Vim-script files not detected by shebang line * revert unintended change to zip#Write() * add another tag for vim-shebang feature * Cmdline pum doesn't work properly with 'rightleft' * minor style problems with patch 9.1.0487 * default completion may break with fuzzy * Wrong padding for pum "kind" with 'rightleft' * Update base-syntax, match shebang lines * MS-Windows: handle files with spaces properly * Restore HTML syntax file tests * completed item not update on fuzzy completion * filetype: Snakemake files are not recognized * make TermDebugSendCommand() a global function again * close all buffers in the same way * Matched text shouldn't be highlighted in "kind" and "menu" * fix wrong helptag for :defer * Update base-syntax, match :sleep arg * include Georgian keymap * Sorting of completeopt+=fuzzy is not stable * correctly test for windows in NetrwGlob() * glob() on windows fails with [] in directory name * rewrite mkdir() doc and simplify {flags} meaning * glob() not sufficiently tested * update return type for job_info() * termdebug plugin needs more love * correct return types for job_start() and job_status() * Update base-syntax, match :catch and :throw args * Include element values in non-marker annotations * Vim9: term_getjob() throws an exception on error * fuzzy string matching executed when not needed * fuzzy_match_str_with_pos() does unnecessary list operations * restore description of "$" in col() and virtcol() * deduplicate getpos(), line(), col(), virtcol() * Update g:vimsyn_comment_strings dump file tests * Use string interpolation instead of string concat * potential deref of NULL pointer in fuzzy_match_str_with_pos * block_editing errors out when using <enter> * Update base-syntax, configurable comment string highlighting * fix typos in syntax.txt * Cannot see matched text in popup menu * Update base-syntax, match multiline continued comments * clarify documentation for "v" position at line() * cmod_split modifier is always reset in term_start() * remove line-continuation characters * use shiftwidth() instead of &tabstop in indent script * Remove orphaned screen dump files * include syntax, indent and ftplugin files * CI: Test_ColonEight() fails on github runners * add missing Enabled field in syntax script * basic svelte ftplugin file * term_start() does not clear vertical modifier * fix mousemodel restoration by comparing against null_string * Added definitions of Vim scripts and plugins * Exclude lambda expressions from _when_ _switch-case_ label clauses * Fix saved_mousemodel check * Inconsistencies between functions for option flags * Crash when using autocmd_get() after removing event inside autocmd * Fix small style issues * add return type info for Vim function descriptions * Update Italian Vim manpage * disable the q mapping * Change 'cms' for C++ to '// %s' * fix type mismatch error * Fix wrong email address * convert termdebug plugin to Vim9 script - Update to 9.1.0470: * tests Test_ColonEight_MultiByte() fails sporadically * Cannot have buffer-local value for 'completeopt' * GvimExt does not consult HKEY_CURRENT_USER * typos in some comments * runtime(vim): Update base-syntax, allow whitespace before :substitute pattern * Missing comments for fuzzy completion * runtime(man): update Vim manpage * runtime(comment): clarify the usage of 'commentstring' option value * runtime(doc): clarify how fuzzy 'completeopt' should work * runtime(netrw): prevent accidental data loss * missing filecopy() function * no whitespace padding in commentstring option in ftplugins * no fuzzy-matching support for insert-completion * eval5() and eval7 are too complex * too many strlen() calls in drawline.c * filetype lintstagedrc files are not recognized * Vim9 import autoload does not work with symlink * Coverity complains about division by zero * tests test_gui fails on Wayland * Left shift is incorrect with vartabstop and shiftwidth=0 * runtime(doc): clarify 'shortmess' flag "S" * MS-Windows compiler warning for size_t to int conversion * runtime(doc): include some vim9 script examples in the help * minor issues in test_filetype with rasi test * filetype rasi files are not recognized * runtime(java): Improve the matching of lambda expressions * Configure checks for libelf unnecessarily * No test for escaping '<' with shellescape() * check.vim complains about overlong comment lines * translation(it): Update Italian translation * evalc. code too complex * MS-Windows Compiler warnings - Update to 9.1.0448: * compiler warning in eval.c * remove remaining css code * Add ft_hare.txt to Reference Manual TOC * re-generate vim syntax from generator * fix syntax vim bug * completion may be wrong when deleting all chars * getregionpos() inconsistent for partly-selected multibyte char * fix highlighting nested and escaped quotes in string props * remove the indent plugin since it has too many issues * update Debian runtime files * Coverity warning after 9.1.0440 * Not enough tests for getregion() with multibyte chars * Can't use blockwise selection with width for getregion() * update outdated syntax files * fix floating_modifier highlight * hare runtime files outdated * getregionpos() can't properly indicate positions beyond eol * function get_lval() is too long * Cannot filter the history * Wrong Ex command executed when :g uses '?' as delimiter * support floating_modifier none; revert broken highlighting * Motif requires non-const char pointer for XPM data * Crash when using '?' as separator for :s * filetype: cygport files are not recognized * make errors trying to access autoload/zig * Wrong yanking with exclusive selection and ve=all * add missing help tags file * Ancient XPM preprocessor hack may cause build errors * include basic rescript ftplugin file * eval.c is too long * getregionpos() doesn't handle one char selection * check for gdb file/dir before using as buffer name * refactor zig ftplugin, remove auto format * Coverity complains about eval.c refactor * Tag guessing leaves wrong search history with very short names * some issues with termdebug mapping test * update matchit plugin to v1.20 * too many strlen() calls in search.c * set commentstring option * update vb indent plugin as vim9script * filetype: purescript files are not recognized * filetype: slint files are not recognized * basic nim ftplugin file for comments * Add Arduino ftplugin and indent files * include basic typst ftplugin file * include basic prisma ftplugin file * include basic v ftplugin for comment support * getregionpos() wrong with blockwise mode and multibyte * function echo_string_core() is too long * hyprlang files are not recognized * add basic dart ftplugin file * basic ftplugin file for graphql * mention comment plugin at :h 'commentstring' * set commentstring for sql files in ftplugin * :browse oldfiles prompts even with single entry * eval.c not sufficiently tested * clarify why E195 is returned * clarify temporary file clean up * fix :NoMatchParen not working * Cannot move to previous/next rare word * add basic ftplugin file for sshdconfig * if_py: find_module has been removed in Python 3.12.0a7 * some screen dump tests can be improved * Some functions are not tested * clarify instal instructions for comment package * Unable to leave long line with 'smoothscroll' and 'scrolloff' * fix typo in vim9script help file * Remove trailing spaces * clarify {special} argument for shellescape() - update to 9.1.0413 * smoothscroll may cause infinite loop * add missing entries for the keys CTRL-W g<Tab> and <C-Tab> * update vi_diff.txt: add default value for 'flash' * typo in regexp_bt.c in DEBUG code * allow indented commands * Fix wrong define regex in ftplugin * Filter out non-Latin-1 characters for syntax tests * prefer scp over pscp * fix typo in usr_52.txt * too long functions in eval.c * warning about uninitialized variable * too many strlen() calls in the regexp engine * E16 fix, async keyword support for define * Stuck with long line and half-page scrolling * Divide by zero with getmousepos() and 'smoothscroll' * update and remove some invalid links * update translation of xxd manpage * Recursively delete directories by default with netrw delete command * Strive to remain compatible for at least Vim 7.0 * tests: xxd buffer overflow fails on 32-bit * Stop handpicking syntax groups for @javaTop * [security] xxd: buffer-overflow with specific flags * Vim9: not able to import file from start dir * filetype: mdd files detected as zsh filetype * filetype: zsh module files are not recognized * Remove hardcoded private.ppk logic from netrw * Vim9: confusing error message for unknown type * block_editing errors out when using del * add new items to scripts section in syntax plugin * Vim9: imported vars are not properly type checked * Wrong display with 'smoothscroll' when changing quickfix list * filetype: jj files are not recognized * getregionpos() may leak memory on error * The CODEOWNERS File is not useful * Remove and cleanup Win9x legacy from netrw * add MsgArea to 'highlight' option description * Cannot get a list of positions describing a region * Fix digit separator in syntax script for octals and floats * Update link to Wikipedia Vi page * clear $MANPAGER in ftplugin before shelling out * Fix typos in help documents * 'viewdir' not respecting $XDG_CONFIG_HOME * tests: Vim9 debug tests may be flaky * correct getscriptinfo() example * Vim9: could improve testing * test_sound fails on macos-12 * update Serbian menu * update Slovak menu * update Slovenian menu * update Portuguese menu * update Dutch menu * update Korean menu * update Icelandic menu * update Czech menu * update Afrikaans menu * update German menu * filetype: inko files are not recognized * filetype: templ files are not recognized * cursor() and getregion() don't handle v:maxcol well * Vim9: null value tests not sufficient * update Catalan menu * filetype: stylus files not recognized * update spanish menu localization * regenerate helptags * Vim9: crash with null_class and null_object * Add tags about lazyloading of menu * tests: vt420 terminfo entry may not be found * filetype: .out files recognized as tex files * filetype: Kbuild files are not recognized * cbuffer and similar commands don't accept a range * Improve the recognition of the "indent" method declarations * Fix a typo in usr_30.txt * remove undefined var s:save_cpoptions and add include setting * missing setlocal in indent plugin * Calculating line height for unnecessary amount of lines * improve syntax file performance * There are a few typos * Vim9: no comments allowed after class vars * CI: remove trailing white space in documentation * Formatting text wrong when 'breakindent' is set * Add oracular (24.10) as Ubuntu release name * Vim9: Trailing commands after class/enum keywords ignored * tests: 1-second delay after Test_BufEnter_botline() * update helptags for jq syntax * include syntax, ftplugin and compiler plugin * fix typo synconcealend -> synconcealed * include a simple comment toggling plugin * wrong botline in BufEnter * clarify syntax vs matching mechanism * fix undefined variable in indent plugin * ops.c code uses too many strlen() calls * Calling CLEAR_FIELD() on the same struct twice * Vim9: compile_def_function() still too long * Update Serbian messages * clarify the effect of setting the shell to powershell * Improve the recognition of the "style" method declarations * Vim9: problem when importing autoloaded scripts * compile_def_function is too long * filetype: ondir files are not recognized * Crash when typing many keys with D- modifier * tests: test_vim9_builtin is a bit slow * update documentation * change the download URL of "libsodium" * tests: test_winfixbuf is a bit slow * Add filetype, syntax and indent plugin for Astro * expanding rc config files does not work well * Vim9: vim9type.c is too complicated * Vim9: does not handle autoloaded variables well * minor spell fix in starting.txt * wrong drawing in GUI with setcellwidth() * Add include and suffixesadd * Page scrolling should place cursor at window boundaries * align command line table * minor fixes to starting.txt * fix comment definition in filetype plugin * filetype: flake.lock files are not recognized * runtime(uci): No support for uci file types * Support "g:ftplugin_java_source_path" with archived files * tests: Test_autoload_import_relative_compiled fails on Windows * Finding cmd modifiers and cmdline-specials is inefficient * No test that completing a partial mapping clears 'showcmd' * tests: test_vim9_dissamble may fail * Vim9: need static type for typealias * X11 does not ignore smooth scroll event * A few typos in test_xdg when testing gvimrc * Patch v9.1.0338 fixed sourcing a script with import * Problem: gvimrc not sourced from XDG_CONFIG_HOME * Cursor wrong after using setcellwidth() in terminal * 'showcmd' wrong for partial mapping with multibyte * tests: test_taglist fails when 'helplang' contains non-english * Problem: a few memory leaks are found * Problem: Error with matchaddpos() and empty list * tests: xdg test uses screen dumps * Vim9: import through symlinks not correctly handled * Missing entry for XDG vimrc file in :version * tests: typo in test_xdg * runtime(i3config/swayconfig): update syntax scripts * document pandoc compiler and enable configuring arguments * String interpolation fails for List type * No test for highlight behavior with 'ambiwidth' * tests: test_xdg fails on the appimage repo * tests: some assert_equal() calls have wrong order of args * make install does not install all files * runtime(doc): fix typos in starting.txt - Pre-convert gvim icons, otherwise building vim depends on rsvg-convert -> librsvg -> cargo -> Rust -> LLVM - Cleanup SVG icon, make lines pixel-grid aligned - Correct RPM Group - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Pre-convert gvim icons, otherwise building vim depends on rsvg-convert -> librsvg -> cargo -> Rust -> LLVM - Cleanup SVG icon, make lines pixel-grid aligned - Correct RPM Group - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Pre-convert gvim icons, otherwise building vim depends on rsvg-convert -> librsvg -> cargo -> Rust -> LLVM - Cleanup SVG icon, make lines pixel-grid aligned - Correct RPM Group - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Add source-check-sandbox.patch to fix CVE-2019-12735 boo#1137443 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - introduce vim-small package with reduced requirements for small installations (boo#1166602). - BuildRequire pkg-config(krb5) instead of krb5-mini to be able to build against Tumbleweed repo. - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Fix for bsc#1231373 / CVE-2024-47814. - Fix for bsc#1229238 / CVE-2024-43374. - update to 9.1.0836 * 9.1.0836: The vimtutor can be improved * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu' * 9.1.0834: tests: 2html test fails * 9.1.0833: CI: recent ASAN changes do not work for indent tests * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal * runtime(doc): update help-toc description * runtime(2html): Make links use color scheme colors in TOhtml * 9.1.0831: 'findexpr' can't be used as lambad or Funcref * Filelist: include helptoc package * runtime(doc): include a TOC Vim9 plugin * Filelist: ignore .git-blame-ignore-revs * 9.1.0830: using wrong highlight group for spaces for popupmenu * runtime(typst): synchronize updates from the upstream typst.vim * git: ignore reformatting commit for git-blame (after v9.1.0829) * 9.1.0829: Vim source code uses a mix of tabs and spaces * 9.1.0828: string_T struct could be used more often * 9.1.0827: CI: tests can be improved * runtime(doc): remove stray sentence in pi_netrw.txt * 9.1.0826: filetype: sway files are not recognized * runtime(doc): Include netrw-gp in TOC * runtime(doc): mention 'iskeyword' at :h charclass() * runtime(doc): update help tags * 9.1.0825: compile error for non-diff builds * runtime(netrw): fix E874 when browsing remote directory which contains `~` character * runtime(doc): update coding style documentation * runtime(debversions): Add plucky (25.04) as Ubuntu release name * 9.1.0824: too many strlen() calls in register.c * 9.1.0823: filetype: Zephyr overlay files not recognized * runtime(doc): Clean up minor formatting issues for builtin functions * runtime(netrw): make :Launch/Open autoloadable * runtime(netrw): fix regression with x mapping on Cygwin * runtime(netrw): fix filetype detection for remote files * 9.1.0822: topline might be changed in diff mode unexpectedly * CI: huge linux builds should also run syntax & indent tests * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument * 9.1.0820: tests: Mac OS tests are too flaky * runtime(awk): Highlight more awk comments in syntax script * runtime(netrw): add missing change for s:redir() * 9.1.0819: tests: using findexpr and imported func not tested * runtime(netrw): improve netrw's open-handling further * runtime(netrw): fix syntax error in netrwPlugin.vim * runtime(netrw): simplify gx file handling * 9.1.0818: some global functions are only used in single files * 9.1.0817: termdebug: cannot evaluate expr in a popup * runtime(defaults): Detect putty terminal and switch to dark background * 9.1.0816: tests: not clear what tests cause asan failures * runtime(doc): Remove some completed items from todo.txt * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position * runtime(syntax-tests): tiny vim fails because of line-continuation * 9.1.0814: mapset() may remove unrelated mapping * 9.1.0813: no error handling with setglobal and number types * 9.1.0812: Coverity warns about dereferencing NULL ptr * 9.1.0811: :find expansion does not consider 'findexpr' * 9.1.0810: cannot easily adjust the |:find| command * 9.1.0809: filetype: petalinux config files not recognized * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll' * 9.1.0807: tests: having 'nolist' in modelines isn't always desired * 9.1.0806: tests: no error check when setting global 'briopt' * 9.1.0805: tests: minor issues in gen_opt_test.vim * 9.1.0804: tests: no error check when setting global 'cc' * 9.1.0803: tests: no error check when setting global 'isk' * 9.1.0802: tests: no error check when setting global 'fdm' to empty value * 9.1.0801: tests: no error check when setting global 'termwinkey' * 9.1.0800: tests: no error check when setting global 'termwinsize' * runtime(doc): :ownsyntax also resets 'spelloptions' * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive * runtime(doc): Fix wrong Mac default options * 9.1.0798: too many strlen() calls in cmdhist.c * 9.1.0797: testing of options can be further improved * 9.1.0796: filetype: libtool files are not recognized * (typst): add folding to typst ftplugin * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke() * 9.1.0795: filetype: Vivado memory info file are not recognized * 9.1.0794: tests: tests may fail on Windows environment * runtime(doc): improve the :colorscheme documentation * 9.1.0793: xxd: -e does add one extra space * 9.1.0792: tests: Test_set_values() is not comprehensive enough * runtime(swayconfig): add flag for bindsym/bindcode to syntax script * 9.1.0791: tests: errors in gen_opt_test.vim are not shown * runtime(compiler): check for compile_commands in build dirs for cppcheck * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib) * runtime(help): Update help syntax * runtime(help): fix end of sentence highlight in code examples * runtime(jinja): Support jinja syntax as secondary filetype * 9.1.0789: tests: ':resize + 5' has invalid space after '+' * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot * 9.1.0787: cursor position changed when using hidden terminal * 9.1.0786: tests: quickfix update test does not test location list * runtime(doc): add some docs for file-watcher programs * CI: uploading failed screendumps still fails on Cirrus CI * 9.1.0785: cannot preserve error position when setting quickfix list * 9.1.0784: there are several problems with python 3.13 * 9.1.0783: 'spell' option setting has problems * 9.1.0782: tests: using wrong neomuttlog file name * runtime(doc): add preview flag to statusline example * 9.1.0781: tests: test_filetype fails * 9.1.0780: MS-Windows: incorrect Win32 error checking * 9.1.0779: filetype: neomuttlog files are not recognized * 9.1.0778: filetype: lf config files are not recognized * runtime(comment): fix commment toggle with mixed tabs & spaces * runtime(misc): Use consistent "Vim script" spelling * runtime(gleam): add ftplugin for gleam files * runtime(doc): link help-writing from write-local-help * 9.1.0777: filetype: Some upstream php files are not recognized * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups * runtime(doc): mention conversion rules for remote_expr() * runtime(tutor): Fix missing :s command in spanish translation section 4.4 * 9.1.0776: test_strftime may fail because of missing TZ data * translation(am): Add Armenian language translation * 9.1.0775: tests: not enough tests for setting options * 9.1.0774: "shellcmdline" doesn't work with getcompletion() * 9.1.0773: filetype: some Apache files are not recognized * 9.1.0772: some missing changes from v9.1.0771 * 9.1.0771: completion attribute hl_group is confusing * 9.1.0770: current command line completion is a bit limited * 9.1.0769: filetype: MLIR files are not recognized * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen * runtime(nasm): Update nasm syntax script * 9.1.0767: A condition is always true in ex_getln.c * runtime(skill): Update syntax file to fix string escapes * runtime(help): highlight CTRL-<Key> correctly * runtime(doc): add missing usr_52 entry to toc * 9.1.0766: too many strlen() calls in ex_getln.c * runtime(doc): correct `vi` registers 1-9 documentation error * 9.1.0765: No test for patches 6.2.418 and 7.3.489 * runtime(spec): set comments and commentstring options * NSIS: Include libgcc_s_sjlj-1.dll again * runtime(doc): clarify the effect of 'startofline' option * 9.1.0764: [security]: use-after-free when closing a buffer * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting * 9.1.0763: tests: cannot run single syntax tests * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly * 9.1.0761: :cd completion fails on Windows with backslash in path * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails * 9.1.0759: screenpos() may return invalid position * runtime(misc): unset compiler in various ftplugins * runtime(doc): update formatting and syntax * runtime(compiler): add cppcheck linter compiler plugin * runtime(doc): Fix style in documents * runtime(doc): Fix to two-space convention in user manual * runtime(comment): consider &tabstop in lines after whitespace indent * 9.1.0758: it's possible to set an invalid key to 'wildcharm' * runtime(java): Manage circularity for every :syn-included syntax file * 9.1.0757: tests: messages files contains ANSI escape sequences * 9.1.0756: missing change from patch v9.1.0754 * 9.1.0755: quickfix list does not handle hardlinks well * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters * runtime(systemd): small fixes to &keywordprg in ftplugin * CI: macos-12 runner is being sunset, switch to 13 * 9.1.0754: fixed order of items in insert-mode completion menu * runtime(comment): commenting might be off by one column * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll' * 9.1.0752: can set 'cedit' to an invalid value * runtime(doc): add `usr` tag to usr_toc.txt * 9.1.0751: Error callback for term_start() not used * 9.1.0750: there are some Win9x legacy references * runtime(java): Recognise the CommonMark form (///) of Javadoc comments * 9.1.0749: filetype: http files not recognized * runtime(comment): fix syntax error * CI: uploading failed screendump tests does not work Cirrus * 9.1.0748: :keep* commmands are sometimes misidentified as :k * runtime(indent): allow matching negative numbers for gnu indent config file * runtime(comment): add gC mapping to (un)comment rest of line * 9.1.0747: various typos in repo found * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals * runtime(doc): reformat gnat example * runtime(doc): reformat ada_standard_types section * 9.1.0745: filetype: bun and deno history files not recognized * runtime(glvs): Correct the tag name of glvs-autoinstal * runtime(doc): include short form for :earlier/:later * runtime(doc): remove completed TODO * 9.1.0744: filetype: notmuch configs are not recognised * 9.1.0743: diff mode does not handle overlapping diffs correctly * runtime(glvs): fix a few issues * runtime(doc): Fix typo in :help :command-modifiers * 9.1.0742: getcmdprompt() implementation can be improved * runtime(docs): update `:set?` command behavior table * runtime(doc): update vim90 to vim91 in docs * runtime(doc): fix typo in :h dos-colors * 9.1.0741: No way to get prompt for input()/confirm() * runtime(doc): fix typo in version9.txt nrformat -> nrformats * runtime(rmd,rrst): 'fex' option not properly restored * runtime(netrw): remove extraneous closing bracket * 9.1.0740: incorrect internal diff with empty file * 9.1.0739: [security]: use-after-free in ex_getln.c * runtime(filetype): tests: Test_filetype_detection() fails * runtime(dist): do not output a message if executable is not found * 9.1.0738: filetype: rapid files are not recognized * runtime(modconf): remove erroneous :endif in ftplugin * runtime(lyrics): support multiple timestamps in syntax script * runtime(java): Optionally recognise _module_ import declarations * runtime(vim): Update base-syntax, improve folding function matches * CI: upload failed screendump tests also for Cirrus * 9.1.0737: tests: screendump tests may require a bit more time * runtime(misc): simplify keywordprg in various ftplugins * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels * runtime(zsh,sh): set and unset compiler in ftplugin * runtime(netrw): using inefficient highlight pattern for 'mf' * 9.1.0736: Unicode tables are outdated * 9.1.0735: filetype: salt files are not recognized * 9.1.0734: filetype: jinja files are not recognized * runtime(zathurarc): add double-click-follow to syntax script * translation(ru): Updated messages translation * translation(it): updated xxd man page * translation(ru): updated xxd man page * 9.1.0733: keyword completion does not work with fuzzy * 9.1.0732: xxd: cannot use -b and -i together * runtime(java): Highlight javaConceptKind modifiers with StorageClass * runtime(doc): reword and reformat how to use defaults.vim * 9.1.0731: inconsistent case sensitive extension matching * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return * runtime(netrw): delete confirmation not strict enough * 9.1.0730: Crash with cursor-screenline and narrow window * 9.1.0729: Wrong cursor-screenline when resizing window * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data * runtime(doc): clarify the effect of the timeout for search()-functions * runtime(idlang): update syntax script * runtime(spec): Recognize epoch when making spec changelog in ftplugin * runtime(spec): add file triggers to syntax script * 9.1.0727: too many strlen() calls in option.c * runtime(make): add compiler/make.vim to reset compiler plugin settings * runtime(java): Recognise all available standard doclet tags * 9.1.0726: not using correct python3 API with dynamic linking * runtime(dosini): Update syntax script, spellcheck comments only * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation * 9.1.0725: filetype: swiftinterface files are not recognized * runtime(pandoc): Update compiler plugin to use actual 'spelllang' * runtime(groff): Add compiler plugin for groff * 9.1.0724: if_python: link error with python 3.13 and stable ABI * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13 * 9.1.0722: crash with large id in text_prop interface * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME * runtime(glvs): update GetLatestVimScripts plugin * runtime(doc): Fix typo in :help :hide text * runtime(doc): buffers can be re-used * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid * runtime(doc): Update version9.txt and mention $MYVIMDIR - Update to 9.1.0718: * v9.1.0718: hard to know the users personal Vim Runtime Directory * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers() Maintainers: fix typo in author name * v9.1.0716: resetting setcellwidth( doesn't update the screen runtime(hcl,terraform): Add runtime files for HCL and Terraform runtime(tmux): Update syntax script * v9.1.0715: Not correctly parsing color names (after v9.1.0709) * v9.1.0714: GuiEnter_Turkish test may fail * v9.1.0713: Newline causes E749 in Ex mode * v9.1.0712: missing dependency of Test_gettext_makefile * v9.1.0711: test_xxd may file when using different xxd * v9.1.0710: popup window may hide part of Command line runtime(vim): Update syntax, improve user-command matching * v9.1.0709: GUIEnter event not found in Turkish locale runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items * v9.1.0708: Recursive window update does not account for reset skipcol runtime(nu): include filetype plugin * v9.1.0707: invalid cursor position may cause a crash * v9.1.0706: test_gettext fails when using shadow dir CI: Install locales-all package * v9.1.0705: Sorting of fuzzy filename completion is not stable translation(pt): update Portuguese/Brazilian menu translation runtime(vim): Update base-syntax, match bracket mark ranges runtime(doc): Update :help :command-complete list * v9.1.0704: inserting with a count is inefficient runtime(doc): use mkdir -p to save a command * v9.1.0703: crash with 2byte encoding and glob2regpat() runtime(hollywood): update syn highlight for If-Then statements and For-In-Loops * v9.1.0702: Patch 9.1.0700 broke CI * v9.1.0701: crash with NFA regex engine when searching for composing chars * v9.1.0700: crash with 2byte encoding and glob2regpat() * v9.1.0699: "dvgo" is not always an inclusive motion runtime(java): Provide support for syntax preview features * v9.1.0698: "Untitled" file not removed when running Test_crash1_3 alone * v9.1.0697: heap-buffer-overflow in ins_typebuf * v9.1.0696: installing runtime files fails when using SHADOWDIR runtime(doc): fix typo * v9.1.0695: test_crash leaves Untitled file around translation(br): Update Brazilian translation translation(pt): Update menu_pt_br * v9.1.0694: matchparen is slow on a long line * v9.1.0693: Configure doesn't show result when not using python3 stable abi * v9.1.0692: Wrong patlen value in ex_substitute() * v9.1.0691: stable-abi may cause segfault on Python 3.11 runtime(vim): Update base-syntax, match :loadkeymap after colon and bar runtime(mane): Improve <Plug>ManBS mapping * v9.1.0690: cannot set special highlight kind in popupmenu translation(pt): Revert and fix wrong Portuguese menu translation files translation(pt): revert Portuguese menu translation translation(br): Update Brazilian translations runtime(vim): Update base-syntax, improve :let-heredoc highlighting * v9.1.0689: buffer-overflow in do_search( with 'rightleft' runtime(vim): Improve heredoc handling for all embedded scripts * v9.1.0688: dereferences NULL pointer in check_type_is_value() * v9.1.0687: Makefile may not install desktop files runtime(man): Fix <Plug>ManBS runtime(java): Make the bundled &foldtext function optional runtime(netrw): Change line on `mx` if command output exists runtime(netrw): Fix `mf`-selected entry highlighting runtime(htmlangular): add html syntax highlighting translation(it): Fix filemode of Italian manpages runtime(doc): Update outdated man.vim plugin information runtime(zip): simplify condition to detect MS-Windows * v9.1.0686: zip-plugin has problems with special characters runtime(pandoc): escape quotes in &errorformat for pandoc translation(it): updated Italian manpage * v9.1.0685: too many strlen( calls in usercmd.c runtime(doc): fix grammar in :h :keeppatterns runtime(pandoc): refine pandoc compiler settings * v9.1.0684: completion is inserted on Enter with "noselect" translation(ru): update man pages * v9.1.0683: mode( returns wrong value with <Cmd> mapping runtime(doc): remove trailing whitespace in cmdline.txt * v9.1.0682: Segfault with uninitialized funcref * v9.1.0681: Analyzing failed screendumps is hard runtime(doc): more clarification for the :keeppatterns needed * v9.1.0680: VMS does not have defined uintptr_t runtime(doc): improve typedchar documentation for KeyInputPre autocmd runtime(dist): verify that executable is in $PATH translation(it): update Italian manpages runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677 runtime(doc): update Makefile and make it portable between GNU and BSD * v9.1.0679: Rename from w_closing to w_locked is incomplete runtime(colors): update colorschemes runtime(vim): Update base-syntax, improve :let-heredoc highlighting runtime(doc): Updating the examples in the xxd manpage translation(ru): Updated uganda.rux runtime(yaml): do not re-indent when commenting out lines * v9.1.0678: use-after-free in alist_add() * v9.1.0677 :keepp does not retain the substitute pattern translation(ja): Update Japanese translations to latest release runtime(netrw): Drop committed trace lines runtime(netrw): Error popup not always used runtime(netrw): ErrorMsg( may throw E121 runtime(tutor): update Makefile and make it portable between GNU and BSD translation: improve the po/cleanup.vim script runtime(lang): update Makefile and make it portable between GNU and BSD * v9.1.0676: style issues with man pages * v9.1.0675: Patch v9.1.0674 causes problems runtime(dosbatch): Show %%i as an argument in syntax file runtime(dosbatch): Add syn-sync to syntax file runtime(sql, mysql): fix E169: Command too recursive with sql_type_default = "mysql" * v9.1.0674: compiling abstract method fails because of missing return runtime(javascript): fix a few issues with syntax higlighting runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var runtime(termdebug): Fix wrong test for balloon feature runtime(doc): Remove mentioning of the voting feature runtime(doc): add help tags for json + markdown global variables * v9.1.0673: too recursive func calls when calling super-class method runtime(syntax-tests): Facilitate the viewing of rendered screendumps runtime(doc): fix a few style issues * v9.1.0672: marker folds may get corrupted on undo * v9.1.0671 Problem: crash with WinNewPre autocommand * v9.1.0670: po file encoding fails on *BSD during make translation(it): Update Italian translation translation: Stop using msgconv * v9.1.0669: stable python ABI not used by default Update .gitignore and .hgignore files * v9.1.0668: build-error with python3.12 and stable ABI translations: Update generated po files * v9.1.0667: Some other options reset curswant unnecessarily when set * v9.1.0666: assert_equal( doesn't show multibyte string correctly runtime(doc): clarify directory of Vim's executable vs CWD * v9.1.0665 :for loop runtime(proto): Add indent script for protobuf filetype * v9.1.0664: console vim did not switch back to main screen on exit runtime(zip): zip plugin does not work with Vim 9.0 * v9.1.0663: zip test still resets 'shellslash' option runtime(zip): use defer to restore old settings runtime(zip): add a generic Message function runtime(zip): increment base version of zip plugin runtime(zip): raise minimum Vim version to * v9.0 runtime(zip): refactor save and restore of options runtime(zip): remove test for fnameescape runtime(zip): use :echomsg instead of :echo runtime(zip): clean up and remove comments * v9.1.0662: filecopy( may return wrong value when readlink( fails * v9.1.0661: the zip plugin is not tested. runtime(zip): Fix for FreeBSD's unzip command runtime(doc): capitalize correctly * v9.1.0660: Shift-Insert does work on old conhost translation(it): update Italian manpage runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr runtime(zip): escape '[' on Unix as well * v9.1.0659: MSVC Makefile is a bit hard to read runtime(doc): fix typo in syntax.txt runtime(doc): -x is only available when compiled with crypt feature * v9.1.0658: Coverity warns about dereferencing NULL pointer. runtime(colors): update Todo highlight in habamax colorscheme * v9.1.0657: MSVC build time can be optimized * v9.1.0656: MSVC Makefile CPU handling can be improved * v9.1.0655: goaccess config file not recognized CI: update clang compiler to version 20 runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore` * v9.1.0654: completion does not respect completeslash with fuzzy * v9.1.0653: Patch v9.1.0648 not completely right * v9.1.0652: too many strlen( calls in syntax.c * v9.1.0651 :append * v9.1.0650: Coverity warning in cstrncmp() * v9.1.0649: Wrong comment for "len" argument of call_simple_func() * v9.1.0648: [security] double-free in dialog_changed() * v9.1.0647: [security] use-after-free in tagstack_clear_entry runtime(doc): re-format tag example lines, mention ctags --list-kinds * v9.1.0646: imported function may not be found runtime(java): Document "g:java_space_errors" and "g:java_comment_strings" runtime(java): Cluster optional group definitions and their group links runtime(java): Tidy up the syntax file runtime(java): Tidy up the documentation for "ft-java-syntax" runtime(colors): update habamax scheme - tweak diff/search/todo colors runtime(nohlsearch): add missing loaded_hlsearch guard runtime(kivy): Updated maintainer info for syntax script Maintainers: Add maintainer for ondir ftplugin + syntax files runtime(netrw): removing trailing slash when copying files in same directory * v9.1.0645: wrong match when searching multi-byte char case-insensitive runtime(html): update syntax script to sync by 250 minlines by default * v9.1.0644: Unnecessary STRLEN( when applying mapping runtime(zip): Opening a remote zipfile don't work runtime(cuda): source c and cpp ftplugins * v9.1.0643: cursor may end up on invalid position * v9.1.0642: Check that mapping rhs starts with lhs fails if not simplified * v9.1.0641: OLE enabled in console version runtime(thrift): add ftplugin, indent and syntax scripts * v9.1.0640: Makefile can be improved * v9.1.0639: channel timeout may wrap around * v9.1.0638: E1510 may happen when formatting a message for smsg() * v9.1.0637: Style issues in MSVC Makefile - Update apparmor.vim to latest version (from AppArmor 4.0.2) - add support for "all" and "userns" rules, and new profile flags - Update to 9.1.0636: * 9.1.0636: filetype: ziggy files are not recognized * 9.1.0635: filetype: SuperHTML template files not recognized * 9.1.0634: Ctrl-P not working by default * 9.1.0633: Compilation warnings with `-Wunused-parameter` * 9.1.0632: MS-Windows: Compiler Warnings Add support for Files-Included in syntax script tweak documentation style a bit * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme * 9.1.0629: Rename of pum hl_group is incomplete * 9.1.0628: MinGW: coverage files are not cleaned up * 9.1.0627: MinGW: build-error when COVERAGE is enabled * 9.1.0626: Vim9: need more tests with null objects include initial filetype plugin * 9.1.0625: tests: test output all translated messages for all translations * 9.1.0624: ex command modifiers not found * 9.1.0623: Mingw: errors when trying to delete non-existing files * 9.1.0622: MS-Windows: mingw-build can be optimized * 9.1.0621: MS-Windows: startup code can be improved * 9.1.0620: Vim9: segfauls with null objects * 9.1.0619: tests: test_popup fails * 9.1.0618: cannot mark deprecated attributes in completion menu * 9.1.0617: Cursor moves beyond first line of folded end of buffer * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles * 9.1.0615: Unnecessary STRLEN() in make_percent_swname() Add single-line comment syntax Add syntax test for comments Update maintainer info * 9.1.0614: tests: screendump tests fail due to recent syntax changes * 9.1.0613: tests: termdebug test may fail and leave file around Update base-syntax, improve :set highlighting Optionally highlight the :: token for method references * 9.1.0612: filetype: deno.lock file not recognized Use delete() for deleting directory escape filename before trying to delete it * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys correctly extract file from zip browser * 9.1.0610: filetype: OpenGL Shading Language files are not detected Fix endless recursion in netrw#Explore() * 9.1.0609: outdated comments in Makefile update syntax script Fix flow mapping key detection Remove orphaned YAML syntax dump files * 9.1.0608: Coverity warns about a few potential issues Update syntax script and remove syn sync * 9.1.0607: termdebug: uses inconsistent style * 9.1.0606: tests: generated files may cause failure in test_codestyle * 9.1.0605: internal error with fuzzy completion * 9.1.0604: popup_filter during Press Enter prompt seems to hang translation: Update Serbian messages translation * 9.1.0603: filetype: use correct extension for Dracula * 9.1.0602: filetype: Prolog detection can be improved fix more inconsistencies in assert function docs * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit Update base-syntax, improve :map highlighting * 9.1.0600: Unused function and unused error constants * 9.1.0599: Termdebug: still get E1023 when specifying arguments correct wrong comment options fix typo "a xterm" -> "an xterm" * 9.1.0598: fuzzy completion does not work with default completion * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key * 9.1.0596: filetype: devscripts config files are not recognized gdb file/folder check is now performed only in CWD. quote filename arguments using double quotes update syntax to SDC-standard 2.1 minor updates. Cleanup :match and :loadkeymap syntax test files Update base-syntax, match types in Vim9 variable declarations * 9.1.0595: make errors out with the po Makefile * 9.1.0594: Unnecessary redraw when setting 'winfixbuf' using wrong highlight for UTF-8 include simple syntax plugin * 9.1.0593: filetype: Asymptote files are not recognized add recommended indent options to ftplugin add recommended indent options to ftplugin add recommended indent options to ftplugin * 9.1.0592: filetype: Mediawiki files are not recognized * 9.1.0591: filetype: *.wl files are not recognized * 9.1.0590: Vim9: crash when accessing getregionpos() return value 'cpoptions': Include "z" in the documented default * 9.1.0589: vi: d{motion} and cw work differently than expected update included colorschemes grammar fixes in options.txt - Add "Keywords" to gvim.desktop to make searching for gvim easier - Removed patches, as they're no longer required (refreshing them deleted their contents): * vim-7.3-help_tags.patch * vim-7.4-highlight_fstab.patch - Reorganise all applied patches in the spec file. - Update to 9.1.0588: * 9.1.0588: The maze program no longer compiles on newer clang runtime(typst): Add typst runtime files * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky * 9.1.0586: ocaml runtime files are outdated runtime(termdebug): fix a few issues * 9.1.0585: tests: test_cpoptions leaves swapfiles around * 9.1.0584: Warning about redeclaring f_id() non-static runtime(doc): Add hint how to load termdebug from vimrc runtime(doc): document global insert behavior * 9.1.0583: filetype: *.pdf_tex files are not recognized * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode * 9.1.0581: Various lines are indented inconsistently * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode * 9.1.0579: Ex command is still executed after giving E1247 * 9.1.0578: no tests for :Tohtml * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim * 9.1.0576: tests: still an issue with test_gettext_make * 9.1.0575: Wrong comments in alt_tabpage() * 9.1.0574: ex: wrong handling of commands after bar runtime(doc): add a note for netrw bug reports * 9.1.0573: ex: no implicit print for single addresses runtime(vim): make &indentexpr available from the outside * 9.1.0572: cannot specify tab page closing behaviour runtime(doc): remove obsolete Ex insert behavior * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky runtime(logindefs): update syntax with new keywords * 9.1.0570: tests: test_gettext_make can be improved runtime(filetype): Fix Prolog file detection regex * 9.1.0569: fnamemodify() treats ".." and "../" differently runtime(mojo): include mojo ftplugin and indent script * 9.1.0568: Cannot expand paths from 'cdpath' setting * 9.1.0567: Cannot use relative paths as findfile() stop directories * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash * 9.1.0565: Stop directory doesn't work properly in 'tags' * 9.1.0564: id() can be faster * 9.1.0563: Cannot process any Key event * 9.1.0562: tests: inconsistency in test_findfile.vim runtime(fstab): Add missing keywords to fstab syntax * 9.1.0561: netbeans: variable used un-initialized (Coverity) * 9.1.0560: bindtextdomain() does not indicate an error * 9.1.0559: translation of vim scripts can be improved * 9.1.0558: filetype: prolog detection can be improved * 9.1.0557: moving in the buffer list doesn't work as documented runtime(doc): fix inconsistencies in :h file-searching * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages runtime(htmlangular): correct comment * 9.1.0555: filetype: angular ft detection is still problematic * 9.1.0554: :bw leaves jumplist and tagstack data around * 9.1.0553: filetype: *.mcmeta files are not recognized * 9.1.0552: No test for antlr4 filetype * 9.1.0551: filetype: htmlangular files are not properly detected * 9.1.0550: filetype: antlr4 files are not recognized * 9.1.0549: fuzzycollect regex based completion not working as expected runtime(doc): autocmd_add() accepts a list not a dict * 9.1.0548: it's not possible to get a unique id for some vars runtime(tmux): Update syntax script * 9.1.0547: No way to get the arity of a Vim function * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A runtime(hlsplaylist): include hlsplaylist ftplugin file runtime(doc): fix typo in :h ft-csv-syntax runtime(doc): Correct shell command to get $VIMRUNTIME into shell * 9.1.0545: MSVC conversion warning * 9.1.0544: filetype: ldapconf files are not recognized runtime(cmakecache): include cmakecache ftplugin file runtime(lex): include lex ftplugin file runtime(yacc): include yacc ftplugin file runtime(squirrel): include squirrel ftplugin file runtime(objcpp): include objcpp ftplugin file runtime(tf): include tf ftplugin file runtime(mysql): include mysql ftplugin file runtime(javacc): include javacc ftplugin file runtime(cabal): include cabal ftplugin file runtime(cuda): include CUDA ftplugin file runtime(editorconfig): include editorconfig ftplugin file runtime(kivy): update kivy syntax, include ftplugin runtime(syntax-tests): Stop generating redundant "*_* 99.dump" files * 9.1.0543: Behavior of CursorMovedC is strange runtime(vim): Update base-syntax, improve :match command highlighting * 9.1.0542: Vim9: confusing string() output for object functions * 9.1.0541: failing test with Vim configured without channel * 9.1.0540: Unused assignment in sign_define_cmd() runtime(doc): add page-scrolling keys to index.txt runtime(doc): add reference to xterm-focus-event from FocusGained/Lost * 9.1.0539: Not enough tests for what v9.1.0535 fixed runtime(doc): clarify how to re-init csv syntax file * 9.1.0538: not possible to assign priority when defining a sign * 9.1.0537: signed number detection for CTRL-X/A can be improved * 9.1.0536: filetype: zone files are not recognized * 9.1.0535: newline escape wrong in ex mode runtime(man): honor cmd modifiers before `g:ft_man_open_mode` runtime(man): use `nnoremap` to map to Ex commands * 9.1.0534: completion wrong with fuzzy when cycling back to original runtime(syntax-tests): Abort and report failed cursor progress runtime(syntax-tests): Introduce self tests for screen dumping runtime(syntax-tests): Clear and redraw the ruler line with the shell info runtime(syntax-tests): Allow for folded and wrapped lines in syntax test files * 9.1.0533: Vim9: need more tests for nested objects equality CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries runtime(doc): Remove wrong help tag CTRL-SHIFT-CR * 9.1.0532: filetype: Cedar files not recognized runtime(doc): document further keys that scroll page up/down * 9.1.0531: resource leak in mch_get_random() runtime(tutor): Fix wrong spanish translation runtime(netrw): fix remaining case of register clobber * 9.1.0530: xxd: MSVC warning about non-ASCII character * 9.1.0529: silent! causes following try/catch to not work runtime(rust): use shiftwidth() in indent script * 9.1.0528: spell completion message still wrong in translations * 9.1.0527: inconsistent parameter in Makefiles for Vim executable * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config * 9.1.0525: Right release selects immediately when pum is truncated. * 9.1.0524: the recursive parameter in the *_equal functions can be removed runtime(termdebug): Add Deprecation warnings * 9.1.0523: Vim9: cannot downcast an object * 9.1.0522: Vim9: string(object) hangs for recursive references * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13 * 9.1.0520: Vim9: incorrect type checking for modifying lists runtime(manpager): avoid readonly prompt * 9.1.0519: MS-Windows: libvterm compilation can be optimized * 9.1.0518: initialize the random buffer can be improved * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak runtime(terraform): Add filetype plugin for terraform runtime(dockerfile): enable spellchecking of comments in syntax script runtime(doc): rename variable for pandoc markdown support runtime(doc): In builtin overview use {buf} as param for appendbufline/setbufline runtime(doc): clarify, that register 1-* 9 will always be shifted runtime(netrw): save and restore register 0-* 9, a and unnamed runtime(termdebug): Refactored StartDebug_term and EndDebug functions runtime(java): Compose "g:java_highlight_signature" and "g:java_highlight_functions" * 9.1.0516: need more tests for nested dicts and list comparision * 9.1.0515: Vim9: segfault in object_equal() * 9.1.0514: Vim9: issue with comparing objects recursively runtime(termdebug): Change some variables to Enums runtime(vim): Update base-syntax, fix function tail comments * 9.1.0513: Vim9: segfault with object comparison - Update to 9.1.0512: * Mode message for spell completion doesn't match allowed keys * CursorMovedC triggered wrongly with setcmdpos() * update runtime files * CI: test_gettext fails on MacOS14 + MSVC Win * not possible to translate Vim script messages * termdebug plugin can be further improved * add gomod filetype plugin * hard to detect cursor movement in the command line * Optionally highlight parameterised types * filetype: .envrc & .prettierignore not recognized * filetype: Faust files are not recognized * inner-tag textobject confused about ">" in attributes * cannot use fuzzy keyword completion * Remove the group exclusion list from @javaTop * wrong return type for execute() function * MS-Windows: too much legacy code * too complicated mapping restore in termdebug * simplify mapping * cannot switch buffer in a popup * MS-Windows: doesn't handle symlinks properly * getcmdcompltype() interferes with cmdline completion * termdebug can be further improved * update htmldjango detection * Improve Turkish documentation * include a simple csv filetype and syntax plugin * include the the simple nohlsearch package * matched text is highlighted case-sensitively * Matched text isn't highlighted in cmdline pum * Fix typos in several documents * clarify when text properties are cleared * improve the vim-shebang example * revert unintended formatting changes for termdebug * Add a config variable for commonly used compiler options * Wrong matched text highlighted in pum with 'rightleft' * bump length of character references in syntax script * properly check mapping variables using null_dict * fix KdlIndent and kdlComment in indent script * Test for patch 9.1.0489 doesn't fail without the fix * Fold multi-line comments with the syntax kind of &fdm * using wrong type for PlaceSign() * filetype: Vim-script files not detected by shebang line * revert unintended change to zip#Write() * add another tag for vim-shebang feature * Cmdline pum doesn't work properly with 'rightleft' * minor style problems with patch 9.1.0487 * default completion may break with fuzzy * Wrong padding for pum "kind" with 'rightleft' * Update base-syntax, match shebang lines * MS-Windows: handle files with spaces properly * Restore HTML syntax file tests * completed item not update on fuzzy completion * filetype: Snakemake files are not recognized * make TermDebugSendCommand() a global function again * close all buffers in the same way * Matched text shouldn't be highlighted in "kind" and "menu" * fix wrong helptag for :defer * Update base-syntax, match :sleep arg * include Georgian keymap * Sorting of completeopt+=fuzzy is not stable * correctly test for windows in NetrwGlob() * glob() on windows fails with [] in directory name * rewrite mkdir() doc and simplify {flags} meaning * glob() not sufficiently tested * update return type for job_info() * termdebug plugin needs more love * correct return types for job_start() and job_status() * Update base-syntax, match :catch and :throw args * Include element values in non-marker annotations * Vim9: term_getjob() throws an exception on error * fuzzy string matching executed when not needed * fuzzy_match_str_with_pos() does unnecessary list operations * restore description of "$" in col() and virtcol() * deduplicate getpos(), line(), col(), virtcol() * Update g:vimsyn_comment_strings dump file tests * Use string interpolation instead of string concat * potential deref of NULL pointer in fuzzy_match_str_with_pos * block_editing errors out when using <enter> * Update base-syntax, configurable comment string highlighting * fix typos in syntax.txt * Cannot see matched text in popup menu * Update base-syntax, match multiline continued comments * clarify documentation for "v" position at line() * cmod_split modifier is always reset in term_start() * remove line-continuation characters * use shiftwidth() instead of &tabstop in indent script * Remove orphaned screen dump files * include syntax, indent and ftplugin files * CI: Test_ColonEight() fails on github runners * add missing Enabled field in syntax script * basic svelte ftplugin file * term_start() does not clear vertical modifier * fix mousemodel restoration by comparing against null_string * Added definitions of Vim scripts and plugins * Exclude lambda expressions from _when_ _switch-case_ label clauses * Fix saved_mousemodel check * Inconsistencies between functions for option flags * Crash when using autocmd_get() after removing event inside autocmd * Fix small style issues * add return type info for Vim function descriptions * Update Italian Vim manpage * disable the q mapping * Change 'cms' for C++ to '// %s' * fix type mismatch error * Fix wrong email address * convert termdebug plugin to Vim9 script - Update to 9.1.0470: * tests Test_ColonEight_MultiByte() fails sporadically * Cannot have buffer-local value for 'completeopt' * GvimExt does not consult HKEY_CURRENT_USER * typos in some comments * runtime(vim): Update base-syntax, allow whitespace before :substitute pattern * Missing comments for fuzzy completion * runtime(man): update Vim manpage * runtime(comment): clarify the usage of 'commentstring' option value * runtime(doc): clarify how fuzzy 'completeopt' should work * runtime(netrw): prevent accidental data loss * missing filecopy() function * no whitespace padding in commentstring option in ftplugins * no fuzzy-matching support for insert-completion * eval5() and eval7 are too complex * too many strlen() calls in drawline.c * filetype lintstagedrc files are not recognized * Vim9 import autoload does not work with symlink * Coverity complains about division by zero * tests test_gui fails on Wayland * Left shift is incorrect with vartabstop and shiftwidth=0 * runtime(doc): clarify 'shortmess' flag "S" * MS-Windows compiler warning for size_t to int conversion * runtime(doc): include some vim9 script examples in the help * minor issues in test_filetype with rasi test * filetype rasi files are not recognized * runtime(java): Improve the matching of lambda expressions * Configure checks for libelf unnecessarily * No test for escaping '<' with shellescape() * check.vim complains about overlong comment lines * translation(it): Update Italian translation * evalc. code too complex * MS-Windows Compiler warnings - Update to 9.1.0448: * compiler warning in eval.c * remove remaining css code * Add ft_hare.txt to Reference Manual TOC * re-generate vim syntax from generator * fix syntax vim bug * completion may be wrong when deleting all chars * getregionpos() inconsistent for partly-selected multibyte char * fix highlighting nested and escaped quotes in string props * remove the indent plugin since it has too many issues * update Debian runtime files * Coverity warning after 9.1.0440 * Not enough tests for getregion() with multibyte chars * Can't use blockwise selection with width for getregion() * update outdated syntax files * fix floating_modifier highlight * hare runtime files outdated * getregionpos() can't properly indicate positions beyond eol * function get_lval() is too long * Cannot filter the history * Wrong Ex command executed when :g uses '?' as delimiter * support floating_modifier none; revert broken highlighting * Motif requires non-const char pointer for XPM data * Crash when using '?' as separator for :s * filetype: cygport files are not recognized * make errors trying to access autoload/zig * Wrong yanking with exclusive selection and ve=all * add missing help tags file * Ancient XPM preprocessor hack may cause build errors * include basic rescript ftplugin file * eval.c is too long * getregionpos() doesn't handle one char selection * check for gdb file/dir before using as buffer name * refactor zig ftplugin, remove auto format * Coverity complains about eval.c refactor * Tag guessing leaves wrong search history with very short names * some issues with termdebug mapping test * update matchit plugin to v1.20 * too many strlen() calls in search.c * set commentstring option * update vb indent plugin as vim9script * filetype: purescript files are not recognized * filetype: slint files are not recognized * basic nim ftplugin file for comments * Add Arduino ftplugin and indent files * include basic typst ftplugin file * include basic prisma ftplugin file * include basic v ftplugin for comment support * getregionpos() wrong with blockwise mode and multibyte * function echo_string_core() is too long * hyprlang files are not recognized * add basic dart ftplugin file * basic ftplugin file for graphql * mention comment plugin at :h 'commentstring' * set commentstring for sql files in ftplugin * :browse oldfiles prompts even with single entry * eval.c not sufficiently tested * clarify why E195 is returned * clarify temporary file clean up * fix :NoMatchParen not working * Cannot move to previous/next rare word * add basic ftplugin file for sshdconfig * if_py: find_module has been removed in Python 3.12.0a7 * some screen dump tests can be improved * Some functions are not tested * clarify instal instructions for comment package * Unable to leave long line with 'smoothscroll' and 'scrolloff' * fix typo in vim9script help file * Remove trailing spaces * clarify {special} argument for shellescape() - update to 9.1.0413 * smoothscroll may cause infinite loop * add missing entries for the keys CTRL-W g<Tab> and <C-Tab> * update vi_diff.txt: add default value for 'flash' * typo in regexp_bt.c in DEBUG code * allow indented commands * Fix wrong define regex in ftplugin * Filter out non-Latin-1 characters for syntax tests * prefer scp over pscp * fix typo in usr_52.txt * too long functions in eval.c * warning about uninitialized variable * too many strlen() calls in the regexp engine * E16 fix, async keyword support for define * Stuck with long line and half-page scrolling * Divide by zero with getmousepos() and 'smoothscroll' * update and remove some invalid links * update translation of xxd manpage * Recursively delete directories by default with netrw delete command * Strive to remain compatible for at least Vim 7.0 * tests: xxd buffer overflow fails on 32-bit * Stop handpicking syntax groups for @javaTop * [security] xxd: buffer-overflow with specific flags * Vim9: not able to import file from start dir * filetype: mdd files detected as zsh filetype * filetype: zsh module files are not recognized * Remove hardcoded private.ppk logic from netrw * Vim9: confusing error message for unknown type * block_editing errors out when using del * add new items to scripts section in syntax plugin * Vim9: imported vars are not properly type checked * Wrong display with 'smoothscroll' when changing quickfix list * filetype: jj files are not recognized * getregionpos() may leak memory on error * The CODEOWNERS File is not useful * Remove and cleanup Win9x legacy from netrw * add MsgArea to 'highlight' option description * Cannot get a list of positions describing a region * Fix digit separator in syntax script for octals and floats * Update link to Wikipedia Vi page * clear $MANPAGER in ftplugin before shelling out * Fix typos in help documents * 'viewdir' not respecting $XDG_CONFIG_HOME * tests: Vim9 debug tests may be flaky * correct getscriptinfo() example * Vim9: could improve testing * test_sound fails on macos-12 * update Serbian menu * update Slovak menu * update Slovenian menu * update Portuguese menu * update Dutch menu * update Korean menu * update Icelandic menu * update Czech menu * update Afrikaans menu * update German menu * filetype: inko files are not recognized * filetype: templ files are not recognized * cursor() and getregion() don't handle v:maxcol well * Vim9: null value tests not sufficient * update Catalan menu * filetype: stylus files not recognized * update spanish menu localization * regenerate helptags * Vim9: crash with null_class and null_object * Add tags about lazyloading of menu * tests: vt420 terminfo entry may not be found * filetype: .out files recognized as tex files * filetype: Kbuild files are not recognized * cbuffer and similar commands don't accept a range * Improve the recognition of the "indent" method declarations * Fix a typo in usr_30.txt * remove undefined var s:save_cpoptions and add include setting * missing setlocal in indent plugin * Calculating line height for unnecessary amount of lines * improve syntax file performance * There are a few typos * Vim9: no comments allowed after class vars * CI: remove trailing white space in documentation * Formatting text wrong when 'breakindent' is set * Add oracular (24.10) as Ubuntu release name * Vim9: Trailing commands after class/enum keywords ignored * tests: 1-second delay after Test_BufEnter_botline() * update helptags for jq syntax * include syntax, ftplugin and compiler plugin * fix typo synconcealend -> synconcealed * include a simple comment toggling plugin * wrong botline in BufEnter * clarify syntax vs matching mechanism * fix undefined variable in indent plugin * ops.c code uses too many strlen() calls * Calling CLEAR_FIELD() on the same struct twice * Vim9: compile_def_function() still too long * Update Serbian messages * clarify the effect of setting the shell to powershell * Improve the recognition of the "style" method declarations * Vim9: problem when importing autoloaded scripts * compile_def_function is too long * filetype: ondir files are not recognized * Crash when typing many keys with D- modifier * tests: test_vim9_builtin is a bit slow * update documentation * change the download URL of "libsodium" * tests: test_winfixbuf is a bit slow * Add filetype, syntax and indent plugin for Astro * expanding rc config files does not work well * Vim9: vim9type.c is too complicated * Vim9: does not handle autoloaded variables well * minor spell fix in starting.txt * wrong drawing in GUI with setcellwidth() * Add include and suffixesadd * Page scrolling should place cursor at window boundaries * align command line table * minor fixes to starting.txt * fix comment definition in filetype plugin * filetype: flake.lock files are not recognized * runtime(uci): No support for uci file types * Support "g:ftplugin_java_source_path" with archived files * tests: Test_autoload_import_relative_compiled fails on Windows * Finding cmd modifiers and cmdline-specials is inefficient * No test that completing a partial mapping clears 'showcmd' * tests: test_vim9_dissamble may fail * Vim9: need static type for typealias * X11 does not ignore smooth scroll event * A few typos in test_xdg when testing gvimrc * Patch v9.1.0338 fixed sourcing a script with import * Problem: gvimrc not sourced from XDG_CONFIG_HOME * Cursor wrong after using setcellwidth() in terminal * 'showcmd' wrong for partial mapping with multibyte * tests: test_taglist fails when 'helplang' contains non-english * Problem: a few memory leaks are found * Problem: Error with matchaddpos() and empty list * tests: xdg test uses screen dumps * Vim9: import through symlinks not correctly handled * Missing entry for XDG vimrc file in :version * tests: typo in test_xdg * runtime(i3config/swayconfig): update syntax scripts * document pandoc compiler and enable configuring arguments * String interpolation fails for List type * No test for highlight behavior with 'ambiwidth' * tests: test_xdg fails on the appimage repo * tests: some assert_equal() calls have wrong order of args * make install does not install all files * runtime(doc): fix typos in starting.txt - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Fix for bsc#1231373 / CVE-2024-47814. - Fix for bsc#1229238 / CVE-2024-43374. - update to 9.1.0836 * 9.1.0836: The vimtutor can be improved * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu' * 9.1.0834: tests: 2html test fails * 9.1.0833: CI: recent ASAN changes do not work for indent tests * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal * runtime(doc): update help-toc description * runtime(2html): Make links use color scheme colors in TOhtml * 9.1.0831: 'findexpr' can't be used as lambad or Funcref * Filelist: include helptoc package * runtime(doc): include a TOC Vim9 plugin * Filelist: ignore .git-blame-ignore-revs * 9.1.0830: using wrong highlight group for spaces for popupmenu * runtime(typst): synchronize updates from the upstream typst.vim * git: ignore reformatting commit for git-blame (after v9.1.0829) * 9.1.0829: Vim source code uses a mix of tabs and spaces * 9.1.0828: string_T struct could be used more often * 9.1.0827: CI: tests can be improved * runtime(doc): remove stray sentence in pi_netrw.txt * 9.1.0826: filetype: sway files are not recognized * runtime(doc): Include netrw-gp in TOC * runtime(doc): mention 'iskeyword' at :h charclass() * runtime(doc): update help tags * 9.1.0825: compile error for non-diff builds * runtime(netrw): fix E874 when browsing remote directory which contains `~` character * runtime(doc): update coding style documentation * runtime(debversions): Add plucky (25.04) as Ubuntu release name * 9.1.0824: too many strlen() calls in register.c * 9.1.0823: filetype: Zephyr overlay files not recognized * runtime(doc): Clean up minor formatting issues for builtin functions * runtime(netrw): make :Launch/Open autoloadable * runtime(netrw): fix regression with x mapping on Cygwin * runtime(netrw): fix filetype detection for remote files * 9.1.0822: topline might be changed in diff mode unexpectedly * CI: huge linux builds should also run syntax & indent tests * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument * 9.1.0820: tests: Mac OS tests are too flaky * runtime(awk): Highlight more awk comments in syntax script * runtime(netrw): add missing change for s:redir() * 9.1.0819: tests: using findexpr and imported func not tested * runtime(netrw): improve netrw's open-handling further * runtime(netrw): fix syntax error in netrwPlugin.vim * runtime(netrw): simplify gx file handling * 9.1.0818: some global functions are only used in single files * 9.1.0817: termdebug: cannot evaluate expr in a popup * runtime(defaults): Detect putty terminal and switch to dark background * 9.1.0816: tests: not clear what tests cause asan failures * runtime(doc): Remove some completed items from todo.txt * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position * runtime(syntax-tests): tiny vim fails because of line-continuation * 9.1.0814: mapset() may remove unrelated mapping * 9.1.0813: no error handling with setglobal and number types * 9.1.0812: Coverity warns about dereferencing NULL ptr * 9.1.0811: :find expansion does not consider 'findexpr' * 9.1.0810: cannot easily adjust the |:find| command * 9.1.0809: filetype: petalinux config files not recognized * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll' * 9.1.0807: tests: having 'nolist' in modelines isn't always desired * 9.1.0806: tests: no error check when setting global 'briopt' * 9.1.0805: tests: minor issues in gen_opt_test.vim * 9.1.0804: tests: no error check when setting global 'cc' * 9.1.0803: tests: no error check when setting global 'isk' * 9.1.0802: tests: no error check when setting global 'fdm' to empty value * 9.1.0801: tests: no error check when setting global 'termwinkey' * 9.1.0800: tests: no error check when setting global 'termwinsize' * runtime(doc): :ownsyntax also resets 'spelloptions' * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive * runtime(doc): Fix wrong Mac default options * 9.1.0798: too many strlen() calls in cmdhist.c * 9.1.0797: testing of options can be further improved * 9.1.0796: filetype: libtool files are not recognized * (typst): add folding to typst ftplugin * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke() * 9.1.0795: filetype: Vivado memory info file are not recognized * 9.1.0794: tests: tests may fail on Windows environment * runtime(doc): improve the :colorscheme documentation * 9.1.0793: xxd: -e does add one extra space * 9.1.0792: tests: Test_set_values() is not comprehensive enough * runtime(swayconfig): add flag for bindsym/bindcode to syntax script * 9.1.0791: tests: errors in gen_opt_test.vim are not shown * runtime(compiler): check for compile_commands in build dirs for cppcheck * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib) * runtime(help): Update help syntax * runtime(help): fix end of sentence highlight in code examples * runtime(jinja): Support jinja syntax as secondary filetype * 9.1.0789: tests: ':resize + 5' has invalid space after '+' * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot * 9.1.0787: cursor position changed when using hidden terminal * 9.1.0786: tests: quickfix update test does not test location list * runtime(doc): add some docs for file-watcher programs * CI: uploading failed screendumps still fails on Cirrus CI * 9.1.0785: cannot preserve error position when setting quickfix list * 9.1.0784: there are several problems with python 3.13 * 9.1.0783: 'spell' option setting has problems * 9.1.0782: tests: using wrong neomuttlog file name * runtime(doc): add preview flag to statusline example * 9.1.0781: tests: test_filetype fails * 9.1.0780: MS-Windows: incorrect Win32 error checking * 9.1.0779: filetype: neomuttlog files are not recognized * 9.1.0778: filetype: lf config files are not recognized * runtime(comment): fix commment toggle with mixed tabs & spaces * runtime(misc): Use consistent "Vim script" spelling * runtime(gleam): add ftplugin for gleam files * runtime(doc): link help-writing from write-local-help * 9.1.0777: filetype: Some upstream php files are not recognized * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups * runtime(doc): mention conversion rules for remote_expr() * runtime(tutor): Fix missing :s command in spanish translation section 4.4 * 9.1.0776: test_strftime may fail because of missing TZ data * translation(am): Add Armenian language translation * 9.1.0775: tests: not enough tests for setting options * 9.1.0774: "shellcmdline" doesn't work with getcompletion() * 9.1.0773: filetype: some Apache files are not recognized * 9.1.0772: some missing changes from v9.1.0771 * 9.1.0771: completion attribute hl_group is confusing * 9.1.0770: current command line completion is a bit limited * 9.1.0769: filetype: MLIR files are not recognized * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen * runtime(nasm): Update nasm syntax script * 9.1.0767: A condition is always true in ex_getln.c * runtime(skill): Update syntax file to fix string escapes * runtime(help): highlight CTRL-<Key> correctly * runtime(doc): add missing usr_52 entry to toc * 9.1.0766: too many strlen() calls in ex_getln.c * runtime(doc): correct `vi` registers 1-9 documentation error * 9.1.0765: No test for patches 6.2.418 and 7.3.489 * runtime(spec): set comments and commentstring options * NSIS: Include libgcc_s_sjlj-1.dll again * runtime(doc): clarify the effect of 'startofline' option * 9.1.0764: [security]: use-after-free when closing a buffer * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting * 9.1.0763: tests: cannot run single syntax tests * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly * 9.1.0761: :cd completion fails on Windows with backslash in path * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails * 9.1.0759: screenpos() may return invalid position * runtime(misc): unset compiler in various ftplugins * runtime(doc): update formatting and syntax * runtime(compiler): add cppcheck linter compiler plugin * runtime(doc): Fix style in documents * runtime(doc): Fix to two-space convention in user manual * runtime(comment): consider &tabstop in lines after whitespace indent * 9.1.0758: it's possible to set an invalid key to 'wildcharm' * runtime(java): Manage circularity for every :syn-included syntax file * 9.1.0757: tests: messages files contains ANSI escape sequences * 9.1.0756: missing change from patch v9.1.0754 * 9.1.0755: quickfix list does not handle hardlinks well * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters * runtime(systemd): small fixes to &keywordprg in ftplugin * CI: macos-12 runner is being sunset, switch to 13 * 9.1.0754: fixed order of items in insert-mode completion menu * runtime(comment): commenting might be off by one column * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll' * 9.1.0752: can set 'cedit' to an invalid value * runtime(doc): add `usr` tag to usr_toc.txt * 9.1.0751: Error callback for term_start() not used * 9.1.0750: there are some Win9x legacy references * runtime(java): Recognise the CommonMark form (///) of Javadoc comments * 9.1.0749: filetype: http files not recognized * runtime(comment): fix syntax error * CI: uploading failed screendump tests does not work Cirrus * 9.1.0748: :keep* commmands are sometimes misidentified as :k * runtime(indent): allow matching negative numbers for gnu indent config file * runtime(comment): add gC mapping to (un)comment rest of line * 9.1.0747: various typos in repo found * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals * runtime(doc): reformat gnat example * runtime(doc): reformat ada_standard_types section * 9.1.0745: filetype: bun and deno history files not recognized * runtime(glvs): Correct the tag name of glvs-autoinstal * runtime(doc): include short form for :earlier/:later * runtime(doc): remove completed TODO * 9.1.0744: filetype: notmuch configs are not recognised * 9.1.0743: diff mode does not handle overlapping diffs correctly * runtime(glvs): fix a few issues * runtime(doc): Fix typo in :help :command-modifiers * 9.1.0742: getcmdprompt() implementation can be improved * runtime(docs): update `:set?` command behavior table * runtime(doc): update vim90 to vim91 in docs * runtime(doc): fix typo in :h dos-colors * 9.1.0741: No way to get prompt for input()/confirm() * runtime(doc): fix typo in version9.txt nrformat -> nrformats * runtime(rmd,rrst): 'fex' option not properly restored * runtime(netrw): remove extraneous closing bracket * 9.1.0740: incorrect internal diff with empty file * 9.1.0739: [security]: use-after-free in ex_getln.c * runtime(filetype): tests: Test_filetype_detection() fails * runtime(dist): do not output a message if executable is not found * 9.1.0738: filetype: rapid files are not recognized * runtime(modconf): remove erroneous :endif in ftplugin * runtime(lyrics): support multiple timestamps in syntax script * runtime(java): Optionally recognise _module_ import declarations * runtime(vim): Update base-syntax, improve folding function matches * CI: upload failed screendump tests also for Cirrus * 9.1.0737: tests: screendump tests may require a bit more time * runtime(misc): simplify keywordprg in various ftplugins * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels * runtime(zsh,sh): set and unset compiler in ftplugin * runtime(netrw): using inefficient highlight pattern for 'mf' * 9.1.0736: Unicode tables are outdated * 9.1.0735: filetype: salt files are not recognized * 9.1.0734: filetype: jinja files are not recognized * runtime(zathurarc): add double-click-follow to syntax script * translation(ru): Updated messages translation * translation(it): updated xxd man page * translation(ru): updated xxd man page * 9.1.0733: keyword completion does not work with fuzzy * 9.1.0732: xxd: cannot use -b and -i together * runtime(java): Highlight javaConceptKind modifiers with StorageClass * runtime(doc): reword and reformat how to use defaults.vim * 9.1.0731: inconsistent case sensitive extension matching * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return * runtime(netrw): delete confirmation not strict enough * 9.1.0730: Crash with cursor-screenline and narrow window * 9.1.0729: Wrong cursor-screenline when resizing window * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data * runtime(doc): clarify the effect of the timeout for search()-functions * runtime(idlang): update syntax script * runtime(spec): Recognize epoch when making spec changelog in ftplugin * runtime(spec): add file triggers to syntax script * 9.1.0727: too many strlen() calls in option.c * runtime(make): add compiler/make.vim to reset compiler plugin settings * runtime(java): Recognise all available standard doclet tags * 9.1.0726: not using correct python3 API with dynamic linking * runtime(dosini): Update syntax script, spellcheck comments only * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation * 9.1.0725: filetype: swiftinterface files are not recognized * runtime(pandoc): Update compiler plugin to use actual 'spelllang' * runtime(groff): Add compiler plugin for groff * 9.1.0724: if_python: link error with python 3.13 and stable ABI * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13 * 9.1.0722: crash with large id in text_prop interface * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME * runtime(glvs): update GetLatestVimScripts plugin * runtime(doc): Fix typo in :help :hide text * runtime(doc): buffers can be re-used * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid * runtime(doc): Update version9.txt and mention $MYVIMDIR - Update to 9.1.0718: * v9.1.0718: hard to know the users personal Vim Runtime Directory * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers() Maintainers: fix typo in author name * v9.1.0716: resetting setcellwidth( doesn't update the screen runtime(hcl,terraform): Add runtime files for HCL and Terraform runtime(tmux): Update syntax script * v9.1.0715: Not correctly parsing color names (after v9.1.0709) * v9.1.0714: GuiEnter_Turkish test may fail * v9.1.0713: Newline causes E749 in Ex mode * v9.1.0712: missing dependency of Test_gettext_makefile * v9.1.0711: test_xxd may file when using different xxd * v9.1.0710: popup window may hide part of Command line runtime(vim): Update syntax, improve user-command matching * v9.1.0709: GUIEnter event not found in Turkish locale runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items * v9.1.0708: Recursive window update does not account for reset skipcol runtime(nu): include filetype plugin * v9.1.0707: invalid cursor position may cause a crash * v9.1.0706: test_gettext fails when using shadow dir CI: Install locales-all package * v9.1.0705: Sorting of fuzzy filename completion is not stable translation(pt): update Portuguese/Brazilian menu translation runtime(vim): Update base-syntax, match bracket mark ranges runtime(doc): Update :help :command-complete list * v9.1.0704: inserting with a count is inefficient runtime(doc): use mkdir -p to save a command * v9.1.0703: crash with 2byte encoding and glob2regpat() runtime(hollywood): update syn highlight for If-Then statements and For-In-Loops * v9.1.0702: Patch 9.1.0700 broke CI * v9.1.0701: crash with NFA regex engine when searching for composing chars * v9.1.0700: crash with 2byte encoding and glob2regpat() * v9.1.0699: "dvgo" is not always an inclusive motion runtime(java): Provide support for syntax preview features * v9.1.0698: "Untitled" file not removed when running Test_crash1_3 alone * v9.1.0697: heap-buffer-overflow in ins_typebuf * v9.1.0696: installing runtime files fails when using SHADOWDIR runtime(doc): fix typo * v9.1.0695: test_crash leaves Untitled file around translation(br): Update Brazilian translation translation(pt): Update menu_pt_br * v9.1.0694: matchparen is slow on a long line * v9.1.0693: Configure doesn't show result when not using python3 stable abi * v9.1.0692: Wrong patlen value in ex_substitute() * v9.1.0691: stable-abi may cause segfault on Python 3.11 runtime(vim): Update base-syntax, match :loadkeymap after colon and bar runtime(mane): Improve <Plug>ManBS mapping * v9.1.0690: cannot set special highlight kind in popupmenu translation(pt): Revert and fix wrong Portuguese menu translation files translation(pt): revert Portuguese menu translation translation(br): Update Brazilian translations runtime(vim): Update base-syntax, improve :let-heredoc highlighting * v9.1.0689: buffer-overflow in do_search( with 'rightleft' runtime(vim): Improve heredoc handling for all embedded scripts * v9.1.0688: dereferences NULL pointer in check_type_is_value() * v9.1.0687: Makefile may not install desktop files runtime(man): Fix <Plug>ManBS runtime(java): Make the bundled &foldtext function optional runtime(netrw): Change line on `mx` if command output exists runtime(netrw): Fix `mf`-selected entry highlighting runtime(htmlangular): add html syntax highlighting translation(it): Fix filemode of Italian manpages runtime(doc): Update outdated man.vim plugin information runtime(zip): simplify condition to detect MS-Windows * v9.1.0686: zip-plugin has problems with special characters runtime(pandoc): escape quotes in &errorformat for pandoc translation(it): updated Italian manpage * v9.1.0685: too many strlen( calls in usercmd.c runtime(doc): fix grammar in :h :keeppatterns runtime(pandoc): refine pandoc compiler settings * v9.1.0684: completion is inserted on Enter with "noselect" translation(ru): update man pages * v9.1.0683: mode( returns wrong value with <Cmd> mapping runtime(doc): remove trailing whitespace in cmdline.txt * v9.1.0682: Segfault with uninitialized funcref * v9.1.0681: Analyzing failed screendumps is hard runtime(doc): more clarification for the :keeppatterns needed * v9.1.0680: VMS does not have defined uintptr_t runtime(doc): improve typedchar documentation for KeyInputPre autocmd runtime(dist): verify that executable is in $PATH translation(it): update Italian manpages runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677 runtime(doc): update Makefile and make it portable between GNU and BSD * v9.1.0679: Rename from w_closing to w_locked is incomplete runtime(colors): update colorschemes runtime(vim): Update base-syntax, improve :let-heredoc highlighting runtime(doc): Updating the examples in the xxd manpage translation(ru): Updated uganda.rux runtime(yaml): do not re-indent when commenting out lines * v9.1.0678: use-after-free in alist_add() * v9.1.0677 :keepp does not retain the substitute pattern translation(ja): Update Japanese translations to latest release runtime(netrw): Drop committed trace lines runtime(netrw): Error popup not always used runtime(netrw): ErrorMsg( may throw E121 runtime(tutor): update Makefile and make it portable between GNU and BSD translation: improve the po/cleanup.vim script runtime(lang): update Makefile and make it portable between GNU and BSD * v9.1.0676: style issues with man pages * v9.1.0675: Patch v9.1.0674 causes problems runtime(dosbatch): Show %%i as an argument in syntax file runtime(dosbatch): Add syn-sync to syntax file runtime(sql, mysql): fix E169: Command too recursive with sql_type_default = "mysql" * v9.1.0674: compiling abstract method fails because of missing return runtime(javascript): fix a few issues with syntax higlighting runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var runtime(termdebug): Fix wrong test for balloon feature runtime(doc): Remove mentioning of the voting feature runtime(doc): add help tags for json + markdown global variables * v9.1.0673: too recursive func calls when calling super-class method runtime(syntax-tests): Facilitate the viewing of rendered screendumps runtime(doc): fix a few style issues * v9.1.0672: marker folds may get corrupted on undo * v9.1.0671 Problem: crash with WinNewPre autocommand * v9.1.0670: po file encoding fails on *BSD during make translation(it): Update Italian translation translation: Stop using msgconv * v9.1.0669: stable python ABI not used by default Update .gitignore and .hgignore files * v9.1.0668: build-error with python3.12 and stable ABI translations: Update generated po files * v9.1.0667: Some other options reset curswant unnecessarily when set * v9.1.0666: assert_equal( doesn't show multibyte string correctly runtime(doc): clarify directory of Vim's executable vs CWD * v9.1.0665 :for loop runtime(proto): Add indent script for protobuf filetype * v9.1.0664: console vim did not switch back to main screen on exit runtime(zip): zip plugin does not work with Vim 9.0 * v9.1.0663: zip test still resets 'shellslash' option runtime(zip): use defer to restore old settings runtime(zip): add a generic Message function runtime(zip): increment base version of zip plugin runtime(zip): raise minimum Vim version to * v9.0 runtime(zip): refactor save and restore of options runtime(zip): remove test for fnameescape runtime(zip): use :echomsg instead of :echo runtime(zip): clean up and remove comments * v9.1.0662: filecopy( may return wrong value when readlink( fails * v9.1.0661: the zip plugin is not tested. runtime(zip): Fix for FreeBSD's unzip command runtime(doc): capitalize correctly * v9.1.0660: Shift-Insert does work on old conhost translation(it): update Italian manpage runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr runtime(zip): escape '[' on Unix as well * v9.1.0659: MSVC Makefile is a bit hard to read runtime(doc): fix typo in syntax.txt runtime(doc): -x is only available when compiled with crypt feature * v9.1.0658: Coverity warns about dereferencing NULL pointer. runtime(colors): update Todo highlight in habamax colorscheme * v9.1.0657: MSVC build time can be optimized * v9.1.0656: MSVC Makefile CPU handling can be improved * v9.1.0655: goaccess config file not recognized CI: update clang compiler to version 20 runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore` * v9.1.0654: completion does not respect completeslash with fuzzy * v9.1.0653: Patch v9.1.0648 not completely right * v9.1.0652: too many strlen( calls in syntax.c * v9.1.0651 :append * v9.1.0650: Coverity warning in cstrncmp() * v9.1.0649: Wrong comment for "len" argument of call_simple_func() * v9.1.0648: [security] double-free in dialog_changed() * v9.1.0647: [security] use-after-free in tagstack_clear_entry runtime(doc): re-format tag example lines, mention ctags --list-kinds * v9.1.0646: imported function may not be found runtime(java): Document "g:java_space_errors" and "g:java_comment_strings" runtime(java): Cluster optional group definitions and their group links runtime(java): Tidy up the syntax file runtime(java): Tidy up the documentation for "ft-java-syntax" runtime(colors): update habamax scheme - tweak diff/search/todo colors runtime(nohlsearch): add missing loaded_hlsearch guard runtime(kivy): Updated maintainer info for syntax script Maintainers: Add maintainer for ondir ftplugin + syntax files runtime(netrw): removing trailing slash when copying files in same directory * v9.1.0645: wrong match when searching multi-byte char case-insensitive runtime(html): update syntax script to sync by 250 minlines by default * v9.1.0644: Unnecessary STRLEN( when applying mapping runtime(zip): Opening a remote zipfile don't work runtime(cuda): source c and cpp ftplugins * v9.1.0643: cursor may end up on invalid position * v9.1.0642: Check that mapping rhs starts with lhs fails if not simplified * v9.1.0641: OLE enabled in console version runtime(thrift): add ftplugin, indent and syntax scripts * v9.1.0640: Makefile can be improved * v9.1.0639: channel timeout may wrap around * v9.1.0638: E1510 may happen when formatting a message for smsg() * v9.1.0637: Style issues in MSVC Makefile - Update apparmor.vim to latest version (from AppArmor 4.0.2) - add support for "all" and "userns" rules, and new profile flags - Update to 9.1.0636: * 9.1.0636: filetype: ziggy files are not recognized * 9.1.0635: filetype: SuperHTML template files not recognized * 9.1.0634: Ctrl-P not working by default * 9.1.0633: Compilation warnings with `-Wunused-parameter` * 9.1.0632: MS-Windows: Compiler Warnings Add support for Files-Included in syntax script tweak documentation style a bit * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme * 9.1.0629: Rename of pum hl_group is incomplete * 9.1.0628: MinGW: coverage files are not cleaned up * 9.1.0627: MinGW: build-error when COVERAGE is enabled * 9.1.0626: Vim9: need more tests with null objects include initial filetype plugin * 9.1.0625: tests: test output all translated messages for all translations * 9.1.0624: ex command modifiers not found * 9.1.0623: Mingw: errors when trying to delete non-existing files * 9.1.0622: MS-Windows: mingw-build can be optimized * 9.1.0621: MS-Windows: startup code can be improved * 9.1.0620: Vim9: segfauls with null objects * 9.1.0619: tests: test_popup fails * 9.1.0618: cannot mark deprecated attributes in completion menu * 9.1.0617: Cursor moves beyond first line of folded end of buffer * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles * 9.1.0615: Unnecessary STRLEN() in make_percent_swname() Add single-line comment syntax Add syntax test for comments Update maintainer info * 9.1.0614: tests: screendump tests fail due to recent syntax changes * 9.1.0613: tests: termdebug test may fail and leave file around Update base-syntax, improve :set highlighting Optionally highlight the :: token for method references * 9.1.0612: filetype: deno.lock file not recognized Use delete() for deleting directory escape filename before trying to delete it * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys correctly extract file from zip browser * 9.1.0610: filetype: OpenGL Shading Language files are not detected Fix endless recursion in netrw#Explore() * 9.1.0609: outdated comments in Makefile update syntax script Fix flow mapping key detection Remove orphaned YAML syntax dump files * 9.1.0608: Coverity warns about a few potential issues Update syntax script and remove syn sync * 9.1.0607: termdebug: uses inconsistent style * 9.1.0606: tests: generated files may cause failure in test_codestyle * 9.1.0605: internal error with fuzzy completion * 9.1.0604: popup_filter during Press Enter prompt seems to hang translation: Update Serbian messages translation * 9.1.0603: filetype: use correct extension for Dracula * 9.1.0602: filetype: Prolog detection can be improved fix more inconsistencies in assert function docs * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit Update base-syntax, improve :map highlighting * 9.1.0600: Unused function and unused error constants * 9.1.0599: Termdebug: still get E1023 when specifying arguments correct wrong comment options fix typo "a xterm" -> "an xterm" * 9.1.0598: fuzzy completion does not work with default completion * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key * 9.1.0596: filetype: devscripts config files are not recognized gdb file/folder check is now performed only in CWD. quote filename arguments using double quotes update syntax to SDC-standard 2.1 minor updates. Cleanup :match and :loadkeymap syntax test files Update base-syntax, match types in Vim9 variable declarations * 9.1.0595: make errors out with the po Makefile * 9.1.0594: Unnecessary redraw when setting 'winfixbuf' using wrong highlight for UTF-8 include simple syntax plugin * 9.1.0593: filetype: Asymptote files are not recognized add recommended indent options to ftplugin add recommended indent options to ftplugin add recommended indent options to ftplugin * 9.1.0592: filetype: Mediawiki files are not recognized * 9.1.0591: filetype: *.wl files are not recognized * 9.1.0590: Vim9: crash when accessing getregionpos() return value 'cpoptions': Include "z" in the documented default * 9.1.0589: vi: d{motion} and cw work differently than expected update included colorschemes grammar fixes in options.txt - Add "Keywords" to gvim.desktop to make searching for gvim easier - Removed patches, as they're no longer required (refreshing them deleted their contents): * vim-7.3-help_tags.patch * vim-7.4-highlight_fstab.patch - Reorganise all applied patches in the spec file. - Update to 9.1.0588: * 9.1.0588: The maze program no longer compiles on newer clang runtime(typst): Add typst runtime files * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky * 9.1.0586: ocaml runtime files are outdated runtime(termdebug): fix a few issues * 9.1.0585: tests: test_cpoptions leaves swapfiles around * 9.1.0584: Warning about redeclaring f_id() non-static runtime(doc): Add hint how to load termdebug from vimrc runtime(doc): document global insert behavior * 9.1.0583: filetype: *.pdf_tex files are not recognized * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode * 9.1.0581: Various lines are indented inconsistently * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode * 9.1.0579: Ex command is still executed after giving E1247 * 9.1.0578: no tests for :Tohtml * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim * 9.1.0576: tests: still an issue with test_gettext_make * 9.1.0575: Wrong comments in alt_tabpage() * 9.1.0574: ex: wrong handling of commands after bar runtime(doc): add a note for netrw bug reports * 9.1.0573: ex: no implicit print for single addresses runtime(vim): make &indentexpr available from the outside * 9.1.0572: cannot specify tab page closing behaviour runtime(doc): remove obsolete Ex insert behavior * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky runtime(logindefs): update syntax with new keywords * 9.1.0570: tests: test_gettext_make can be improved runtime(filetype): Fix Prolog file detection regex * 9.1.0569: fnamemodify() treats ".." and "../" differently runtime(mojo): include mojo ftplugin and indent script * 9.1.0568: Cannot expand paths from 'cdpath' setting * 9.1.0567: Cannot use relative paths as findfile() stop directories * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash * 9.1.0565: Stop directory doesn't work properly in 'tags' * 9.1.0564: id() can be faster * 9.1.0563: Cannot process any Key event * 9.1.0562: tests: inconsistency in test_findfile.vim runtime(fstab): Add missing keywords to fstab syntax * 9.1.0561: netbeans: variable used un-initialized (Coverity) * 9.1.0560: bindtextdomain() does not indicate an error * 9.1.0559: translation of vim scripts can be improved * 9.1.0558: filetype: prolog detection can be improved * 9.1.0557: moving in the buffer list doesn't work as documented runtime(doc): fix inconsistencies in :h file-searching * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages runtime(htmlangular): correct comment * 9.1.0555: filetype: angular ft detection is still problematic * 9.1.0554: :bw leaves jumplist and tagstack data around * 9.1.0553: filetype: *.mcmeta files are not recognized * 9.1.0552: No test for antlr4 filetype * 9.1.0551: filetype: htmlangular files are not properly detected * 9.1.0550: filetype: antlr4 files are not recognized * 9.1.0549: fuzzycollect regex based completion not working as expected runtime(doc): autocmd_add() accepts a list not a dict * 9.1.0548: it's not possible to get a unique id for some vars runtime(tmux): Update syntax script * 9.1.0547: No way to get the arity of a Vim function * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A runtime(hlsplaylist): include hlsplaylist ftplugin file runtime(doc): fix typo in :h ft-csv-syntax runtime(doc): Correct shell command to get $VIMRUNTIME into shell * 9.1.0545: MSVC conversion warning * 9.1.0544: filetype: ldapconf files are not recognized runtime(cmakecache): include cmakecache ftplugin file runtime(lex): include lex ftplugin file runtime(yacc): include yacc ftplugin file runtime(squirrel): include squirrel ftplugin file runtime(objcpp): include objcpp ftplugin file runtime(tf): include tf ftplugin file runtime(mysql): include mysql ftplugin file runtime(javacc): include javacc ftplugin file runtime(cabal): include cabal ftplugin file runtime(cuda): include CUDA ftplugin file runtime(editorconfig): include editorconfig ftplugin file runtime(kivy): update kivy syntax, include ftplugin runtime(syntax-tests): Stop generating redundant "*_* 99.dump" files * 9.1.0543: Behavior of CursorMovedC is strange runtime(vim): Update base-syntax, improve :match command highlighting * 9.1.0542: Vim9: confusing string() output for object functions * 9.1.0541: failing test with Vim configured without channel * 9.1.0540: Unused assignment in sign_define_cmd() runtime(doc): add page-scrolling keys to index.txt runtime(doc): add reference to xterm-focus-event from FocusGained/Lost * 9.1.0539: Not enough tests for what v9.1.0535 fixed runtime(doc): clarify how to re-init csv syntax file * 9.1.0538: not possible to assign priority when defining a sign * 9.1.0537: signed number detection for CTRL-X/A can be improved * 9.1.0536: filetype: zone files are not recognized * 9.1.0535: newline escape wrong in ex mode runtime(man): honor cmd modifiers before `g:ft_man_open_mode` runtime(man): use `nnoremap` to map to Ex commands * 9.1.0534: completion wrong with fuzzy when cycling back to original runtime(syntax-tests): Abort and report failed cursor progress runtime(syntax-tests): Introduce self tests for screen dumping runtime(syntax-tests): Clear and redraw the ruler line with the shell info runtime(syntax-tests): Allow for folded and wrapped lines in syntax test files * 9.1.0533: Vim9: need more tests for nested objects equality CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries runtime(doc): Remove wrong help tag CTRL-SHIFT-CR * 9.1.0532: filetype: Cedar files not recognized runtime(doc): document further keys that scroll page up/down * 9.1.0531: resource leak in mch_get_random() runtime(tutor): Fix wrong spanish translation runtime(netrw): fix remaining case of register clobber * 9.1.0530: xxd: MSVC warning about non-ASCII character * 9.1.0529: silent! causes following try/catch to not work runtime(rust): use shiftwidth() in indent script * 9.1.0528: spell completion message still wrong in translations * 9.1.0527: inconsistent parameter in Makefiles for Vim executable * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config * 9.1.0525: Right release selects immediately when pum is truncated. * 9.1.0524: the recursive parameter in the *_equal functions can be removed runtime(termdebug): Add Deprecation warnings * 9.1.0523: Vim9: cannot downcast an object * 9.1.0522: Vim9: string(object) hangs for recursive references * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13 * 9.1.0520: Vim9: incorrect type checking for modifying lists runtime(manpager): avoid readonly prompt * 9.1.0519: MS-Windows: libvterm compilation can be optimized * 9.1.0518: initialize the random buffer can be improved * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak runtime(terraform): Add filetype plugin for terraform runtime(dockerfile): enable spellchecking of comments in syntax script runtime(doc): rename variable for pandoc markdown support runtime(doc): In builtin overview use {buf} as param for appendbufline/setbufline runtime(doc): clarify, that register 1-* 9 will always be shifted runtime(netrw): save and restore register 0-* 9, a and unnamed runtime(termdebug): Refactored StartDebug_term and EndDebug functions runtime(java): Compose "g:java_highlight_signature" and "g:java_highlight_functions" * 9.1.0516: need more tests for nested dicts and list comparision * 9.1.0515: Vim9: segfault in object_equal() * 9.1.0514: Vim9: issue with comparing objects recursively runtime(termdebug): Change some variables to Enums runtime(vim): Update base-syntax, fix function tail comments * 9.1.0513: Vim9: segfault with object comparison - Update to 9.1.0512: * Mode message for spell completion doesn't match allowed keys * CursorMovedC triggered wrongly with setcmdpos() * update runtime files * CI: test_gettext fails on MacOS14 + MSVC Win * not possible to translate Vim script messages * termdebug plugin can be further improved * add gomod filetype plugin * hard to detect cursor movement in the command line * Optionally highlight parameterised types * filetype: .envrc & .prettierignore not recognized * filetype: Faust files are not recognized * inner-tag textobject confused about ">" in attributes * cannot use fuzzy keyword completion * Remove the group exclusion list from @javaTop * wrong return type for execute() function * MS-Windows: too much legacy code * too complicated mapping restore in termdebug * simplify mapping * cannot switch buffer in a popup * MS-Windows: doesn't handle symlinks properly * getcmdcompltype() interferes with cmdline completion * termdebug can be further improved * update htmldjango detection * Improve Turkish documentation * include a simple csv filetype and syntax plugin * include the the simple nohlsearch package * matched text is highlighted case-sensitively * Matched text isn't highlighted in cmdline pum * Fix typos in several documents * clarify when text properties are cleared * improve the vim-shebang example * revert unintended formatting changes for termdebug * Add a config variable for commonly used compiler options * Wrong matched text highlighted in pum with 'rightleft' * bump length of character references in syntax script * properly check mapping variables using null_dict * fix KdlIndent and kdlComment in indent script * Test for patch 9.1.0489 doesn't fail without the fix * Fold multi-line comments with the syntax kind of &fdm * using wrong type for PlaceSign() * filetype: Vim-script files not detected by shebang line * revert unintended change to zip#Write() * add another tag for vim-shebang feature * Cmdline pum doesn't work properly with 'rightleft' * minor style problems with patch 9.1.0487 * default completion may break with fuzzy * Wrong padding for pum "kind" with 'rightleft' * Update base-syntax, match shebang lines * MS-Windows: handle files with spaces properly * Restore HTML syntax file tests * completed item not update on fuzzy completion * filetype: Snakemake files are not recognized * make TermDebugSendCommand() a global function again * close all buffers in the same way * Matched text shouldn't be highlighted in "kind" and "menu" * fix wrong helptag for :defer * Update base-syntax, match :sleep arg * include Georgian keymap * Sorting of completeopt+=fuzzy is not stable * correctly test for windows in NetrwGlob() * glob() on windows fails with [] in directory name * rewrite mkdir() doc and simplify {flags} meaning * glob() not sufficiently tested * update return type for job_info() * termdebug plugin needs more love * correct return types for job_start() and job_status() * Update base-syntax, match :catch and :throw args * Include element values in non-marker annotations * Vim9: term_getjob() throws an exception on error * fuzzy string matching executed when not needed * fuzzy_match_str_with_pos() does unnecessary list operations * restore description of "$" in col() and virtcol() * deduplicate getpos(), line(), col(), virtcol() * Update g:vimsyn_comment_strings dump file tests * Use string interpolation instead of string concat * potential deref of NULL pointer in fuzzy_match_str_with_pos * block_editing errors out when using <enter> * Update base-syntax, configurable comment string highlighting * fix typos in syntax.txt * Cannot see matched text in popup menu * Update base-syntax, match multiline continued comments * clarify documentation for "v" position at line() * cmod_split modifier is always reset in term_start() * remove line-continuation characters * use shiftwidth() instead of &tabstop in indent script * Remove orphaned screen dump files * include syntax, indent and ftplugin files * CI: Test_ColonEight() fails on github runners * add missing Enabled field in syntax script * basic svelte ftplugin file * term_start() does not clear vertical modifier * fix mousemodel restoration by comparing against null_string * Added definitions of Vim scripts and plugins * Exclude lambda expressions from _when_ _switch-case_ label clauses * Fix saved_mousemodel check * Inconsistencies between functions for option flags * Crash when using autocmd_get() after removing event inside autocmd * Fix small style issues * add return type info for Vim function descriptions * Update Italian Vim manpage * disable the q mapping * Change 'cms' for C++ to '// %s' * fix type mismatch error * Fix wrong email address * convert termdebug plugin to Vim9 script - Update to 9.1.0470: * tests Test_ColonEight_MultiByte() fails sporadically * Cannot have buffer-local value for 'completeopt' * GvimExt does not consult HKEY_CURRENT_USER * typos in some comments * runtime(vim): Update base-syntax, allow whitespace before :substitute pattern * Missing comments for fuzzy completion * runtime(man): update Vim manpage * runtime(comment): clarify the usage of 'commentstring' option value * runtime(doc): clarify how fuzzy 'completeopt' should work * runtime(netrw): prevent accidental data loss * missing filecopy() function * no whitespace padding in commentstring option in ftplugins * no fuzzy-matching support for insert-completion * eval5() and eval7 are too complex * too many strlen() calls in drawline.c * filetype lintstagedrc files are not recognized * Vim9 import autoload does not work with symlink * Coverity complains about division by zero * tests test_gui fails on Wayland * Left shift is incorrect with vartabstop and shiftwidth=0 * runtime(doc): clarify 'shortmess' flag "S" * MS-Windows compiler warning for size_t to int conversion * runtime(doc): include some vim9 script examples in the help * minor issues in test_filetype with rasi test * filetype rasi files are not recognized * runtime(java): Improve the matching of lambda expressions * Configure checks for libelf unnecessarily * No test for escaping '<' with shellescape() * check.vim complains about overlong comment lines * translation(it): Update Italian translation * evalc. code too complex * MS-Windows Compiler warnings - Update to 9.1.0448: * compiler warning in eval.c * remove remaining css code * Add ft_hare.txt to Reference Manual TOC * re-generate vim syntax from generator * fix syntax vim bug * completion may be wrong when deleting all chars * getregionpos() inconsistent for partly-selected multibyte char * fix highlighting nested and escaped quotes in string props * remove the indent plugin since it has too many issues * update Debian runtime files * Coverity warning after 9.1.0440 * Not enough tests for getregion() with multibyte chars * Can't use blockwise selection with width for getregion() * update outdated syntax files * fix floating_modifier highlight * hare runtime files outdated * getregionpos() can't properly indicate positions beyond eol * function get_lval() is too long * Cannot filter the history * Wrong Ex command executed when :g uses '?' as delimiter * support floating_modifier none; revert broken highlighting * Motif requires non-const char pointer for XPM data * Crash when using '?' as separator for :s * filetype: cygport files are not recognized * make errors trying to access autoload/zig * Wrong yanking with exclusive selection and ve=all * add missing help tags file * Ancient XPM preprocessor hack may cause build errors * include basic rescript ftplugin file * eval.c is too long * getregionpos() doesn't handle one char selection * check for gdb file/dir before using as buffer name * refactor zig ftplugin, remove auto format * Coverity complains about eval.c refactor * Tag guessing leaves wrong search history with very short names * some issues with termdebug mapping test * update matchit plugin to v1.20 * too many strlen() calls in search.c * set commentstring option * update vb indent plugin as vim9script * filetype: purescript files are not recognized * filetype: slint files are not recognized * basic nim ftplugin file for comments * Add Arduino ftplugin and indent files * include basic typst ftplugin file * include basic prisma ftplugin file * include basic v ftplugin for comment support * getregionpos() wrong with blockwise mode and multibyte * function echo_string_core() is too long * hyprlang files are not recognized * add basic dart ftplugin file * basic ftplugin file for graphql * mention comment plugin at :h 'commentstring' * set commentstring for sql files in ftplugin * :browse oldfiles prompts even with single entry * eval.c not sufficiently tested * clarify why E195 is returned * clarify temporary file clean up * fix :NoMatchParen not working * Cannot move to previous/next rare word * add basic ftplugin file for sshdconfig * if_py: find_module has been removed in Python 3.12.0a7 * some screen dump tests can be improved * Some functions are not tested * clarify instal instructions for comment package * Unable to leave long line with 'smoothscroll' and 'scrolloff' * fix typo in vim9script help file * Remove trailing spaces * clarify {special} argument for shellescape() - update to 9.1.0413 * smoothscroll may cause infinite loop * add missing entries for the keys CTRL-W g<Tab> and <C-Tab> * update vi_diff.txt: add default value for 'flash' * typo in regexp_bt.c in DEBUG code * allow indented commands * Fix wrong define regex in ftplugin * Filter out non-Latin-1 characters for syntax tests * prefer scp over pscp * fix typo in usr_52.txt * too long functions in eval.c * warning about uninitialized variable * too many strlen() calls in the regexp engine * E16 fix, async keyword support for define * Stuck with long line and half-page scrolling * Divide by zero with getmousepos() and 'smoothscroll' * update and remove some invalid links * update translation of xxd manpage * Recursively delete directories by default with netrw delete command * Strive to remain compatible for at least Vim 7.0 * tests: xxd buffer overflow fails on 32-bit * Stop handpicking syntax groups for @javaTop * [security] xxd: buffer-overflow with specific flags * Vim9: not able to import file from start dir * filetype: mdd files detected as zsh filetype * filetype: zsh module files are not recognized * Remove hardcoded private.ppk logic from netrw * Vim9: confusing error message for unknown type * block_editing errors out when using del * add new items to scripts section in syntax plugin * Vim9: imported vars are not properly type checked * Wrong display with 'smoothscroll' when changing quickfix list * filetype: jj files are not recognized * getregionpos() may leak memory on error * The CODEOWNERS File is not useful * Remove and cleanup Win9x legacy from netrw * add MsgArea to 'highlight' option description * Cannot get a list of positions describing a region * Fix digit separator in syntax script for octals and floats * Update link to Wikipedia Vi page * clear $MANPAGER in ftplugin before shelling out * Fix typos in help documents * 'viewdir' not respecting $XDG_CONFIG_HOME * tests: Vim9 debug tests may be flaky * correct getscriptinfo() example * Vim9: could improve testing * test_sound fails on macos-12 * update Serbian menu * update Slovak menu * update Slovenian menu * update Portuguese menu * update Dutch menu * update Korean menu * update Icelandic menu * update Czech menu * update Afrikaans menu * update German menu * filetype: inko files are not recognized * filetype: templ files are not recognized * cursor() and getregion() don't handle v:maxcol well * Vim9: null value tests not sufficient * update Catalan menu * filetype: stylus files not recognized * update spanish menu localization * regenerate helptags * Vim9: crash with null_class and null_object * Add tags about lazyloading of menu * tests: vt420 terminfo entry may not be found * filetype: .out files recognized as tex files * filetype: Kbuild files are not recognized * cbuffer and similar commands don't accept a range * Improve the recognition of the "indent" method declarations * Fix a typo in usr_30.txt * remove undefined var s:save_cpoptions and add include setting * missing setlocal in indent plugin * Calculating line height for unnecessary amount of lines * improve syntax file performance * There are a few typos * Vim9: no comments allowed after class vars * CI: remove trailing white space in documentation * Formatting text wrong when 'breakindent' is set * Add oracular (24.10) as Ubuntu release name * Vim9: Trailing commands after class/enum keywords ignored * tests: 1-second delay after Test_BufEnter_botline() * update helptags for jq syntax * include syntax, ftplugin and compiler plugin * fix typo synconcealend -> synconcealed * include a simple comment toggling plugin * wrong botline in BufEnter * clarify syntax vs matching mechanism * fix undefined variable in indent plugin * ops.c code uses too many strlen() calls * Calling CLEAR_FIELD() on the same struct twice * Vim9: compile_def_function() still too long * Update Serbian messages * clarify the effect of setting the shell to powershell * Improve the recognition of the "style" method declarations * Vim9: problem when importing autoloaded scripts * compile_def_function is too long * filetype: ondir files are not recognized * Crash when typing many keys with D- modifier * tests: test_vim9_builtin is a bit slow * update documentation * change the download URL of "libsodium" * tests: test_winfixbuf is a bit slow * Add filetype, syntax and indent plugin for Astro * expanding rc config files does not work well * Vim9: vim9type.c is too complicated * Vim9: does not handle autoloaded variables well * minor spell fix in starting.txt * wrong drawing in GUI with setcellwidth() * Add include and suffixesadd * Page scrolling should place cursor at window boundaries * align command line table * minor fixes to starting.txt * fix comment definition in filetype plugin * filetype: flake.lock files are not recognized * runtime(uci): No support for uci file types * Support "g:ftplugin_java_source_path" with archived files * tests: Test_autoload_import_relative_compiled fails on Windows * Finding cmd modifiers and cmdline-specials is inefficient * No test that completing a partial mapping clears 'showcmd' * tests: test_vim9_dissamble may fail * Vim9: need static type for typealias * X11 does not ignore smooth scroll event * A few typos in test_xdg when testing gvimrc * Patch v9.1.0338 fixed sourcing a script with import * Problem: gvimrc not sourced from XDG_CONFIG_HOME * Cursor wrong after using setcellwidth() in terminal * 'showcmd' wrong for partial mapping with multibyte * tests: test_taglist fails when 'helplang' contains non-english * Problem: a few memory leaks are found * Problem: Error with matchaddpos() and empty list * tests: xdg test uses screen dumps * Vim9: import through symlinks not correctly handled * Missing entry for XDG vimrc file in :version * tests: typo in test_xdg * runtime(i3config/swayconfig): update syntax scripts * document pandoc compiler and enable configuring arguments * String interpolation fails for List type * No test for highlight behavior with 'ambiwidth' * tests: test_xdg fails on the appimage repo * tests: some assert_equal() calls have wrong order of args * make install does not install all files * runtime(doc): fix typos in starting.txt - Add restrict-shell-commands.patch to disable using interfaces in restricted mode, fixes bsc#1172225 CVE-2019-20807 - stop owning /etc/vimrc so the old, distro provided config actually gets removed. Leaving it around leads to a duplicated autocmd for * .spec, leading to spec file template inserted twice. - own some dirs in vim-data-common so installation of vim-small doesn't leave not owned directories (boo#1173256). - Add vi as slave to update-alternatives so that every package has a matching "vi" symlink (bsc#1174564, boo#1176549). - source correct suse.vimrc file (boo#1182324) - install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch) - Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0413.patch - Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c / vim-8.0.1568-CVE-2021-3796.patch - Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch - Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch - Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch - Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch - Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch - Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c / vim-8.0.1568-CVE-2021-3778.patch - Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read / vim-8.0.1568-CVE-2021-4193.patch - Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch - Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch - Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7() / vim-8.0.1568-CVE-2022-0351.patch - Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch - Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c / vim-8.0.1568-CVE-2022-0413.patch - Deleted patches: * restrict-shell-commands.patch * source-check-sandbox.patch * vim-8.0.1568-CVE-2021-3778.patch * vim-8.0.1568-CVE-2021-3796.patch * vim-8.0.1568-CVE-2021-3872.patch * vim-8.0.1568-CVE-2021-3927.patch * vim-8.0.1568-CVE-2021-3928.patch * vim-8.0.1568-CVE-2021-3984.patch * vim-8.0.1568-CVE-2021-4019.patch * vim-8.0.1568-CVE-2021-4193.patch * vim-8.0.1568-CVE-2021-46059.patch * vim-8.0.1568-CVE-2022-0319.patch * vim-8.0.1568-CVE-2022-0351.patch * vim-8.0.1568-CVE-2022-0361.patch * vim-8.0.1568-CVE-2022-0413.patch * vim-8.0.1568-globalvimrc.patch - Added patches: * vim-8.1.0297-dump3.patch * vim-8.2.2411-globalvimrc.patch * disable-unreliable-tests-arch.patch - Updated patches: * disable-unreliable-tests.patch * vim-7.3-filetype_changes.patch * vim-7.3-filetype_ftl.patch * vim-7.3-filetype_spec.patch * vim-7.3-gvimrc_fontset.patch * vim-7.3-help_tags.patch * vim-7.3-mktemp_tutor.patch * vim-7.3-name_vimrc.patch * vim-7.3-sh_is_bash.patch * vim-7.3-use_awk.patch * vim-7.4-disable_lang_no.patch * vim-7.4-filetype_apparmor.patch * vim-7.4-filetype_mine.patch * vim-7.4-highlight_fstab.patch * vim-8.0-ttytype-test.patch * vim-8.0.1568-defaults.patch * vim73-no-static-libpython.patch - Updated to version 8.2 with patch level 5038, fixes the following problems * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use After Free * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open() in src/ex_docmd.c * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to Out-of-bounds Read * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to Heap-based Buffer Overflow * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in vim prior to 8.2. * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in init_ccline() in ex_getln.c * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in Conda vim prior to 8.2. * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow in skip_range * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in append_command * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in function cmdline_erase_chars * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in function vim_regexec_string * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in find_pattern_in_path * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior to 8.2 * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior to 8.2 * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a .swp file to the editor's primary group, which allows local users to obtain sensitive information * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to Out-of-bounds Read * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow in vim prior to 8.2 * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in vim prior to 8.2 * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in cindent.c * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior to 8.2. * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read - Updated to version 9.0 with patch level 0313, fixes the following problems * Fixing bsc#1200884 Vim: Error on startup * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32 * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37 * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37 * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl() * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044 * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045 * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046. * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock() * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar() * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote() * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent() * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both() * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name() * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc() * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len() * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes() * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk() * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite() * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int() * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check() * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs() * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special() * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr() * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line() * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string() * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr() * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails() * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet() * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function() * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len() * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar() * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240 * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00 - Updated to version 9.0 with patch level 0814, fixes the following problems * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483. * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490. * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598. * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer() * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag() * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse() * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321 - ignore-flaky-test-failure.patch: Ignore failure of flaky tests - disable-unreliable-tests-arch.patch: Removed - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814 - Updated to version 9.0 with patch level 1040, fixes the following security problems * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882. * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.814...v9.0.1040 - Updated to version 9.0 with patch level 1234, fixes the following security problems * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225 * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. - refreshed vim-7.4-highlight_fstab.patch - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234 - Updated to version 9.0 with patch level 1386, fixes the following security problems * Fixing bsc#1207780 - (CVE-2023-0512) VUL-0: CVE-2023-0512: vim: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247 * Fixing bsc#1208957 - (CVE-2023-1175) VUL-0: CVE-2023-1175: vim: Incorrect Calculation of Buffer Size * Fixing bsc#1208959 - (CVE-2023-1170) VUL-0: CVE-2023-1170: vim: Heap-based Buffer Overflow in vim prior to 9.0.1376 * Fixing bsc#1208828 - (CVE-2023-1127) VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386 - Updated to version 9.0 with patch level 1443, fixes the following security problems * Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392 * Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402. * Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown() - drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we remove during %prep anyway. And this breaks quilt setup. - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1386...v9.0.1443 - Fixing bsc#1211144 - [Build 96.1] openQA test fails in zypper_migration - conflict between xxd and vim * Revert the creation standalone xxd packages - Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm * Add: reorder-exit-raw-mode.patch * Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit. - Updated to version 9.0 with patch level 1572, fixes the following security problems * Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. * Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531 * Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1572 - Use app icon generated from vimlogo.eps in source tarball; add higher res icons of sizes 128, 256, and 512px as png sources. Our current icons deviate from upstream flatpaks for example. - Updated to version 9.0 with patch level 1632 - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1632 - Updated to version 9.0 with patch level 2103, fixes the following security problems * Fixing bsc#1215940 (CVE-2023-5344) - VUL-0: CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969. * Fixing bsc#1216001 (CVE-2023-5441) - VUL-0: CVE-2023-5441: vim: segfault in exmode when redrawing * Fixing bsc#1216167 (CVE-2023-5535) - VUL-0: CVE-2023-5535: vim: use-after-free from buf_contents_changed() * Fixing bsc#1216696 (CVE-2023-46246) - VUL-0: CVE-2023-46246: vim: Integer Overflow in :history command * Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both * Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c * Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand * Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos * Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp * Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both - drop patches: disable-unreliable-tests.patch ignore-flaky-test-failure.patch vim-8.1.0297-dump3.patch - dropped %check - most of tests didn't work correctly in OBS and maintenance burden of this was getting too big - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1632...v9.0.2103 - Updated to version 9.1 with patch level 0111, fixes the following security problems * Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close() * Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol() * Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command * Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count * Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing * Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number * Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line * Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute * Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c * Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix - for the complete list of changes see https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111 - Updated to version 9.1 with patch level 0330, fixes the following problems * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1 - refreshed vim-7.3-filetype_spec.patch - refreshed vim-7.3-filetype_ftl.patch - Update spec.skeleton to use autosetup in place of setup macro. - for the complete list of changes see https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330 - Fix for bsc#1231373 / CVE-2024-47814. - Fix for bsc#1229238 / CVE-2024-43374. - update to 9.1.0836 * 9.1.0836: The vimtutor can be improved * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu' * 9.1.0834: tests: 2html test fails * 9.1.0833: CI: recent ASAN changes do not work for indent tests * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal * runtime(doc): update help-toc description * runtime(2html): Make links use color scheme colors in TOhtml * 9.1.0831: 'findexpr' can't be used as lambad or Funcref * Filelist: include helptoc package * runtime(doc): include a TOC Vim9 plugin * Filelist: ignore .git-blame-ignore-revs * 9.1.0830: using wrong highlight group for spaces for popupmenu * runtime(typst): synchronize updates from the upstream typst.vim * git: ignore reformatting commit for git-blame (after v9.1.0829) * 9.1.0829: Vim source code uses a mix of tabs and spaces * 9.1.0828: string_T struct could be used more often * 9.1.0827: CI: tests can be improved * runtime(doc): remove stray sentence in pi_netrw.txt * 9.1.0826: filetype: sway files are not recognized * runtime(doc): Include netrw-gp in TOC * runtime(doc): mention 'iskeyword' at :h charclass() * runtime(doc): update help tags * 9.1.0825: compile error for non-diff builds * runtime(netrw): fix E874 when browsing remote directory which contains `~` character * runtime(doc): update coding style documentation * runtime(debversions): Add plucky (25.04) as Ubuntu release name * 9.1.0824: too many strlen() calls in register.c * 9.1.0823: filetype: Zephyr overlay files not recognized * runtime(doc): Clean up minor formatting issues for builtin functions * runtime(netrw): make :Launch/Open autoloadable * runtime(netrw): fix regression with x mapping on Cygwin * runtime(netrw): fix filetype detection for remote files * 9.1.0822: topline might be changed in diff mode unexpectedly * CI: huge linux builds should also run syntax & indent tests * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument * 9.1.0820: tests: Mac OS tests are too flaky * runtime(awk): Highlight more awk comments in syntax script * runtime(netrw): add missing change for s:redir() * 9.1.0819: tests: using findexpr and imported func not tested * runtime(netrw): improve netrw's open-handling further * runtime(netrw): fix syntax error in netrwPlugin.vim * runtime(netrw): simplify gx file handling * 9.1.0818: some global functions are only used in single files * 9.1.0817: termdebug: cannot evaluate expr in a popup * runtime(defaults): Detect putty terminal and switch to dark background * 9.1.0816: tests: not clear what tests cause asan failures * runtime(doc): Remove some completed items from todo.txt * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position * runtime(syntax-tests): tiny vim fails because of line-continuation * 9.1.0814: mapset() may remove unrelated mapping * 9.1.0813: no error handling with setglobal and number types * 9.1.0812: Coverity warns about dereferencing NULL ptr * 9.1.0811: :find expansion does not consider 'findexpr' * 9.1.0810: cannot easily adjust the |:find| command * 9.1.0809: filetype: petalinux config files not recognized * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll' * 9.1.0807: tests: having 'nolist' in modelines isn't always desired * 9.1.0806: tests: no error check when setting global 'briopt' * 9.1.0805: tests: minor issues in gen_opt_test.vim * 9.1.0804: tests: no error check when setting global 'cc' * 9.1.0803: tests: no error check when setting global 'isk' * 9.1.0802: tests: no error check when setting global 'fdm' to empty value * 9.1.0801: tests: no error check when setting global 'termwinkey' * 9.1.0800: tests: no error check when setting global 'termwinsize' * runtime(doc): :ownsyntax also resets 'spelloptions' * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive * runtime(doc): Fix wrong Mac default options * 9.1.0798: too many strlen() calls in cmdhist.c * 9.1.0797: testing of options can be further improved * 9.1.0796: filetype: libtool files are not recognized * (typst): add folding to typst ftplugin * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke() * 9.1.0795: filetype: Vivado memory info file are not recognized * 9.1.0794: tests: tests may fail on Windows environment * runtime(doc): improve the :colorscheme documentation * 9.1.0793: xxd: -e does add one extra space * 9.1.0792: tests: Test_set_values() is not comprehensive enough * runtime(swayconfig): add flag for bindsym/bindcode to syntax script * 9.1.0791: tests: errors in gen_opt_test.vim are not shown * runtime(compiler): check for compile_commands in build dirs for cppcheck * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib) * runtime(help): Update help syntax * runtime(help): fix end of sentence highlight in code examples * runtime(jinja): Support jinja syntax as secondary filetype * 9.1.0789: tests: ':resize + 5' has invalid space after '+' * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot * 9.1.0787: cursor position changed when using hidden terminal * 9.1.0786: tests: quickfix update test does not test location list * runtime(doc): add some docs for file-watcher programs * CI: uploading failed screendumps still fails on Cirrus CI * 9.1.0785: cannot preserve error position when setting quickfix list * 9.1.0784: there are several problems with python 3.13 * 9.1.0783: 'spell' option setting has problems * 9.1.0782: tests: using wrong neomuttlog file name * runtime(doc): add preview flag to statusline example * 9.1.0781: tests: test_filetype fails * 9.1.0780: MS-Windows: incorrect Win32 error checking * 9.1.0779: filetype: neomuttlog files are not recognized * 9.1.0778: filetype: lf config files are not recognized * runtime(comment): fix commment toggle with mixed tabs & spaces * runtime(misc): Use consistent "Vim script" spelling * runtime(gleam): add ftplugin for gleam files * runtime(doc): link help-writing from write-local-help * 9.1.0777: filetype: Some upstream php files are not recognized * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups * runtime(doc): mention conversion rules for remote_expr() * runtime(tutor): Fix missing :s command in spanish translation section 4.4 * 9.1.0776: test_strftime may fail because of missing TZ data * translation(am): Add Armenian language translation * 9.1.0775: tests: not enough tests for setting options * 9.1.0774: "shellcmdline" doesn't work with getcompletion() * 9.1.0773: filetype: some Apache files are not recognized * 9.1.0772: some missing changes from v9.1.0771 * 9.1.0771: completion attribute hl_group is confusing * 9.1.0770: current command line completion is a bit limited * 9.1.0769: filetype: MLIR files are not recognized * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen * runtime(nasm): Update nasm syntax script * 9.1.0767: A condition is always true in ex_getln.c * runtime(skill): Update syntax file to fix string escapes * runtime(help): highlight CTRL-<Key> correctly * runtime(doc): add missing usr_52 entry to toc * 9.1.0766: too many strlen() calls in ex_getln.c * runtime(doc): correct `vi` registers 1-9 documentation error * 9.1.0765: No test for patches 6.2.418 and 7.3.489 * runtime(spec): set comments and commentstring options * NSIS: Include libgcc_s_sjlj-1.dll again * runtime(doc): clarify the effect of 'startofline' option * 9.1.0764: [security]: use-after-free when closing a buffer * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting * 9.1.0763: tests: cannot run single syntax tests * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly * 9.1.0761: :cd completion fails on Windows with backslash in path * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails * 9.1.0759: screenpos() may return invalid position * runtime(misc): unset compiler in various ftplugins * runtime(doc): update formatting and syntax * runtime(compiler): add cppcheck linter compiler plugin * runtime(doc): Fix style in documents * runtime(doc): Fix to two-space convention in user manual * runtime(comment): consider &tabstop in lines after whitespace indent * 9.1.0758: it's possible to set an invalid key to 'wildcharm' * runtime(java): Manage circularity for every :syn-included syntax file * 9.1.0757: tests: messages files contains ANSI escape sequences * 9.1.0756: missing change from patch v9.1.0754 * 9.1.0755: quickfix list does not handle hardlinks well * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters * runtime(systemd): small fixes to &keywordprg in ftplugin * CI: macos-12 runner is being sunset, switch to 13 * 9.1.0754: fixed order of items in insert-mode completion menu * runtime(comment): commenting might be off by one column * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll' * 9.1.0752: can set 'cedit' to an invalid value * runtime(doc): add `usr` tag to usr_toc.txt * 9.1.0751: Error callback for term_start() not used * 9.1.0750: there are some Win9x legacy references * runtime(java): Recognise the CommonMark form (///) of Javadoc comments * 9.1.0749: filetype: http files not recognized * runtime(comment): fix syntax error * CI: uploading failed screendump tests does not work Cirrus * 9.1.0748: :keep* commmands are sometimes misidentified as :k * runtime(indent): allow matching negative numbers for gnu indent config file * runtime(comment): add gC mapping to (un)comment rest of line * 9.1.0747: various typos in repo found * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals * runtime(doc): reformat gnat example * runtime(doc): reformat ada_standard_types section * 9.1.0745: filetype: bun and deno history files not recognized * runtime(glvs): Correct the tag name of glvs-autoinstal * runtime(doc): include short form for :earlier/:later * runtime(doc): remove completed TODO * 9.1.0744: filetype: notmuch configs are not recognised * 9.1.0743: diff mode does not handle overlapping diffs correctly * runtime(glvs): fix a few issues * runtime(doc): Fix typo in :help :command-modifiers * 9.1.0742: getcmdprompt() implementation can be improved * runtime(docs): update `:set?` command behavior table * runtime(doc): update vim90 to vim91 in docs * runtime(doc): fix typo in :h dos-colors * 9.1.0741: No way to get prompt for input()/confirm() * runtime(doc): fix typo in version9.txt nrformat -> nrformats * runtime(rmd,rrst): 'fex' option not properly restored * runtime(netrw): remove extraneous closing bracket * 9.1.0740: incorrect internal diff with empty file * 9.1.0739: [security]: use-after-free in ex_getln.c * runtime(filetype): tests: Test_filetype_detection() fails * runtime(dist): do not output a message if executable is not found * 9.1.0738: filetype: rapid files are not recognized * runtime(modconf): remove erroneous :endif in ftplugin * runtime(lyrics): support multiple timestamps in syntax script * runtime(java): Optionally recognise _module_ import declarations * runtime(vim): Update base-syntax, improve folding function matches * CI: upload failed screendump tests also for Cirrus * 9.1.0737: tests: screendump tests may require a bit more time * runtime(misc): simplify keywordprg in various ftplugins * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels * runtime(zsh,sh): set and unset compiler in ftplugin * runtime(netrw): using inefficient highlight pattern for 'mf' * 9.1.0736: Unicode tables are outdated * 9.1.0735: filetype: salt files are not recognized * 9.1.0734: filetype: jinja files are not recognized * runtime(zathurarc): add double-click-follow to syntax script * translation(ru): Updated messages translation * translation(it): updated xxd man page * translation(ru): updated xxd man page * 9.1.0733: keyword completion does not work with fuzzy * 9.1.0732: xxd: cannot use -b and -i together * runtime(java): Highlight javaConceptKind modifiers with StorageClass * runtime(doc): reword and reformat how to use defaults.vim * 9.1.0731: inconsistent case sensitive extension matching * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return * runtime(netrw): delete confirmation not strict enough * 9.1.0730: Crash with cursor-screenline and narrow window * 9.1.0729: Wrong cursor-screenline when resizing window * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data * runtime(doc): clarify the effect of the timeout for search()-functions * runtime(idlang): update syntax script * runtime(spec): Recognize epoch when making spec changelog in ftplugin * runtime(spec): add file triggers to syntax script * 9.1.0727: too many strlen() calls in option.c * runtime(make): add compiler/make.vim to reset compiler plugin settings * runtime(java): Recognise all available standard doclet tags * 9.1.0726: not using correct python3 API with dynamic linking * runtime(dosini): Update syntax script, spellcheck comments only * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation * 9.1.0725: filetype: swiftinterface files are not recognized * runtime(pandoc): Update compiler plugin to use actual 'spelllang' * runtime(groff): Add compiler plugin for groff * 9.1.0724: if_python: link error with python 3.13 and stable ABI * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13 * 9.1.0722: crash with large id in text_prop interface * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME * runtime(glvs): update GetLatestVimScripts plugin * runtime(doc): Fix typo in :help :hide text * runtime(doc): buffers can be re-used * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid * runtime(doc): Update version9.txt and mention $MYVIMDIR - Update to 9.1.0718: * v9.1.0718: hard to know the users personal Vim Runtime Directory * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers() Maintainers: fix typo in author name * v9.1.0716: resetting setcellwidth( doesn't update the screen runtime(hcl,terraform): Add runtime files for HCL and Terraform runtime(tmux): Update syntax script * v9.1.0715: Not correctly parsing color names (after v9.1.0709) * v9.1.0714: GuiEnter_Turkish test may fail * v9.1.0713: Newline causes E749 in Ex mode * v9.1.0712: missing dependency of Test_gettext_makefile * v9.1.0711: test_xxd may file when using different xxd * v9.1.0710: popup window may hide part of Command line runtime(vim): Update syntax, improve user-command matching * v9.1.0709: GUIEnter event not found in Turkish locale runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items * v9.1.0708: Recursive window update does not account for reset skipcol runtime(nu): include filetype plugin * v9.1.0707: invalid cursor position may cause a crash * v9.1.0706: test_gettext fails when using shadow dir CI: Install locales-all package * v9.1.0705: Sorting of fuzzy filename completion is not stable translation(pt): update Portuguese/Brazilian menu translation runtime(vim): Update base-syntax, match bracket mark ranges runtime(doc): Update :help :command-complete list * v9.1.0704: inserting with a count is inefficient runtime(doc): use mkdir -p to save a command * v9.1.0703: crash with 2byte encoding and glob2regpat() runtime(hollywood): update syn highlight for If-Then statements and For-In-Loops * v9.1.0702: Patch 9.1.0700 broke CI * v9.1.0701: crash with NFA regex engine when searching for composing chars * v9.1.0700: crash with 2byte encoding and glob2regpat() * v9.1.0699: "dvgo" is not always an inclusive motion runtime(java): Provide support for syntax preview features * v9.1.0698: "Untitled" file not removed when running Test_crash1_3 alone * v9.1.0697: heap-buffer-overflow in ins_typebuf * v9.1.0696: installing runtime files fails when using SHADOWDIR runtime(doc): fix typo * v9.1.0695: test_crash leaves Untitled file around translation(br): Update Brazilian translation translation(pt): Update menu_pt_br * v9.1.0694: matchparen is slow on a long line * v9.1.0693: Configure doesn't show result when not using python3 stable abi * v9.1.0692: Wrong patlen value in ex_substitute() * v9.1.0691: stable-abi may cause segfault on Python 3.11 runtime(vim): Update base-syntax, match :loadkeymap after colon and bar runtime(mane): Improve <Plug>ManBS mapping * v9.1.0690: cannot set special highlight kind in popupmenu translation(pt): Revert and fix wrong Portuguese menu translation files translation(pt): revert Portuguese menu translation translation(br): Update Brazilian translations runtime(vim): Update base-syntax, improve :let-heredoc highlighting * v9.1.0689: buffer-overflow in do_search( with 'rightleft' runtime(vim): Improve heredoc handling for all embedded scripts * v9.1.0688: dereferences NULL pointer in check_type_is_value() * v9.1.0687: Makefile may not install desktop files runtime(man): Fix <Plug>ManBS runtime(java): Make the bundled &foldtext function optional runtime(netrw): Change line on `mx` if command output exists runtime(netrw): Fix `mf`-selected entry highlighting runtime(htmlangular): add html syntax highlighting translation(it): Fix filemode of Italian manpages runtime(doc): Update outdated man.vim plugin information runtime(zip): simplify condition to detect MS-Windows * v9.1.0686: zip-plugin has problems with special characters runtime(pandoc): escape quotes in &errorformat for pandoc translation(it): updated Italian manpage * v9.1.0685: too many strlen( calls in usercmd.c runtime(doc): fix grammar in :h :keeppatterns runtime(pandoc): refine pandoc compiler settings * v9.1.0684: completion is inserted on Enter with "noselect" translation(ru): update man pages * v9.1.0683: mode( returns wrong value with <Cmd> mapping runtime(doc): remove trailing whitespace in cmdline.txt * v9.1.0682: Segfault with uninitialized funcref * v9.1.0681: Analyzing failed screendumps is hard runtime(doc): more clarification for the :keeppatterns needed * v9.1.0680: VMS does not have defined uintptr_t runtime(doc): improve typedchar documentation for KeyInputPre autocmd runtime(dist): verify that executable is in $PATH translation(it): update Italian manpages runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677 runtime(doc): update Makefile and make it portable between GNU and BSD * v9.1.0679: Rename from w_closing to w_locked is incomplete runtime(colors): update colorschemes runtime(vim): Update base-syntax, improve :let-heredoc highlighting runtime(doc): Updating the examples in the xxd manpage translation(ru): Updated uganda.rux runtime(yaml): do not re-indent when commenting out lines * v9.1.0678: use-after-free in alist_add() * v9.1.0677 :keepp does not retain the substitute pattern translation(ja): Update Japanese translations to latest release runtime(netrw): Drop committed trace lines runtime(netrw): Error popup not always used runtime(netrw): ErrorMsg( may throw E121 runtime(tutor): update Makefile and make it portable between GNU and BSD translation: improve the po/cleanup.vim script runtime(lang): update Makefile and make it portable between GNU and BSD * v9.1.0676: style issues with man pages * v9.1.0675: Patch v9.1.0674 causes problems runtime(dosbatch): Show %%i as an argument in syntax file runtime(dosbatch): Add syn-sync to syntax file runtime(sql, mysql): fix E169: Command too recursive with sql_type_default = "mysql" * v9.1.0674: compiling abstract method fails because of missing return runtime(javascript): fix a few issues with syntax higlighting runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var runtime(termdebug): Fix wrong test for balloon feature runtime(doc): Remove mentioning of the voting feature runtime(doc): add help tags for json + markdown global variables * v9.1.0673: too recursive func calls when calling super-class method runtime(syntax-tests): Facilitate the viewing of rendered screendumps runtime(doc): fix a few style issues * v9.1.0672: marker folds may get corrupted on undo * v9.1.0671 Problem: crash with WinNewPre autocommand * v9.1.0670: po file encoding fails on *BSD during make translation(it): Update Italian translation translation: Stop using msgconv * v9.1.0669: stable python ABI not used by default Update .gitignore and .hgignore files * v9.1.0668: build-error with python3.12 and stable ABI translations: Update generated po files * v9.1.0667: Some other options reset curswant unnecessarily when set * v9.1.0666: assert_equal( doesn't show multibyte string correctly runtime(doc): clarify directory of Vim's executable vs CWD * v9.1.0665 :for loop runtime(proto): Add indent script for protobuf filetype * v9.1.0664: console vim did not switch back to main screen on exit runtime(zip): zip plugin does not work with Vim 9.0 * v9.1.0663: zip test still resets 'shellslash' option runtime(zip): use defer to restore old settings runtime(zip): add a generic Message function runtime(zip): increment base version of zip plugin runtime(zip): raise minimum Vim version to * v9.0 runtime(zip): refactor save and restore of options runtime(zip): remove test for fnameescape runtime(zip): use :echomsg instead of :echo runtime(zip): clean up and remove comments * v9.1.0662: filecopy( may return wrong value when readlink( fails * v9.1.0661: the zip plugin is not tested. runtime(zip): Fix for FreeBSD's unzip command runtime(doc): capitalize correctly * v9.1.0660: Shift-Insert does work on old conhost translation(it): update Italian manpage runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr runtime(zip): escape '[' on Unix as well * v9.1.0659: MSVC Makefile is a bit hard to read runtime(doc): fix typo in syntax.txt runtime(doc): -x is only available when compiled with crypt feature * v9.1.0658: Coverity warns about dereferencing NULL pointer. runtime(colors): update Todo highlight in habamax colorscheme * v9.1.0657: MSVC build time can be optimized * v9.1.0656: MSVC Makefile CPU handling can be improved * v9.1.0655: goaccess config file not recognized CI: update clang compiler to version 20 runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore` * v9.1.0654: completion does not respect completeslash with fuzzy * v9.1.0653: Patch v9.1.0648 not completely right * v9.1.0652: too many strlen( calls in syntax.c * v9.1.0651 :append * v9.1.0650: Coverity warning in cstrncmp() * v9.1.0649: Wrong comment for "len" argument of call_simple_func() * v9.1.0648: [security] double-free in dialog_changed() * v9.1.0647: [security] use-after-free in tagstack_clear_entry runtime(doc): re-format tag example lines, mention ctags --list-kinds * v9.1.0646: imported function may not be found runtime(java): Document "g:java_space_errors" and "g:java_comment_strings" runtime(java): Cluster optional group definitions and their group links runtime(java): Tidy up the syntax file runtime(java): Tidy up the documentation for "ft-java-syntax" runtime(colors): update habamax scheme - tweak diff/search/todo colors runtime(nohlsearch): add missing loaded_hlsearch guard runtime(kivy): Updated maintainer info for syntax script Maintainers: Add maintainer for ondir ftplugin + syntax files runtime(netrw): removing trailing slash when copying files in same directory * v9.1.0645: wrong match when searching multi-byte char case-insensitive runtime(html): update syntax script to sync by 250 minlines by default * v9.1.0644: Unnecessary STRLEN( when applying mapping runtime(zip): Opening a remote zipfile don't work runtime(cuda): source c and cpp ftplugins * v9.1.0643: cursor may end up on invalid position * v9.1.0642: Check that mapping rhs starts with lhs fails if not simplified * v9.1.0641: OLE enabled in console version runtime(thrift): add ftplugin, indent and syntax scripts * v9.1.0640: Makefile can be improved * v9.1.0639: channel timeout may wrap around * v9.1.0638: E1510 may happen when formatting a message for smsg() * v9.1.0637: Style issues in MSVC Makefile - Update apparmor.vim to latest version (from AppArmor 4.0.2) - add support for "all" and "userns" rules, and new profile flags - Update to 9.1.0636: * 9.1.0636: filetype: ziggy files are not recognized * 9.1.0635: filetype: SuperHTML template files not recognized * 9.1.0634: Ctrl-P not working by default * 9.1.0633: Compilation warnings with `-Wunused-parameter` * 9.1.0632: MS-Windows: Compiler Warnings Add support for Files-Included in syntax script tweak documentation style a bit * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme * 9.1.0629: Rename of pum hl_group is incomplete * 9.1.0628: MinGW: coverage files are not cleaned up * 9.1.0627: MinGW: build-error when COVERAGE is enabled * 9.1.0626: Vim9: need more tests with null objects include initial filetype plugin * 9.1.0625: tests: test output all translated messages for all translations * 9.1.0624: ex command modifiers not found * 9.1.0623: Mingw: errors when trying to delete non-existing files * 9.1.0622: MS-Windows: mingw-build can be optimized * 9.1.0621: MS-Windows: startup code can be improved * 9.1.0620: Vim9: segfauls with null objects * 9.1.0619: tests: test_popup fails * 9.1.0618: cannot mark deprecated attributes in completion menu * 9.1.0617: Cursor moves beyond first line of folded end of buffer * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles * 9.1.0615: Unnecessary STRLEN() in make_percent_swname() Add single-line comment syntax Add syntax test for comments Update maintainer info * 9.1.0614: tests: screendump tests fail due to recent syntax changes * 9.1.0613: tests: termdebug test may fail and leave file around Update base-syntax, improve :set highlighting Optionally highlight the :: token for method references * 9.1.0612: filetype: deno.lock file not recognized Use delete() for deleting directory escape filename before trying to delete it * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys correctly extract file from zip browser * 9.1.0610: filetype: OpenGL Shading Language files are not detected Fix endless recursion in netrw#Explore() * 9.1.0609: outdated comments in Makefile update syntax script Fix flow mapping key detection Remove orphaned YAML syntax dump files * 9.1.0608: Coverity warns about a few potential issues Update syntax script and remove syn sync * 9.1.0607: termdebug: uses inconsistent style * 9.1.0606: tests: generated files may cause failure in test_codestyle * 9.1.0605: internal error with fuzzy completion * 9.1.0604: popup_filter during Press Enter prompt seems to hang translation: Update Serbian messages translation * 9.1.0603: filetype: use correct extension for Dracula * 9.1.0602: filetype: Prolog detection can be improved fix more inconsistencies in assert function docs * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit Update base-syntax, improve :map highlighting * 9.1.0600: Unused function and unused error constants * 9.1.0599: Termdebug: still get E1023 when specifying arguments correct wrong comment options fix typo "a xterm" -> "an xterm" * 9.1.0598: fuzzy completion does not work with default completion * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key * 9.1.0596: filetype: devscripts config files are not recognized gdb file/folder check is now performed only in CWD. quote filename arguments using double quotes update syntax to SDC-standard 2.1 minor updates. Cleanup :match and :loadkeymap syntax test files Update base-syntax, match types in Vim9 variable declarations * 9.1.0595: make errors out with the po Makefile * 9.1.0594: Unnecessary redraw when setting 'winfixbuf' using wrong highlight for UTF-8 include simple syntax plugin * 9.1.0593: filetype: Asymptote files are not recognized add recommended indent options to ftplugin add recommended indent options to ftplugin add recommended indent options to ftplugin * 9.1.0592: filetype: Mediawiki files are not recognized * 9.1.0591: filetype: *.wl files are not recognized * 9.1.0590: Vim9: crash when accessing getregionpos() return value 'cpoptions': Include "z" in the documented default * 9.1.0589: vi: d{motion} and cw work differently than expected update included colorschemes grammar fixes in options.txt - Add "Keywords" to gvim.desktop to make searching for gvim easier - Removed patches, as they're no longer required (refreshing them deleted their contents): * vim-7.3-help_tags.patch * vim-7.4-highlight_fstab.patch - Reorganise all applied patches in the spec file. - Update to 9.1.0588: * 9.1.0588: The maze program no longer compiles on newer clang runtime(typst): Add typst runtime files * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky * 9.1.0586: ocaml runtime files are outdated runtime(termdebug): fix a few issues * 9.1.0585: tests: test_cpoptions leaves swapfiles around * 9.1.0584: Warning about redeclaring f_id() non-static runtime(doc): Add hint how to load termdebug from vimrc runtime(doc): document global insert behavior * 9.1.0583: filetype: *.pdf_tex files are not recognized * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode * 9.1.0581: Various lines are indented inconsistently * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode * 9.1.0579: Ex command is still executed after giving E1247 * 9.1.0578: no tests for :Tohtml * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim * 9.1.0576: tests: still an issue with test_gettext_make * 9.1.0575: Wrong comments in alt_tabpage() * 9.1.0574: ex: wrong handling of commands after bar runtime(doc): add a note for netrw bug reports * 9.1.0573: ex: no implicit print for single addresses runtime(vim): make &indentexpr available from the outside * 9.1.0572: cannot specify tab page closing behaviour runtime(doc): remove obsolete Ex insert behavior * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky runtime(logindefs): update syntax with new keywords * 9.1.0570: tests: test_gettext_make can be improved runtime(filetype): Fix Prolog file detection regex * 9.1.0569: fnamemodify() treats ".." and "../" differently runtime(mojo): include mojo ftplugin and indent script * 9.1.0568: Cannot expand paths from 'cdpath' setting * 9.1.0567: Cannot use relative paths as findfile() stop directories * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash * 9.1.0565: Stop directory doesn't work properly in 'tags' * 9.1.0564: id() can be faster * 9.1.0563: Cannot process any Key event * 9.1.0562: tests: inconsistency in test_findfile.vim runtime(fstab): Add missing keywords to fstab syntax * 9.1.0561: netbeans: variable used un-initialized (Coverity) * 9.1.0560: bindtextdomain() does not indicate an error * 9.1.0559: translation of vim scripts can be improved * 9.1.0558: filetype: prolog detection can be improved * 9.1.0557: moving in the buffer list doesn't work as documented runtime(doc): fix inconsistencies in :h file-searching * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages runtime(htmlangular): correct comment * 9.1.0555: filetype: angular ft detection is still problematic * 9.1.0554: :bw leaves jumplist and tagstack data around * 9.1.0553: filetype: *.mcmeta files are not recognized * 9.1.0552: No test for antlr4 filetype * 9.1.0551: filetype: htmlangular files are not properly detected * 9.1.0550: filetype: antlr4 files are not recognized * 9.1.0549: fuzzycollect regex based completion not working as expected runtime(doc): autocmd_add() accepts a list not a dict * 9.1.0548: it's not possible to get a unique id for some vars runtime(tmux): Update syntax script * 9.1.0547: No way to get the arity of a Vim function * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A runtime(hlsplaylist): include hlsplaylist ftplugin file runtime(doc): fix typo in :h ft-csv-syntax runtime(doc): Correct shell command to get $VIMRUNTIME into shell * 9.1.0545: MSVC conversion warning * 9.1.0544: filetype: ldapconf files are not recognized runtime(cmakecache): include cmakecache ftplugin file runtime(lex): include lex ftplugin file runtime(yacc): include yacc ftplugin file runtime(squirrel): include squirrel ftplugin file runtime(objcpp): include objcpp ftplugin file runtime(tf): include tf ftplugin file runtime(mysql): include mysql ftplugin file runtime(javacc): include javacc ftplugin file runtime(cabal): include cabal ftplugin file runtime(cuda): include CUDA ftplugin file runtime(editorconfig): include editorconfig ftplugin file runtime(kivy): update kivy syntax, include ftplugin runtime(syntax-tests): Stop generating redundant "*_* 99.dump" files * 9.1.0543: Behavior of CursorMovedC is strange runtime(vim): Update base-syntax, improve :match command highlighting * 9.1.0542: Vim9: confusing string() output for object functions * 9.1.0541: failing test with Vim configured without channel * 9.1.0540: Unused assignment in sign_define_cmd() runtime(doc): add page-scrolling keys to index.txt runtime(doc): add reference to xterm-focus-event from FocusGained/Lost * 9.1.0539: Not enough tests for what v9.1.0535 fixed runtime(doc): clarify how to re-init csv syntax file * 9.1.0538: not possible to assign priority when defining a sign * 9.1.0537: signed number detection for CTRL-X/A can be improved * 9.1.0536: filetype: zone files are not recognized * 9.1.0535: newline escape wrong in ex mode runtime(man): honor cmd modifiers before `g:ft_man_open_mode` runtime(man): use `nnoremap` to map to Ex commands * 9.1.0534: completion wrong with fuzzy when cycling back to original runtime(syntax-tests): Abort and report failed cursor progress runtime(syntax-tests): Introduce self tests for screen dumping runtime(syntax-tests): Clear and redraw the ruler line with the shell info runtime(syntax-tests): Allow for folded and wrapped lines in syntax test files * 9.1.0533: Vim9: need more tests for nested objects equality CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries runtime(doc): Remove wrong help tag CTRL-SHIFT-CR * 9.1.0532: filetype: Cedar files not recognized runtime(doc): document further keys that scroll page up/down * 9.1.0531: resource leak in mch_get_random() runtime(tutor): Fix wrong spanish translation runtime(netrw): fix remaining case of register clobber * 9.1.0530: xxd: MSVC warning about non-ASCII character * 9.1.0529: silent! causes following try/catch to not work runtime(rust): use shiftwidth() in indent script * 9.1.0528: spell completion message still wrong in translations * 9.1.0527: inconsistent parameter in Makefiles for Vim executable * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config * 9.1.0525: Right release selects immediately when pum is truncated. * 9.1.0524: the recursive parameter in the *_equal functions can be removed runtime(termdebug): Add Deprecation warnings * 9.1.0523: Vim9: cannot downcast an object * 9.1.0522: Vim9: string(object) hangs for recursive references * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13 * 9.1.0520: Vim9: incorrect type checking for modifying lists runtime(manpager): avoid readonly prompt * 9.1.0519: MS-Windows: libvterm compilation can be optimized * 9.1.0518: initialize the random buffer can be improved * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak runtime(terraform): Add filetype plugin for terraform runtime(dockerfile): enable spellchecking of comments in syntax script runtime(doc): rename variable for pandoc markdown support runtime(doc): In builtin overview use {buf} as param for appendbufline/setbufline runtime(doc): clarify, that register 1-* 9 will always be shifted runtime(netrw): save and restore register 0-* 9, a and unnamed runtime(termdebug): Refactored StartDebug_term and EndDebug functions runtime(java): Compose "g:java_highlight_signature" and "g:java_highlight_functions" * 9.1.0516: need more tests for nested dicts and list comparision * 9.1.0515: Vim9: segfault in object_equal() * 9.1.0514: Vim9: issue with comparing objects recursively runtime(termdebug): Change some variables to Enums runtime(vim): Update base-syntax, fix function tail comments * 9.1.0513: Vim9: segfault with object comparison - Update to 9.1.0512: * Mode message for spell completion doesn't match allowed keys * CursorMovedC triggered wrongly with setcmdpos() * update runtime files * CI: test_gettext fails on MacOS14 + MSVC Win * not possible to translate Vim script messages * termdebug plugin can be further improved * add gomod filetype plugin * hard to detect cursor movement in the command line * Optionally highlight parameterised types * filetype: .envrc & .prettierignore not recognized * filetype: Faust files are not recognized * inner-tag textobject confused about ">" in attributes * cannot use fuzzy keyword completion * Remove the group exclusion list from @javaTop * wrong return type for execute() function * MS-Windows: too much legacy code * too complicated mapping restore in termdebug * simplify mapping * cannot switch buffer in a popup * MS-Windows: doesn't handle symlinks properly * getcmdcompltype() interferes with cmdline completion * termdebug can be further improved * update htmldjango detection * Improve Turkish documentation * include a simple csv filetype and syntax plugin * include the the simple nohlsearch package * matched text is highlighted case-sensitively * Matched text isn't highlighted in cmdline pum * Fix typos in several documents * clarify when text properties are cleared * improve the vim-shebang example * revert unintended formatting changes for termdebug * Add a config variable for commonly used compiler options * Wrong matched text highlighted in pum with 'rightleft' * bump length of character references in syntax script * properly check mapping variables using null_dict * fix KdlIndent and kdlComment in indent script * Test for patch 9.1.0489 doesn't fail without the fix * Fold multi-line comments with the syntax kind of &fdm * using wrong type for PlaceSign() * filetype: Vim-script files not detected by shebang line * revert unintended change to zip#Write() * add another tag for vim-shebang feature * Cmdline pum doesn't work properly with 'rightleft' * minor style problems with patch 9.1.0487 * default completion may break with fuzzy * Wrong padding for pum "kind" with 'rightleft' * Update base-syntax, match shebang lines * MS-Windows: handle files with spaces properly * Restore HTML syntax file tests * completed item not update on fuzzy completion * filetype: Snakemake files are not recognized * make TermDebugSendCommand() a global function again * close all buffers in the same way * Matched text shouldn't be highlighted in "kind" and "menu" * fix wrong helptag for :defer * Update base-syntax, match :sleep arg * include Georgian keymap * Sorting of completeopt+=fuzzy is not stable * correctly test for windows in NetrwGlob() * glob() on windows fails with [] in directory name * rewrite mkdir() doc and simplify {flags} meaning * glob() not sufficiently tested * update return type for job_info() * termdebug plugin needs more love * correct return types for job_start() and job_status() * Update base-syntax, match :catch and :throw args * Include element values in non-marker annotations * Vim9: term_getjob() throws an exception on error * fuzzy string matching executed when not needed * fuzzy_match_str_with_pos() does unnecessary list operations * restore description of "$" in col() and virtcol() * deduplicate getpos(), line(), col(), virtcol() * Update g:vimsyn_comment_strings dump file tests * Use string interpolation instead of string concat * potential deref of NULL pointer in fuzzy_match_str_with_pos * block_editing errors out when using <enter> * Update base-syntax, configurable comment string highlighting * fix typos in syntax.txt * Cannot see matched text in popup menu * Update base-syntax, match multiline continued comments * clarify documentation for "v" position at line() * cmod_split modifier is always reset in term_start() * remove line-continuation characters * use shiftwidth() instead of &tabstop in indent script * Remove orphaned screen dump files * include syntax, indent and ftplugin files * CI: Test_ColonEight() fails on github runners * add missing Enabled field in syntax script * basic svelte ftplugin file * term_start() does not clear vertical modifier * fix mousemodel restoration by comparing against null_string * Added definitions of Vim scripts and plugins * Exclude lambda expressions from _when_ _switch-case_ label clauses * Fix saved_mousemodel check * Inconsistencies between functions for option flags * Crash when using autocmd_get() after removing event inside autocmd * Fix small style issues * add return type info for Vim function descriptions * Update Italian Vim manpage * disable the q mapping * Change 'cms' for C++ to '// %s' * fix type mismatch error * Fix wrong email address * convert termdebug plugin to Vim9 script - Update to 9.1.0470: * tests Test_ColonEight_MultiByte() fails sporadically * Cannot have buffer-local value for 'completeopt' * GvimExt does not consult HKEY_CURRENT_USER * typos in some comments * runtime(vim): Update base-syntax, allow whitespace before :substitute pattern * Missing comments for fuzzy completion * runtime(man): update Vim manpage * runtime(comment): clarify the usage of 'commentstring' option value * runtime(doc): clarify how fuzzy 'completeopt' should work * runtime(netrw): prevent accidental data loss * missing filecopy() function * no whitespace padding in commentstring option in ftplugins * no fuzzy-matching support for insert-completion * eval5() and eval7 are too complex * too many strlen() calls in drawline.c * filetype lintstagedrc files are not recognized * Vim9 import autoload does not work with symlink * Coverity complains about division by zero * tests test_gui fails on Wayland * Left shift is incorrect with vartabstop and shiftwidth=0 * runtime(doc): clarify 'shortmess' flag "S" * MS-Windows compiler warning for size_t to int conversion * runtime(doc): include some vim9 script examples in the help * minor issues in test_filetype with rasi test * filetype rasi files are not recognized * runtime(java): Improve the matching of lambda expressions * Configure checks for libelf unnecessarily * No test for escaping '<' with shellescape() * check.vim complains about overlong comment lines * translation(it): Update Italian translation * evalc. code too complex * MS-Windows Compiler warnings - Update to 9.1.0448: * compiler warning in eval.c * remove remaining css code * Add ft_hare.txt to Reference Manual TOC * re-generate vim syntax from generator * fix syntax vim bug * completion may be wrong when deleting all chars * getregionpos() inconsistent for partly-selected multibyte char * fix highlighting nested and escaped quotes in string props * remove the indent plugin since it has too many issues * update Debian runtime files * Coverity warning after 9.1.0440 * Not enough tests for getregion() with multibyte chars * Can't use blockwise selection with width for getregion() * update outdated syntax files * fix floating_modifier highlight * hare runtime files outdated * getregionpos() can't properly indicate positions beyond eol * function get_lval() is too long * Cannot filter the history * Wrong Ex command executed when :g uses '?' as delimiter * support floating_modifier none; revert broken highlighting * Motif requires non-const char pointer for XPM data * Crash when using '?' as separator for :s * filetype: cygport files are not recognized * make errors trying to access autoload/zig * Wrong yanking with exclusive selection and ve=all * add missing help tags file * Ancient XPM preprocessor hack may cause build errors * include basic rescript ftplugin file * eval.c is too long * getregionpos() doesn't handle one char selection * check for gdb file/dir before using as buffer name * refactor zig ftplugin, remove auto format * Coverity complains about eval.c refactor * Tag guessing leaves wrong search history with very short names * some issues with termdebug mapping test * update matchit plugin to v1.20 * too many strlen() calls in search.c * set commentstring option * update vb indent plugin as vim9script * filetype: purescript files are not recognized * filetype: slint files are not recognized * basic nim ftplugin file for comments * Add Arduino ftplugin and indent files * include basic typst ftplugin file * include basic prisma ftplugin file * include basic v ftplugin for comment support * getregionpos() wrong with blockwise mode and multibyte * function echo_string_core() is too long * hyprlang files are not recognized * add basic dart ftplugin file * basic ftplugin file for graphql * mention comment plugin at :h 'commentstring' * set commentstring for sql files in ftplugin * :browse oldfiles prompts even with single entry * eval.c not sufficiently tested * clarify why E195 is returned * clarify temporary file clean up * fix :NoMatchParen not working * Cannot move to previous/next rare word * add basic ftplugin file for sshdconfig * if_py: find_module has been removed in Python 3.12.0a7 * some screen dump tests can be improved * Some functions are not tested * clarify instal instructions for comment package * Unable to leave long line with 'smoothscroll' and 'scrolloff' * fix typo in vim9script help file * Remove trailing spaces * clarify {special} argument for shellescape() - update to 9.1.0413 * smoothscroll may cause infinite loop * add missing entries for the keys CTRL-W g<Tab> and <C-Tab> * update vi_diff.txt: add default value for 'flash' * typo in regexp_bt.c in DEBUG code * allow indented commands * Fix wrong define regex in ftplugin * Filter out non-Latin-1 characters for syntax tests * prefer scp over pscp * fix typo in usr_52.txt * too long functions in eval.c * warning about uninitialized variable * too many strlen() calls in the regexp engine * E16 fix, async keyword support for define * Stuck with long line and half-page scrolling * Divide by zero with getmousepos() and 'smoothscroll' * update and remove some invalid links * update translation of xxd manpage * Recursively delete directories by default with netrw delete command * Strive to remain compatible for at least Vim 7.0 * tests: xxd buffer overflow fails on 32-bit * Stop handpicking syntax groups for @javaTop * [security] xxd: buffer-overflow with specific flags * Vim9: not able to import file from start dir * filetype: mdd files detected as zsh filetype * filetype: zsh module files are not recognized * Remove hardcoded private.ppk logic from netrw * Vim9: confusing error message for unknown type * block_editing errors out when using del * add new items to scripts section in syntax plugin * Vim9: imported vars are not properly type checked * Wrong display with 'smoothscroll' when changing quickfix list * filetype: jj files are not recognized * getregionpos() may leak memory on error * The CODEOWNERS File is not useful * Remove and cleanup Win9x legacy from netrw * add MsgArea to 'highlight' option description * Cannot get a list of positions describing a region * Fix digit separator in syntax script for octals and floats * Update link to Wikipedia Vi page * clear $MANPAGER in ftplugin before shelling out * Fix typos in help documents * 'viewdir' not respecting $XDG_CONFIG_HOME * tests: Vim9 debug tests may be flaky * correct getscriptinfo() example * Vim9: could improve testing * test_sound fails on macos-12 * update Serbian menu * update Slovak menu * update Slovenian menu * update Portuguese menu * update Dutch menu * update Korean menu * update Icelandic menu * update Czech menu * update Afrikaans menu * update German menu * filetype: inko files are not recognized * filetype: templ files are not recognized * cursor() and getregion() don't handle v:maxcol well * Vim9: null value tests not sufficient * update Catalan menu * filetype: stylus files not recognized * update spanish menu localization * regenerate helptags * Vim9: crash with null_class and null_object * Add tags about lazyloading of menu * tests: vt420 terminfo entry may not be found * filetype: .out files recognized as tex files * filetype: Kbuild files are not recognized * cbuffer and similar commands don't accept a range * Improve the recognition of the "indent" method declarations * Fix a typo in usr_30.txt * remove undefined var s:save_cpoptions and add include setting * missing setlocal in indent plugin * Calculating line height for unnecessary amount of lines * improve syntax file performance * There are a few typos * Vim9: no comments allowed after class vars * CI: remove trailing white space in documentation * Formatting text wrong when 'breakindent' is set * Add oracular (24.10) as Ubuntu release name * Vim9: Trailing commands after class/enum keywords ignored * tests: 1-second delay after Test_BufEnter_botline() * update helptags for jq syntax * include syntax, ftplugin and compiler plugin * fix typo synconcealend -> synconcealed * include a simple comment toggling plugin * wrong botline in BufEnter * clarify syntax vs matching mechanism * fix undefined variable in indent plugin * ops.c code uses too many strlen() calls * Calling CLEAR_FIELD() on the same struct twice * Vim9: compile_def_function() still too long * Update Serbian messages * clarify the effect of setting the shell to powershell * Improve the recognition of the "style" method declarations * Vim9: problem when importing autoloaded scripts * compile_def_function is too long * filetype: ondir files are not recognized * Crash when typing many keys with D- modifier * tests: test_vim9_builtin is a bit slow * update documentation * change the download URL of "libsodium" * tests: test_winfixbuf is a bit slow * Add filetype, syntax and indent plugin for Astro * expanding rc config files does not work well * Vim9: vim9type.c is too complicated * Vim9: does not handle autoloaded variables well * minor spell fix in starting.txt * wrong drawing in GUI with setcellwidth() * Add include and suffixesadd * Page scrolling should place cursor at window boundaries * align command line table * minor fixes to starting.txt * fix comment definition in filetype plugin * filetype: flake.lock files are not recognized * runtime(uci): No support for uci file types * Support "g:ftplugin_java_source_path" with archived files * tests: Test_autoload_import_relative_compiled fails on Windows * Finding cmd modifiers and cmdline-specials is inefficient * No test that completing a partial mapping clears 'showcmd' * tests: test_vim9_dissamble may fail * Vim9: need static type for typealias * X11 does not ignore smooth scroll event * A few typos in test_xdg when testing gvimrc * Patch v9.1.0338 fixed sourcing a script with import * Problem: gvimrc not sourced from XDG_CONFIG_HOME * Cursor wrong after using setcellwidth() in terminal * 'showcmd' wrong for partial mapping with multibyte * tests: test_taglist fails when 'helplang' contains non-english * Problem: a few memory leaks are found * Problem: Error with matchaddpos() and empty list * tests: xdg test uses screen dumps * Vim9: import through symlinks not correctly handled * Missing entry for XDG vimrc file in :version * tests: typo in test_xdg * runtime(i3config/swayconfig): update syntax scripts * document pandoc compiler and enable configuring arguments * String interpolation fails for List type * No test for highlight behavior with 'ambiwidth' * tests: test_xdg fails on the appimage repo * tests: some assert_equal() calls have wrong order of args * make install does not install all files * runtime(doc): fix typos in starting.txt - bsc#1196806 - [jsc#SLE-18834][virt-install] ERROR SEV launch security requires a Q35 UEFI machine (epic: jsc#SLE-18732) virtman-add-sev-memory-support.patch - Add firmware features to description tooltip when mouse hovers over the selected firmware file. virtman-add-tooltip-to-firmware.patch - Change dependency on package xorriso to Requires from Recommends virt-manager.spec - bsc#1200691 - SLES 15 SP4 GMC --os-variant tag shouldn't be mandatory on s390x (see also bsc#1200422) revert-363fca41-virt-install-Require-osinfo-for-non-x86-HVM-case-too.patch - Upstream bug fix (bsc#1027942) d51541e1-Fix-UI-rename-with-firmware-efi.patch - Use autosetup in spec file - Add Source URL - Add upstream patch virtman-pr381-setuptools-61.patch gh#virt-manager/virt-manager#381 - Enable tests * No python package should go untested * Use multibuild so that all runtime requirements are checked * Add virtman-34662fe-argcomplete.patch - Upstream bug fixes (bsc#1027942) c6107419-tests-Drop-usage-of-sgio-unfiltered.patch 9ac94ef7-tests-Fix-another-sgio-filtered-case.patch b8a77805-domain-cpu-Clear-migratable-when-changing-to-custom-cpu.patch 0d84bcfb-cli-Add-iothreadids-attributes-thread_pool_min-and-thread_pool_max.patch 90e13549-Fix-build-with-setuptools-61+.patch 424283ad-launch_security-Use-SEV-ES-policy-0x07-if-host-supports-it.patch - Modified virtman-add-sev-memory-support.patch - Renamed upstream patches virtman-pr381-setuptools-61.patch to 46dc0616-setup-add-bits-for-setuptools-61.patch virtman-34662fe-argcomplete.patch to 34662fec-tests-Fix-with-latest-argcomplete.patch - Update to 4.1.0 * Fix build with setuptools-61 (Peter Alfredsen, Miro Hrončok) * add UI and cli support for qemu-vdagent channel (Jonathon Jongsma) * cli: More --iothreads suboptions (Lin Ma) * launch_security: Use SEV-ES policy=0x07 if host supports it (Charles * Arnold) * cli: Add support for URL query with disks (Martin Kletzander) - Drop patches merged upstream: * c6107419-tests-Drop-usage-of-sgio-unfiltered.patch * 90e13549-Fix-build-with-setuptools-61+.patch * 46dc0616-setup-add-bits-for-setuptools-61.patch * 9ac94ef7-tests-Fix-another-sgio-filtered-case.patch * 34662fec-tests-Fix-with-latest-argcomplete.patch * d51541e1-Fix-UI-rename-with-firmware-efi.patch * b8a77805-domain-cpu-Clear-migratable-when-changing-to-custom-cpu.patch * 0d84bcfb-cli-Add-iothreadids-attributes-thread_pool_min-and-thread_pool_max.patch * 424283ad-launch_security-Use-SEV-ES-policy-0x07-if-host-supports-it.patch - Refresh patches * virtman-add-tooltip-to-firmware.patch - - changed surrounding imports * virtinst-set-cache-mode-unsafe-for-install.patch - - the patch changes the expected output in tests - Refresh test skips - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Upstream bug fixes (bsc#1027942) 11a887ec-cli-disk-Add-driver.metadata_cache-options.patch 7295ebfb-tests-cli-Fix-test-output-after-previous-commit.patch 58f5e36d-fsdetails-Fix-an-error-with-source.socket-of-virtiofs.patch c22a876e-tests-Add-a-compat-check-for-linux2020-in-amd-sev-test-case.patch fbdf0516-cli-cpu-Add-maxphysaddr.mode-bits-options.patch b0d05167-cloner-Sync-uuid-and-sysinfo-system-uuid.patch 999ccb85-virt-install-unattended-and-cloud-init-conflict.patch - Refresh test skips - Drop the very old "Obsoletes: python-virtinst <= 0.600.4" virt-manager.spec - bsc#1203252 - virt-manager regression - cannot add second virtio-scsi controller virtman-fix-uninitialized-controller-index.patch - bsc#1205675 - [Build 20221122] virt-install: Specifying --boot no longer implies no_install=yes 1cb0be40-virtinstall-split-no_install-conditional-apart-to-track-code-coverage.patch e94786c0-virtinstall-fix-regression-with-boot-and-no-install-method.patch - Replace downstream patch with upstream version (bsc#1203252) 67832d30-addhardware-Fix-backtrace-when-controller-index-is-None.patch Drop virtman-fix-uninitialized-controller-index.patch - bsc#1207070 - libvirt fails to start the guest once the new shared disk is added, with the error, "cannot get 'write' permission without 'resize' image size is not a multiple of request alignment" virtman-fix-shared-disk-request-alignment-error.patch - Language file fixes bsc#1209800, bsc#1197945, bsc#1197947, bsc#1198041 virtman-language-fixes.patch - Drop virtman-check-for-valid-display.patch. This patch is no longer required. - bsc#1201748 - virt-install --graphics vnc fails with not support for video model 'virtio' virtinst-enable-video-virtio-for-arm.patch - bsc#1212195 - libvirtd crashes when virt-manager connects virt-manager qemu:///system on a fresh installation tumbleweed virtman-check-for-libvirt-modular-daemons.patch - Changes to osinfo-db cause some virt-manager tests to fail. virtman-fix-osinfo-tests.patch - bsc#1213790 - Application tab in virt-manager is collapsed, therefore I can't read anything virtman-fix-inspection-apps-window.patch - bsc#1220012 - KVM/QEMU video driver fails - virtio and qxl exhibit issues (see also bsc#1219791) virtinst-enable-video-virtio-for-arm.patch - bsc#1196806 - [jsc#SLE-18834][virt-install] ERROR SEV launch security requires a Q35 UEFI machine (epic: jsc#SLE-18732) virtman-add-sev-memory-support.patch - Add firmware features to description tooltip when mouse hovers over the selected firmware file. virtman-add-tooltip-to-firmware.patch - Change dependency on package xorriso to Requires from Recommends virt-manager.spec - bsc#1200691 - SLES 15 SP4 GMC --os-variant tag shouldn't be mandatory on s390x (see also bsc#1200422) revert-363fca41-virt-install-Require-osinfo-for-non-x86-HVM-case-too.patch - Upstream bug fix (bsc#1027942) d51541e1-Fix-UI-rename-with-firmware-efi.patch - Use autosetup in spec file - Add Source URL - Add upstream patch virtman-pr381-setuptools-61.patch gh#virt-manager/virt-manager#381 - Enable tests * No python package should go untested * Use multibuild so that all runtime requirements are checked * Add virtman-34662fe-argcomplete.patch - Upstream bug fixes (bsc#1027942) c6107419-tests-Drop-usage-of-sgio-unfiltered.patch 9ac94ef7-tests-Fix-another-sgio-filtered-case.patch b8a77805-domain-cpu-Clear-migratable-when-changing-to-custom-cpu.patch 0d84bcfb-cli-Add-iothreadids-attributes-thread_pool_min-and-thread_pool_max.patch 90e13549-Fix-build-with-setuptools-61+.patch 424283ad-launch_security-Use-SEV-ES-policy-0x07-if-host-supports-it.patch - Modified virtman-add-sev-memory-support.patch - Renamed upstream patches virtman-pr381-setuptools-61.patch to 46dc0616-setup-add-bits-for-setuptools-61.patch virtman-34662fe-argcomplete.patch to 34662fec-tests-Fix-with-latest-argcomplete.patch - Update to 4.1.0 * Fix build with setuptools-61 (Peter Alfredsen, Miro Hrončok) * add UI and cli support for qemu-vdagent channel (Jonathon Jongsma) * cli: More --iothreads suboptions (Lin Ma) * launch_security: Use SEV-ES policy=0x07 if host supports it (Charles * Arnold) * cli: Add support for URL query with disks (Martin Kletzander) - Drop patches merged upstream: * c6107419-tests-Drop-usage-of-sgio-unfiltered.patch * 90e13549-Fix-build-with-setuptools-61+.patch * 46dc0616-setup-add-bits-for-setuptools-61.patch * 9ac94ef7-tests-Fix-another-sgio-filtered-case.patch * 34662fec-tests-Fix-with-latest-argcomplete.patch * d51541e1-Fix-UI-rename-with-firmware-efi.patch * b8a77805-domain-cpu-Clear-migratable-when-changing-to-custom-cpu.patch * 0d84bcfb-cli-Add-iothreadids-attributes-thread_pool_min-and-thread_pool_max.patch * 424283ad-launch_security-Use-SEV-ES-policy-0x07-if-host-supports-it.patch - Refresh patches * virtman-add-tooltip-to-firmware.patch - - changed surrounding imports * virtinst-set-cache-mode-unsafe-for-install.patch - - the patch changes the expected output in tests - Refresh test skips - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Upstream bug fixes (bsc#1027942) 11a887ec-cli-disk-Add-driver.metadata_cache-options.patch 7295ebfb-tests-cli-Fix-test-output-after-previous-commit.patch 58f5e36d-fsdetails-Fix-an-error-with-source.socket-of-virtiofs.patch c22a876e-tests-Add-a-compat-check-for-linux2020-in-amd-sev-test-case.patch fbdf0516-cli-cpu-Add-maxphysaddr.mode-bits-options.patch b0d05167-cloner-Sync-uuid-and-sysinfo-system-uuid.patch 999ccb85-virt-install-unattended-and-cloud-init-conflict.patch - Refresh test skips - Drop the very old "Obsoletes: python-virtinst <= 0.600.4" virt-manager.spec - bsc#1203252 - virt-manager regression - cannot add second virtio-scsi controller virtman-fix-uninitialized-controller-index.patch - bsc#1205675 - [Build 20221122] virt-install: Specifying --boot no longer implies no_install=yes 1cb0be40-virtinstall-split-no_install-conditional-apart-to-track-code-coverage.patch e94786c0-virtinstall-fix-regression-with-boot-and-no-install-method.patch - Replace downstream patch with upstream version (bsc#1203252) 67832d30-addhardware-Fix-backtrace-when-controller-index-is-None.patch Drop virtman-fix-uninitialized-controller-index.patch - bsc#1207070 - libvirt fails to start the guest once the new shared disk is added, with the error, "cannot get 'write' permission without 'resize' image size is not a multiple of request alignment" virtman-fix-shared-disk-request-alignment-error.patch - Language file fixes bsc#1209800, bsc#1197945, bsc#1197947, bsc#1198041 virtman-language-fixes.patch - Drop virtman-check-for-valid-display.patch. This patch is no longer required. - bsc#1201748 - virt-install --graphics vnc fails with not support for video model 'virtio' virtinst-enable-video-virtio-for-arm.patch - bsc#1212195 - libvirtd crashes when virt-manager connects virt-manager qemu:///system on a fresh installation tumbleweed virtman-check-for-libvirt-modular-daemons.patch - Changes to osinfo-db cause some virt-manager tests to fail. virtman-fix-osinfo-tests.patch - bsc#1213790 - Application tab in virt-manager is collapsed, therefore I can't read anything virtman-fix-inspection-apps-window.patch - bsc#1220012 - KVM/QEMU video driver fails - virtio and qxl exhibit issues (see also bsc#1219791) virtinst-enable-video-virtio-for-arm.patch - bsc#1196806 - [jsc#SLE-18834][virt-install] ERROR SEV launch security requires a Q35 UEFI machine (epic: jsc#SLE-18732) virtman-add-sev-memory-support.patch - Add firmware features to description tooltip when mouse hovers over the selected firmware file. virtman-add-tooltip-to-firmware.patch - Change dependency on package xorriso to Requires from Recommends virt-manager.spec - bsc#1200691 - SLES 15 SP4 GMC --os-variant tag shouldn't be mandatory on s390x (see also bsc#1200422) revert-363fca41-virt-install-Require-osinfo-for-non-x86-HVM-case-too.patch - Upstream bug fix (bsc#1027942) d51541e1-Fix-UI-rename-with-firmware-efi.patch - Use autosetup in spec file - Add Source URL - Add upstream patch virtman-pr381-setuptools-61.patch gh#virt-manager/virt-manager#381 - Enable tests * No python package should go untested * Use multibuild so that all runtime requirements are checked * Add virtman-34662fe-argcomplete.patch - Upstream bug fixes (bsc#1027942) c6107419-tests-Drop-usage-of-sgio-unfiltered.patch 9ac94ef7-tests-Fix-another-sgio-filtered-case.patch b8a77805-domain-cpu-Clear-migratable-when-changing-to-custom-cpu.patch 0d84bcfb-cli-Add-iothreadids-attributes-thread_pool_min-and-thread_pool_max.patch 90e13549-Fix-build-with-setuptools-61+.patch 424283ad-launch_security-Use-SEV-ES-policy-0x07-if-host-supports-it.patch - Modified virtman-add-sev-memory-support.patch - Renamed upstream patches virtman-pr381-setuptools-61.patch to 46dc0616-setup-add-bits-for-setuptools-61.patch virtman-34662fe-argcomplete.patch to 34662fec-tests-Fix-with-latest-argcomplete.patch - Update to 4.1.0 * Fix build with setuptools-61 (Peter Alfredsen, Miro Hrončok) * add UI and cli support for qemu-vdagent channel (Jonathon Jongsma) * cli: More --iothreads suboptions (Lin Ma) * launch_security: Use SEV-ES policy=0x07 if host supports it (Charles * Arnold) * cli: Add support for URL query with disks (Martin Kletzander) - Drop patches merged upstream: * c6107419-tests-Drop-usage-of-sgio-unfiltered.patch * 90e13549-Fix-build-with-setuptools-61+.patch * 46dc0616-setup-add-bits-for-setuptools-61.patch * 9ac94ef7-tests-Fix-another-sgio-filtered-case.patch * 34662fec-tests-Fix-with-latest-argcomplete.patch * d51541e1-Fix-UI-rename-with-firmware-efi.patch * b8a77805-domain-cpu-Clear-migratable-when-changing-to-custom-cpu.patch * 0d84bcfb-cli-Add-iothreadids-attributes-thread_pool_min-and-thread_pool_max.patch * 424283ad-launch_security-Use-SEV-ES-policy-0x07-if-host-supports-it.patch - Refresh patches * virtman-add-tooltip-to-firmware.patch - - changed surrounding imports * virtinst-set-cache-mode-unsafe-for-install.patch - - the patch changes the expected output in tests - Refresh test skips - jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen and KVM Management - Upstream bug fixes (bsc#1027942) 11a887ec-cli-disk-Add-driver.metadata_cache-options.patch 7295ebfb-tests-cli-Fix-test-output-after-previous-commit.patch 58f5e36d-fsdetails-Fix-an-error-with-source.socket-of-virtiofs.patch c22a876e-tests-Add-a-compat-check-for-linux2020-in-amd-sev-test-case.patch fbdf0516-cli-cpu-Add-maxphysaddr.mode-bits-options.patch b0d05167-cloner-Sync-uuid-and-sysinfo-system-uuid.patch 999ccb85-virt-install-unattended-and-cloud-init-conflict.patch - Refresh test skips - Drop the very old "Obsoletes: python-virtinst <= 0.600.4" virt-manager.spec - bsc#1203252 - virt-manager regression - cannot add second virtio-scsi controller virtman-fix-uninitialized-controller-index.patch - bsc#1205675 - [Build 20221122] virt-install: Specifying --boot no longer implies no_install=yes 1cb0be40-virtinstall-split-no_install-conditional-apart-to-track-code-coverage.patch e94786c0-virtinstall-fix-regression-with-boot-and-no-install-method.patch - Replace downstream patch with upstream version (bsc#1203252) 67832d30-addhardware-Fix-backtrace-when-controller-index-is-None.patch Drop virtman-fix-uninitialized-controller-index.patch - bsc#1207070 - libvirt fails to start the guest once the new shared disk is added, with the error, "cannot get 'write' permission without 'resize' image size is not a multiple of request alignment" virtman-fix-shared-disk-request-alignment-error.patch - Language file fixes bsc#1209800, bsc#1197945, bsc#1197947, bsc#1198041 virtman-language-fixes.patch - Drop virtman-check-for-valid-display.patch. This patch is no longer required. - bsc#1201748 - virt-install --graphics vnc fails with not support for video model 'virtio' virtinst-enable-video-virtio-for-arm.patch - bsc#1212195 - libvirtd crashes when virt-manager connects virt-manager qemu:///system on a fresh installation tumbleweed virtman-check-for-libvirt-modular-daemons.patch - Changes to osinfo-db cause some virt-manager tests to fail. virtman-fix-osinfo-tests.patch - bsc#1213790 - Application tab in virt-manager is collapsed, therefore I can't read anything virtman-fix-inspection-apps-window.patch - bsc#1220012 - KVM/QEMU video driver fails - virtio and qxl exhibit issues (see also bsc#1219791) virtinst-enable-video-virtio-for-arm.patch - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.63 - spec: fix old libwicked package provides/obsoletes (bsc#1165180) - ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960) - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.64 - avoid incomplete ifdown/timeout on route deletion error (bsc#1174099) - dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770) - wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082) - team: fix schema to use correct hwaddr_policy property (boo#1171234) - team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556) - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.65 - ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215) - client: parse sysctl files in the correct order (bsc#1181186) - ifup: fix for set up with unenslave from unconfigured master (boo#954329) - rpm: prepare for new builds using usrmerged rpm macro (boo#1029961) - rpm: Let wicked-service also provide service(network) - cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815) - dbus: add variant container, generic object-path and uint32 array macros - dhcp4: discover on reboot timeout after start-delay (bsc#1181812) [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] - dhcp6: request nis options on sle15 by default (bsc#1181812) [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.66 - wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920) - support multiple networks configurations per interface - show connection status and scan-results (bsc#1160654) - corrected eap-tls,ttls cetificate handling and open vs. shared wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592) - cleanups and several other improvements, see changes - updated man ifcfg-wireless manual pages - nanny: fix identify node owner exit condition - schema: several xml-schema and dbus/property improvements - utils: format/parse bitmap to array and string alternatives - client: expose ethtool --get-permanent-address option - removed sle15-sp3 patches included in the master sources (bsc#1181812) [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch] [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.67 - dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750) - logging: log reaped sub-process command and as debug, not error - ifstatus: Don't show link as "up" without RUNNING flag set - firewalld: Make the zone assignment permanent (boo#1189560) - fsm: cleanup and improve ifconfig and ifpolicy access utils - dbus: cleanup the dbus-service.h file and unused property macros - cleanup: applied code-spell run typo corrections - dracut: initial fixes and improved option handling (boo#1182227) - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - dbus: config files in /usr shouldn't be marked as config in spec - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - version 0.6.68 - sysctl: process sysctl.d directories as in sysctl --system - sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357) - dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353) - cleanup: warnings, time calculations and dhcp fixes (bsc#1188019) - wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495) - tuntap: avoid sysfs attr read error (bsc#1192311) - ifstatus: fix warning of unexpected interface flag combination (bsc#1192164) - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - fsm: fix device rename via yast (bsc#1194392) Reset worker config instead to reject a NULL/empty config xml node -- introduced in wicked 0.6.67 by commit c2a0385. [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.69 - redfish: decode smbios and setup host interface Add initial support to decode the SMBIOS Management Controller Host Interface (Type 42) structure and expose it as wicked `firmware:redfish` configuration to setup a Host Network Interface (to the BMC) using the `Redfish over IP` protocol allowing access to the Redfish Service (via redfish-localhost in /etc/hosts) used to manage the computer system. Tech Preview (jsc#SLE-17762). - buffer: fix size_t length downcast to uint, add guards to init functions - wireless: fix to not expect colons in 64byte long wpa-psk hex hash string - xml-schema: reference counting fix to not crash at exit on schema errors - compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl, remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5. - compat-suse: fix reading of sysctl addr_gen_mode to wrong variable - auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429) - removed obsolete patch included in the master sources (bsc#1194392) [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch] - version 0.6.70 - build: Link as Position Independent Executable (bsc#1184124) - dhcp4: Fix issues in reuse of last lease (bsc#1187655) - dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307) - dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b) - dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03) - dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924) - team: Fix to configure port priority in teamd (bsc#1200505) - firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950) - wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931) - wireless: Add support for WPA3 and PMF (bsc#1198894) - wireless: Remove libiw dependencies (gh#openSUSE/wicked#910) - client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919) - client: Add release options to ifdown/ifreload (jsc#SLE-10249) - dbus: Clear string array before append (gh#openSUSE/wicked#913) - socket: Fix SEGV on heavy socket restart errors (bsc#1192508) - systemd: Remove systemd-udev-settle dependency (bsc#1186787) - spec: Add /etc/sysconfig/network to file list, no longer in the default list of a cleaned up filesystem package (https://github.com/openSUSE/wicked/pull/939). - version 0.6.71 - dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90) - schema: fix the ip rule to-selector to handle network prefixes - version 0.6.72 - nbft: introduced new wicked-nbft sub-package to setup network interfaces using NBFT firmware configuration according to the NVM Express Boot Specification 1.0 (jsc#PED-3132) - client: add `wicked firmware extensions|interfaces|enable|disable` command to improve `ibft`,`nbft`,`redfish` firmware extension and interface handling (jsc#PED-3132) - client: improve error handling in netif firmware discovery extension execution - appconfig: improved to handle extension definition overrides in the wicked-config - nanny: fix use-after-free in debug mode (bsc#1206447) - spec: replace transitional `%usrmerged` macro with regular version check (boo#1206798) - client: improve to show `no-carrier` in ifstatus output - linux: cleanup inclusions and update uapi header to 6.0 - ethtool: link mode nwords cleanup and new advertise link mode map names - bond: workaround 6.1 kernel enslave regression (boo#1206674) The kernel bond enslave rtnetlink message processing changed breaking an `ip link set down master bond0 dev eth0` like enslave which worked with all kernels from 4.12 up to 6.0. [+ 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch] - extensions/nbft: add post-up script (bsc#1211647) In multipath scenarios, not all NBFT interfaces and respective connections may have been brought up during initramfs processing. If wicked brings up some NBFT interfaces after switching to the root file system, run a post-up script to initiate the NVMe connections. [+ 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - update to version 0.6.73 - spec: cleanup artefacts and fix some rpmlint warnings - arp: allow verify/notify counter and interval configuration - arp: handle ENOBUFS sending errors (bsc#1203300) - extensions: improve environment variable handling - firmware: refactor firmware extension definition - firmware: enable, disable and revert cli commands - code cleanup: fix memory leaks, add array/list utils - wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026) - cleanup /var/run leftovers in extension scripts (bsc#1194557) - json: output formatting improvements and Unicode support - removed patches included in the source archive: [- 0001-bond-workaround-6.1-enslave-regression-boo-1206674.patch, - 0002-extensions-nbft-add-post-up-script.bsc-1211647.patch] - ifconfig: fix arp notify loop (boo#1212806) and burst sending [+ 0001-fix_arp_notify_loop_and_burst_sending.patch] - ifreload: VLAN changes require device deletion (bsc#1218927) [+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] - ifcheck: fix config changed check (bsc#1218926) [+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] - client: fix exit code for no-carrier status (bsc#1219265) [+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] - dhcp6: omit the SO_REUSEPORT option (bsc#1215692) [+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] - duid: fix comment for v6time (https://github.com/openSUSE/wicked/pull/989) [+ 0005-duid-fix-comment-for-v6time.patch] - rtnl: fix peer address parsing for non ptp-interfaces (https://github.com/openSUSE/wicked/pull/987, https://github.com/openSUSE/wicked/pull/988) [+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] - system-updater: Parse updater format from XML configuration to ensure install calls can run. (https://github.com/openSUSE/wicked/pull/985) [+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch] - update to version 0.6.74 + team: add new options like link_watch_policy (jsc#PED-7183) + Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001) + xpath: allow underscore in node identifier (gh#openSUSE/wicked#999) + vxlan: don't format unknown rtnl attrs (bsc#1219751) - removed patches included in the source archive: [- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch] [- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch] [- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch] [- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch] [- 0005-duid-fix-comment-for-v6time.patch] [- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch] [- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch] [- 0002-system-updater-Parse-updater-format-from-XML-configu.patch] [- 0001-fix_arp_notify_loop_and_burst_sending.patch] - addrconf: fix fallback-lease drop (bsc#1220996) [+ 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] - extensions/nbft: use upstream `nvme nbft show` (bsc#1221358) [+ 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] - hide secrets in debug log (bsc#1221194) [+ 0003-move-all-attribute-definitions-to-compiler-h.patch] [+ 0004-hide-secrets-in-debug-log-bsc-1221194.patch] - client: do not convert sec to msec twice (bsc#1222105) [+ 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - Update to version 0.6.75: - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings - cleanup: fix overflow warnings in a socket testcase on i586 - ifcheck: report new and deleted configs as changed (bsc#1218926) - man: improve ARP configuration options in the wicked-config.5 - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108) - cleanup: fix interface dependencies and shutdown order (bsc#1205604) - Remove port arrays from bond,team,bridge,ovs-bridge (redundant) and consistently use config and state info attached to the port interface as in rtnetlink(7). - Cleanup ifcfg parsing, schema configuration and service properties - Migrate ports in xml config and policies already applied in nanny - Remove "missed config" generation from finite state machine, which is completed while parsing the config or while xml config migration. - Issue a warning when "lower" interface (e.g. eth0) config is missed while parsing config depending on it (e.g. eth0.42 vlan). - Resolve ovs master to the effective bridge in config and wickedd - Implement netif-check-state require checks using system relations from wickedd/kernel instead of config relations for ifdown and add linkDown and deleteDevice checks to all master and lower references. - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the system/config interface hierarchies as notice with +/- marked interfaces to setup and/or shutdown. - Removed patches included in the source archive: [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch] [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch] [- 0003-move-all-attribute-definitions-to-compiler-h.patch] [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch] [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch] - client: fix ifreload to pull UP ports/links again when the config of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014). [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] - arp: increase arp-send retry value to avoid address configuration failure due to ENOBUF reported by kernel while duplicate address detection with underlying bonding in 802.3ad mode reporting link "up & running" too early (bsc#1218668, gh#openSUSE/wicked#1020, gh#openSUSE/wicked#1022). [+ 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - Update to version 0.6.76 - compat-suse: warn user and create missing parent config of infiniband children (gh#openSUSE/wicked#1027) - client: fix origin in loaded xml-config with obsolete port references but missing port interface config, causing a no-carrier of master (bsc#1226125) - ipv6: fix setup on ipv6.disable=1 kernel cmdline (bsc#1225976) - wireless: add frequency-list in station mode (jsc#PED-8715) - client: fix crash while hierarchy traversing due to loop in e.g. systemd-nspawn containers (bsc#1226664) - man: add supported bonding options to ifcfg-bonding(5) man page (gh#openSUSE/wicked#1021) - arputil: Document minimal interval for getopts (gh#openSUSE/wicked#1019) - man: (re)generate man pages from md sources (gh#openSUSE/wicked#1018) - client: warn on interface wait time reached (gh#openSUSE/wicked#1017) - compat-suse: fix dummy type detection from ifname to not cause conflicts with e.g. correct vlan config on dummy0.42 interfaces (gh#openSUSE/wicked#1016) - compat-suse: fix infiniband and infiniband child type detection from ifname (gh#openSUSE/wicked#1015) - Removed patches included in the source archive: [- 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch] [- 0002-increase-arp-retry-attempts-on-sending-bsc1218668.patch] - compat-suse: fix dummy interfaces configuration with INTERFACETYPE=dummy (boo#1229555, gh#openSUSE/wicked#1031) [+ 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 0.6.77 - compat-suse: use iftype in sysctl handling (bsc#1230911, gh#openSUSE/wicked#1043) - Always generate the ipv4/ipv6 <enabled>true|false</enabled> node - Inherit all, default and interface sysctl settings also for loopback, except for use_tempaddr and accept_dad. - Consider only interface specific accept_redirects sysctl settings. - Adopt ifsysctl(5) manual page with wicked specific behavior. - route: fix family and destination processing (bsc#1231060) - man: improve wicked-config(5) file description (gh#openSUSE/wicked#1039) - dhcp4: add ignore-rfc3927-1-6 wicked-config(5) option (jsc#PED-10855, gh#openSUSE/wicked#1038) - team: set arp link watcher interval default to 1s (gh#openSUSE/wicked#1037) - systemd: use `BindsTo=dbus.service` in favor of `Requisite=` (bsc#1229745) - compat-suse: fix use of deprecated `INTERFACETYPE=dummy` (boo#1229555) - arp: don't set target broadcast hardware address (gh#openSUSE/wicked#1036) - dbus: don't memcpy empty/NULL array value (gh#openSUSE/wicked#1035) - ethtool: fix leak and free pause data in ethtool_free (gh#openSUSE/wicked#1030) - Removed patches included in the source archive: [- 0001-compat-suse-repair-dummy-interfaces-boo-1229555.patch] - Update to version 20210129: * wireless-regdb: Update regulatory rules for Ukraine (UA) * wireless-regdb: update CNAF regulation url for ES - Update to version 20210407: * wireless-regdb: Update regulatory rules for Cuba (CU) on 5GHz * wireless-regdb: Do not hardcode 'sforshee' in the certificate commonName - Update to version 20210421: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: re-add source url and info for CU - Update to version 20210828: * wireless-regdb: update regulatory database based on preceding changes * Update regulatory rules for Ecuador (EC) * wireless-regdb: Update regulatory rules for Norway (NO) on 6 and 60 GHz * wireless-regdb: Update regulatory rules for Germany (DE) on 6GHz * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: reduce bandwidth for 5730-5850 and 5850-5895 MHz in US * wireless-regdb: remove PTMP-ONLY from 5850-5895 MHz for US * wireless-regdb: recent FCC report and order allows 5850-5895 immediately * wireless-regdb: update 5725-5850 MHz rule for GB - Update to version 20211209: * wireless-regdb: Raise DFS TX power limit to 250 mW (24 dBm) for the US - Update to version 20220108: * wireless-regdb: Update regulatory rules for Croatia (HR) on 6GHz - Update to version 20220218: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz * wireless-regdb: Update regulatory rules for China (CN) * wireless-regdb: Update regulatory rules for South Korea (KR) * Revert "wireless-regdb: Update regulatory rules for South Korea (KR)" * wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz * wireless-regdb: add 802.11ah bands to world regulatory domain * wireless-regdb: add support for US S1G channels * wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz * wireless-regdb: Update regulatory rules for South Korea (KR) - Update to version 20220324: * wireless-regdb: Update regulatory rules for Israel (IL) - Update to version 20220408: * wireless-regdb: add db files missing from previous commit * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Australia (AU) * wireless-regdb: add missing spaces for US S1G rules - Update to version 20220527: * wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz * Regulatory update for 6 GHz operation in FI * Regulatory update for 6 GHz operation in United States (US) * Regulatory update for 6 GHz operation in Canada (CA) - Update to version 20220606: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Unify 6 GHz rules for EU contries * wireless-regdb: Remove AUTO-BW from 6 GHz rules - Update to version 20220812: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: update 5 GHz rules for PK and add 60 GHz rule * wireless-regdb: add 5 GHz rules for GY * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Unify 6 GHz rules for EU contries * wireless-regdb: Remove AUTO-BW from 6 GHz rules * wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz * Regulatory update for 6 GHz operation in FI * Regulatory update for 6 GHz operation in United States (US) * Regulatory update for 6 GHz operation in Canada (CA) - Update to version 20221012: * wireless-regdb: update regulatory rules for Switzerland (CH) * wireless-regdb: Update regulatory rules for Brazil (BR) - Update to version 20221205: * wireless-regdb: Update regulatory rules for Japan (JP) on 6GHz * wireless-regdb: Update regulatory rules for Japan (JP) on 5GHz - Update to version 20230213: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory info for Russia (RU) on 5GHz - Update to version 20230503: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Hong Kong (HK) * wireless-regdb: update regulatory rules for India (IN) * wireless-regdb: Update regulatory rules for Russia (RU). Remove DFS requirement. * Update regulatory info for Russia (RU) on 6GHz - Update to version 20230601: * wireless-regdb: Update regulatory rules for Philippines (PH) - Update to version 20230721: * wireless-regdb: Update regulatory info for Türkiye (TR) * wireless-regdb: Update regulatory rules for Egypt (EG) from March 2022 guidelines - Update to version 20230901: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Australia (AU) for June 2023 - Define %{_firmwaredir} if not defined. This fixes RPM build errors. - Update to version 20210129: * wireless-regdb: Update regulatory rules for Ukraine (UA) * wireless-regdb: update CNAF regulation url for ES - Update to version 20210407: * wireless-regdb: Update regulatory rules for Cuba (CU) on 5GHz * wireless-regdb: Do not hardcode 'sforshee' in the certificate commonName - Update to version 20210421: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: re-add source url and info for CU - Update to version 20210828: * wireless-regdb: update regulatory database based on preceding changes * Update regulatory rules for Ecuador (EC) * wireless-regdb: Update regulatory rules for Norway (NO) on 6 and 60 GHz * wireless-regdb: Update regulatory rules for Germany (DE) on 6GHz * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: reduce bandwidth for 5730-5850 and 5850-5895 MHz in US * wireless-regdb: remove PTMP-ONLY from 5850-5895 MHz for US * wireless-regdb: recent FCC report and order allows 5850-5895 immediately * wireless-regdb: update 5725-5850 MHz rule for GB - Update to version 20211209: * wireless-regdb: Raise DFS TX power limit to 250 mW (24 dBm) for the US - Update to version 20220108: * wireless-regdb: Update regulatory rules for Croatia (HR) on 6GHz - Update to version 20220218: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz * wireless-regdb: Update regulatory rules for China (CN) * wireless-regdb: Update regulatory rules for South Korea (KR) * Revert "wireless-regdb: Update regulatory rules for South Korea (KR)" * wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz * wireless-regdb: add 802.11ah bands to world regulatory domain * wireless-regdb: add support for US S1G channels * wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz * wireless-regdb: Update regulatory rules for South Korea (KR) - Update to version 20220324: * wireless-regdb: Update regulatory rules for Israel (IL) - Update to version 20220408: * wireless-regdb: add db files missing from previous commit * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Australia (AU) * wireless-regdb: add missing spaces for US S1G rules - Update to version 20220527: * wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz * Regulatory update for 6 GHz operation in FI * Regulatory update for 6 GHz operation in United States (US) * Regulatory update for 6 GHz operation in Canada (CA) - Update to version 20220606: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Unify 6 GHz rules for EU contries * wireless-regdb: Remove AUTO-BW from 6 GHz rules - Update to version 20220812: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: update 5 GHz rules for PK and add 60 GHz rule * wireless-regdb: add 5 GHz rules for GY * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Unify 6 GHz rules for EU contries * wireless-regdb: Remove AUTO-BW from 6 GHz rules * wireless-regdb: update regulatory rules for Bulgaria (BG) on 6GHz * Regulatory update for 6 GHz operation in FI * Regulatory update for 6 GHz operation in United States (US) * Regulatory update for 6 GHz operation in Canada (CA) - Update to version 20221012: * wireless-regdb: update regulatory rules for Switzerland (CH) * wireless-regdb: Update regulatory rules for Brazil (BR) - Update to version 20221205: * wireless-regdb: Update regulatory rules for Japan (JP) on 6GHz * wireless-regdb: Update regulatory rules for Japan (JP) on 5GHz - Update to version 20230213: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory info for Russia (RU) on 5GHz - Update to version 20230503: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Hong Kong (HK) * wireless-regdb: update regulatory rules for India (IN) * wireless-regdb: Update regulatory rules for Russia (RU). Remove DFS requirement. * Update regulatory info for Russia (RU) on 6GHz - Update to version 20230601: * wireless-regdb: Update regulatory rules for Philippines (PH) - Update to version 20230721: * wireless-regdb: Update regulatory info for Türkiye (TR) * wireless-regdb: Update regulatory rules for Egypt (EG) from March 2022 guidelines - Update to version 20230901: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Australia (AU) for June 2023 - Define %{_firmwaredir} if not defined. This fixes RPM build errors. - Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798) - Refresh spec-file: add %license tag. - Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd). - Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch - Adjust the service to start after network.target wrt bsc#1165266 - Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933) - With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331) - Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331) - Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934) - Enable SAE support(jsc#SLE-14992). - Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build - Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/) - Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777) - Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805) - Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844) - Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348) - Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733) - Enable WPA3-Enterprise (SuiteB-192) support. - update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory - Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run) - Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798) - Refresh spec-file: add %license tag. - Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd). - Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch - Adjust the service to start after network.target wrt bsc#1165266 - Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933) - With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331) - Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331) - Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934) - Enable SAE support(jsc#SLE-14992). - Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build - Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/) - Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777) - Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805) - Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844) - Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348) - Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733) - Enable WPA3-Enterprise (SuiteB-192) support. - update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory - Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run) - Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798) - Refresh spec-file: add %license tag. - Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd). - Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch - Adjust the service to start after network.target wrt bsc#1165266 - Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933) - With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331) - Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331) - Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934) - Enable SAE support(jsc#SLE-14992). - Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build - Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/) - Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777) - Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805) - Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844) - Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348) - Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733) - Enable WPA3-Enterprise (SuiteB-192) support. - update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory - Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run) - Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798) - Refresh spec-file: add %license tag. - Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd). - Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch - Adjust the service to start after network.target wrt bsc#1165266 - Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933) - With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331) - Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331) - Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934) - Enable SAE support(jsc#SLE-14992). - Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build - Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/) - Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777) - Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805) - Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844) - Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348) - Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733) - Enable WPA3-Enterprise (SuiteB-192) support. - update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory - Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run) - bsc#1208736 - GCC 13: xen package fails bunzip-gcc13.patch altp2m-gcc13.patch - Drop gcc13-fixes.patch - bsc#1209017 - VUL-0: CVE-2022-42332: xen: x86 shadow plus log-dirty mode use-after-free (XSA-427) xsa427.patch - bsc#1209018 - VUL-0: CVE-2022-42333,CVE-2022-42334: xen: x86/HVM pinned cache attributes mis-handling (XSA-428) xsa428-1.patch xsa428-2.patch - bsc#1209019 - VUL-0: CVE-2022-42331: xen: x86: speculative vulnerability in 32bit SYSCALL path (XSA-429) xsa429.patch - bsc#1209245 - fix host-assisted kexec/kdump for HVM domUs libxl.fix-guest-kexec-skip-cpuid-policy.patch - Upstream bug fixes (bsc#1027519) 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 641041e8-VT-d-constrain-IGD-check.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch - Use "proper" upstream backports: 640f3035-x86-altp2m-help-gcc13.patch 64104238-bunzip-gcc13.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch - ... in place of: bunzip-gcc13.patch altp2m-gcc13.patch xsa427.patch xsa428-1.patch xsa428-2.patch xsa429.patch - Not building the shim is correctly handled by --disable-pvshim Drop disable-building-pv-shim.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - Upstream bug fixes (bsc#1027519) 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 641041e8-VT-d-constrain-IGD-check.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch - Use "proper" upstream backports: 640f3035-x86-altp2m-help-gcc13.patch 64104238-bunzip-gcc13.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch - ... in place of: bunzip-gcc13.patch altp2m-gcc13.patch xsa427.patch xsa428-1.patch xsa428-2.patch xsa429.patch - Not building the shim is correctly handled by --disable-pvshim Drop disable-building-pv-shim.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Update to Xen 4.17.5 security bug fix release (bsc#1027519) xen-4.17.5-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1228574 - VUL-0: CVE-2024-31145: xen: error handling in x86 IOMMU identity mapping (XSA-460) - bsc#1228575 - VUL-0: CVE-2024-31146: xen: PCI device pass-through with shared resources (XSA-461) - Dropped patches contained in new tarball 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch 6646031f-x86-ucode-further-identify-already-up-to-date.patch 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch xsa458.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Update to Xen 4.17.5 security bug fix release (bsc#1027519) xen-4.17.5-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1228574 - VUL-0: CVE-2024-31145: xen: error handling in x86 IOMMU identity mapping (XSA-460) - bsc#1228575 - VUL-0: CVE-2024-31146: xen: PCI device pass-through with shared resources (XSA-461) - Dropped patches contained in new tarball 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch 6646031f-x86-ucode-further-identify-already-up-to-date.patch 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch xsa458.patch - bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (XSA-462) xsa462.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Update to Xen 4.17.5 security bug fix release (bsc#1027519) xen-4.17.5-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1228574 - VUL-0: CVE-2024-31145: xen: error handling in x86 IOMMU identity mapping (XSA-460) - bsc#1228575 - VUL-0: CVE-2024-31146: xen: PCI device pass-through with shared resources (XSA-461) - Dropped patches contained in new tarball 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch 6646031f-x86-ucode-further-identify-already-up-to-date.patch 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch xsa458.patch - bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (XSA-462) xsa462.patch - bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (XSA-462) 66f2af41-x86-vLAPIC-undue-recursion-of-vlapic_error.patch Drop xsa462.patch - Upstream bug fixes (bsc#1027519) 66cf737b-x86-Dom0-disable-SMAP-for-PV-only.patch 66d6dca8-libxl-nul-termination-in-xen_console_read_line.patch 66d8690f-SUPPORT-split-XSM-from-Flask.patch 66e29480-x86-HVM-properly-reject-indirect-VRAM-writes.patch 66e44ae2-x86-ucode-AMD-buffer-underrun.patch 66f2fd92-x86-ucode-Intel-stricter-sanity-check.patch - bsc#1232542 - remove usage of net-tools-deprecated from supportconfig plugin - bsc#1232622 - VUL-0: CVE-2024-45818: xen: Deadlock in x86 HVM standard VGA handling (XSA-463) xsa463-01.patch xsa463-02.patch xsa463-03.patch xsa463-04.patch xsa463-05.patch xsa463-06.patch xsa463-07.patch xsa463-08.patch xsa463-09.patch xsa463-10.patch - bsc#1232624 - VUL-0: CVE-2024-45819: xen: libxl leaks data to PVH guests via ACPI tables (XSA-464) xsa464.patch - Drop the following patches 66e29480-x86-HVM-properly-reject-indirect-VRAM-writes.patch stdvga-cache.patch - bsc#1208736 - GCC 13: xen package fails bunzip-gcc13.patch altp2m-gcc13.patch - Drop gcc13-fixes.patch - bsc#1209017 - VUL-0: CVE-2022-42332: xen: x86 shadow plus log-dirty mode use-after-free (XSA-427) xsa427.patch - bsc#1209018 - VUL-0: CVE-2022-42333,CVE-2022-42334: xen: x86/HVM pinned cache attributes mis-handling (XSA-428) xsa428-1.patch xsa428-2.patch - bsc#1209019 - VUL-0: CVE-2022-42331: xen: x86: speculative vulnerability in 32bit SYSCALL path (XSA-429) xsa429.patch - bsc#1209245 - fix host-assisted kexec/kdump for HVM domUs libxl.fix-guest-kexec-skip-cpuid-policy.patch - Upstream bug fixes (bsc#1027519) 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 641041e8-VT-d-constrain-IGD-check.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch - Use "proper" upstream backports: 640f3035-x86-altp2m-help-gcc13.patch 64104238-bunzip-gcc13.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch - ... in place of: bunzip-gcc13.patch altp2m-gcc13.patch xsa427.patch xsa428-1.patch xsa428-2.patch xsa429.patch - Not building the shim is correctly handled by --disable-pvshim Drop disable-building-pv-shim.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - Upstream bug fixes (bsc#1027519) 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 641041e8-VT-d-constrain-IGD-check.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch - Use "proper" upstream backports: 640f3035-x86-altp2m-help-gcc13.patch 64104238-bunzip-gcc13.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch - ... in place of: bunzip-gcc13.patch altp2m-gcc13.patch xsa427.patch xsa428-1.patch xsa428-2.patch xsa429.patch - Not building the shim is correctly handled by --disable-pvshim Drop disable-building-pv-shim.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest SSBD selection on AMD hardware (XSA-431) 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch - Upstream bug fixes (bsc#1027519) 645dec48-AMD-IOMMU-assert-boolean-enum.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed (XSA-433) 64bea1b2-x86-AMD-Zenbleed.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Add more debug to libxc-sr-track-migration-time.patch This is supposed to help with doing the math in case xl restore fails with ERANGE as reported in bug#1209311 - Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch A bit is an index in bitmap, while bits is the allocated size of the bitmap. - Update to Xen 4.17.2 bug fix release (bsc#1027519) xen-4.17.2-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative Return Stack Overflow (XSA-434) - bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data Sampling (XSA-435) - Dropped patches contained in new tarball 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch 645dec48-AMD-IOMMU-assert-boolean-enum.patch 64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch 646b782b-PCI-pci_get_pdev-respect-segment.patch 647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch 648863fc-AMD-IOMMU-Invalidate-All-check.patch 64bea1b2-x86-AMD-Zenbleed.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1212684 - xentop fails with long interface name 64d33a57-libxenstat-Linux-nul-terminate-string.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Handle potential unaligned access to bitmap in libxc-sr-restore-hvm-legacy-superpage.patch If setting BITS_PER_LONG at once, the initial bit must be aligned - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Update to Xen 4.17.5 security bug fix release (bsc#1027519) xen-4.17.5-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1228574 - VUL-0: CVE-2024-31145: xen: error handling in x86 IOMMU identity mapping (XSA-460) - bsc#1228575 - VUL-0: CVE-2024-31146: xen: PCI device pass-through with shared resources (XSA-461) - Dropped patches contained in new tarball 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch 6646031f-x86-ucode-further-identify-already-up-to-date.patch 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch xsa458.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) xsa438.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch - bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A transaction conflict can crash C Xenstored (XSA-440) xsa440.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) xsa442.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) xsa444-1.patch xsa444-2.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Update to Xen 4.17.5 security bug fix release (bsc#1027519) xen-4.17.5-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1228574 - VUL-0: CVE-2024-31145: xen: error handling in x86 IOMMU identity mapping (XSA-460) - bsc#1228575 - VUL-0: CVE-2024-31146: xen: PCI device pass-through with shared resources (XSA-461) - Dropped patches contained in new tarball 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch 6646031f-x86-ucode-further-identify-already-up-to-date.patch 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch xsa458.patch - bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (XSA-462) xsa462.patch - bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) 650abbfe-x86-shadow-defer-PV-top-level-release.patch - bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional execution leak via division by zero (XSA-439) 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch - bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU TLB flushing (XSA-442) 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch - bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple vulnerabilities in libfsimage disk handling (XSA-443) 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch - bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD: Debug Mask handling (XSA-444) 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch - Upstream bug fixes (bsc#1027519) 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch - Patches dropped / replaced by newer upstream versions xsa438.patch xsa439-00.patch xsa439-01.patch xsa439-02.patch xsa439-03.patch xsa439-04.patch xsa439-05.patch xsa439-06.patch xsa439-07.patch xsa439-08.patch xsa439-09.patch xsa442.patch xsa443-01.patch xsa443-02.patch xsa443-03.patch xsa443-04.patch xsa443-05.patch xsa443-06.patch xsa443-07.patch xsa443-08.patch xsa443-09.patch xsa443-10.patch xsa443-11.patch xsa444-1.patch xsa444-2.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) xsa445.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) xsa446.patch - Upstream bug fixes (bsc#1027519) 64763137-x86-AutoIBRS-definitions.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 655b2ba9-fix-sched_move_domain.patch - bsc#1216654 - VUL-0: CVE-2023-46835: xen: x86/AMD: mismatch in IOMMU quarantine page table levels (XSA-445) 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch - bsc#1216807 - VUL-0: CVE-2023-46836: xen: x86: BTC/SRSO fixes not fully effective (XSA-446) 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch - Patches replaced by newer upstream versions xsa445.patch xsa446.patch - Update to Xen 4.17.3 bug fix release (bsc#1027519) xen-4.17.3-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 64763137-x86-AutoIBRS-definitions.patch 64e5b4ac-x86-AMD-extend-Zenbleed-check.patch 64e6459b-revert-VMX-sanitize-rIP-before-reentering.patch 64eef7e9-x86-reporting-spurious-i8259-interrupts.patch 64f71f50-Arm-handle-cache-flush-at-top.patch 65084ba5-x86-AMD-dont-expose-TscFreqSel.patch 65087000-x86-spec-ctrl-SPEC_CTRL_EXIT_TO_XEN-confusion.patch 65087001-x86-spec-ctrl-fold-DO_SPEC_CTRL_EXIT_TO_XEN.patch 65087002-x86-spec-ctrl-SPEC_CTRL-ENTRY-EXIT-asm-macros.patch 65087003-x86-spec-ctrl-SPEC_CTRL-ENTER-EXIT-comments.patch 65087004-x86-entry-restore_all_xen-stack_end.patch 65087005-x86-entry-track-IST-ness-of-entry.patch 65087006-x86-spec-ctrl-VERW-on-IST-exit-to-Xen.patch 65087007-x86-AMD-Zen-1-2-predicates.patch 65087008-x86-spec-ctrl-Zen1-DIV-leakage.patch 650abbfe-x86-shadow-defer-PV-top-level-release.patch 65263470-AMD-IOMMU-flush-TLB-when-flushing-DTE.patch 65263471-libfsimage-xfs-remove-dead-code.patch 65263472-libfsimage-xfs-amend-mask32lo.patch 65263473-libfsimage-xfs-sanity-check-superblock.patch 65263474-libfsimage-xfs-compile-time-check.patch 65263475-pygrub-remove-unnecessary-hypercall.patch 65263476-pygrub-small-refactors.patch 65263477-pygrub-open-output-files-earlier.patch 65263478-libfsimage-function-to-preload-plugins.patch 65263479-pygrub-deprivilege.patch 6526347a-libxl-allow-bootloader-restricted-mode.patch 6526347b-libxl-limit-bootloader-when-restricted.patch 6526347c-SVM-fix-AMD-DR-MASK-context-switch-asymmetry.patch 6526347d-x86-PV-auditing-of-guest-breakpoints.patch 652fef4f-x86-AMD-erratum-1485.patch 65319724-VT-d-SAGAW-parsing.patch 6532858d-x86-DOITM.patch 654370e2-x86-x2APIC-remove-ACPI_FADT_APIC_CLUSTER-use.patch 65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch 65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch 65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch 655b2ba9-fix-sched_move_domain.patch xsa440.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) xsa449.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) xsa450.patch - Upstream bug fixes (bsc#1027519) 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch - bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions assigned to incorrect contexts (XSA-449) 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch - bsc#1219080 - VUL-0: CVE-2023-46840: xen: VT-d: Failure to quarantine devices in !HVM builds (XSA-450) 65b8f9ab-VT-d-else-vs-endif-misplacement.patch - Patches replaced by newer upstream versions xsa449.patch xsa450.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) xsa451.patch - bsc#1219885 - VUL-0: CVE-2023-46841: xen: x86: shadow stack vs exceptions from emulation stubs (XSA-451) 65ddda52-x86-CET-stub-exn-recovery.patch - Upstream bug fixes (bsc#1027519) 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch - Patches replaced by newer upstream versions xsa451.patch - bsc#1221332 - VUL-0: CVE-2023-28746: xen: x86: Register File Data Sampling (XSA-452) 65dcd66b-x86-entry-EFRAME_-constants.patch 65df3430-x86-Resync-intel-family-h.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch - bsc#1221334 - VUL-0: CVE-2024-2193: xen: GhostRace: Speculative Race Conditions (XSA-453) 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - Upstream bug fixes (bsc#1027519) 65eee676-x86-mm-last-L1e-detection-in-mxml.patch - Update to Xen 4.17.4 security bug fix release (bsc#1027519) xen-4.17.4-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) - bsc#1222302 - VUL-0: CVE-2024-31142: xen: x86: Incorrect logic for BTC/SRSO mitigations (XSA-455) - bsc#1222453 - VUL-0: CVE-2024-2201: xen: x86: Native Branch History Injection (XSA-456) - Dropped patches contained in new tarball 650dac01-x86-paging-drop-update_cr3-do_locking.patch 65842d5c-x86-AMD-extend-CPU-erratum-1474-fix.patch 659d44da-x86-HVM-hide-SVM-VMX-when.patch 65a7a0a4-x86-Intel-GPCC-setup.patch 65a9911a-VMX-IRQ-handling-for-EXIT_REASON_INIT.patch 65b27990-x86-p2m-pt-off-by-1-in-entry-check.patch 65b8f961-PCI-fail-dev-assign-if-phantom-functions.patch 65b8f9ab-VT-d-else-vs-endif-misplacement.patch 65c2104d-AMD-IVMD-memtype-check.patch 65cb29fe-x86-HVM-tidy-state-on-hvmemul_map_linear_addr.patch 65d7277f-build-fail-when-kconfig-fails.patch 65d727cf-x86emul-EVEX-R-checks.patch 65dca902-x86-spec-set-BRANCH_HARDEN-option-only-when.patch 65dcd66b-x86-entry-EFRAME_-constants.patch 65ddda52-x86-CET-stub-exn-recovery.patch 65ddea60-x86-spec-log-builtin-HARDEN-options.patch 65ddea7c-x86-spec-set-INDIRECT_THUNK-only-when-enabled.patch 65ddea90-x86-spec-dont-log-thunk-option-if-not.patch 65df3430-x86-Resync-intel-family-h.patch 65e02fce-libxl-SEGV-in-device_model_spawn_outcome.patch 65e2371b-x86-CP-allow-levelling-of-VERW-side-effects.patch 65eee676-x86-mm-last-L1e-detection-in-mxml.patch 65f079a1-VMX-perform-VERW-flushing-later.patch 65f079a2-x86-spec-ctrl-perform-VERW-flushing-later.patch 65f079a3-x86-spec-ctrl-rename-VERW-related-options.patch 65f079a4-x86-spec-ctrl-VERW-handling-adjustments.patch 65f079a5-x86-spec-ctrl-mitigate-RFDS.patch 65f079a6-swap-order-of-actions-in-FREE-macros.patch 65f079a7-x86-spinlock-block-speculation-into.patch 65f079a8-rwlock-block-speculation-into.patch 65f079a9-percpu-rwlock-block-speculation-into.patch 65f079aa-locking-wrappers-always-inline.patch 65f079ab-x86-mm-speculation-barriers-in-open-coded.patch 65f079ac-x86-protect-conditional-locking-from-speculative.patch - bsc#1221984 - VUL-0: CVE-2023-46842: xen: x86 HVM hypercalls may trigger Xen bug check (XSA-454) 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch - Upstream bug fixes (bsc#1027519) 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch - bsc#1214718 - The system hangs intermittently when Power Control Mode is set to Minimum Power on SLES15SP5 Xen 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch - Upstream bug fixes (bsc#1027519) 6646031f-x86-ucode-further-identify-already-up-to-date.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch - bsc#1227355 - VUL-0: CVE-2024-31143: xen: double unlock in x86 guest IRQ handling (XSA-458) xsa458.patch - Update to Xen 4.17.5 security bug fix release (bsc#1027519) xen-4.17.5-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - bsc#1228574 - VUL-0: CVE-2024-31145: xen: error handling in x86 IOMMU identity mapping (XSA-460) - bsc#1228575 - VUL-0: CVE-2024-31146: xen: PCI device pass-through with shared resources (XSA-461) - Dropped patches contained in new tarball 6617d62c-x86-hvm-Misra-Rule-19-1-regression.patch 6627a4ee-vRTC-UIP-set-for-longer-than-expected.patch 6627a5fc-x86-MTRR-inverted-WC-check.patch 662a6a4c-x86-spec-reporting-of-BHB-clearing.patch 662a6a8d-x86-spec-adjust-logic-to-elide-LFENCE.patch 663090fd-x86-gen-cpuid-syntax.patch 663a383c-libxs-open-xenbus-fds-as-O_CLOEXEC.patch 663a4f3e-x86-cpu-policy-migration-IceLake-to-CascadeLake.patch 663d05b5-x86-ucode-distinguish-up-to-date.patch 663eaa27-libxl-XenStore-error-handling-in-device-creation.patch 66450626-sched-set-all-sched_resource-data-inside-locked.patch 66450627-x86-respect-mapcache_domain_init-failing.patch 6646031f-x86-ucode-further-identify-already-up-to-date.patch 6666ba52-x86-irq-remove-offline-CPUs-from-old-CPU-mask-when.patch 666994ab-x86-SMP-no-shorthand-IPI-in-hotplug.patch 666994f0-x86-IRQ-limit-interrupt-movement-in-fixup_irqs.patch 666b07ee-x86-EPT-special-page-in-epte_get_entry_emt.patch 666b0819-x86-EPT-avoid-marking-np-ents-for-reconfig.patch 666b085a-x86-EPT-drop-questionable-mfn_valid-from-.patch 667187cc-x86-Intel-unlock-CPUID-earlier.patch 66718849-x86-IRQ-old_cpu_mask-in-fixup_irqs.patch 6671885e-x86-IRQ-handle-moving-in-_assign_irq_vector.patch 6672c846-x86-xstate-initialisation-of-XSS-cache.patch 6672c847-x86-CPUID-XSAVE-dynamic-leaves.patch 6673ffdc-x86-IRQ-forward-pending-to-new-dest-in-fixup_irqs.patch xsa458.patch - bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (XSA-462) xsa462.patch - bsc#1230366 - VUL-0: CVE-2024-45817: xen: x86: Deadlock in vlapic_error() (XSA-462) 66f2af41-x86-vLAPIC-undue-recursion-of-vlapic_error.patch Drop xsa462.patch - Upstream bug fixes (bsc#1027519) 66cf737b-x86-Dom0-disable-SMAP-for-PV-only.patch 66d6dca8-libxl-nul-termination-in-xen_console_read_line.patch 66d8690f-SUPPORT-split-XSM-from-Flask.patch 66e29480-x86-HVM-properly-reject-indirect-VRAM-writes.patch 66e44ae2-x86-ucode-AMD-buffer-underrun.patch 66f2fd92-x86-ucode-Intel-stricter-sanity-check.patch - bsc#1232542 - remove usage of net-tools-deprecated from supportconfig plugin - bsc#1232622 - VUL-0: CVE-2024-45818: xen: Deadlock in x86 HVM standard VGA handling (XSA-463) xsa463-01.patch xsa463-02.patch xsa463-03.patch xsa463-04.patch xsa463-05.patch xsa463-06.patch xsa463-07.patch xsa463-08.patch xsa463-09.patch xsa463-10.patch - bsc#1232624 - VUL-0: CVE-2024-45819: xen: libxl leaks data to PVH guests via ACPI tables (XSA-464) xsa464.patch - Drop the following patches 66e29480-x86-HVM-properly-reject-indirect-VRAM-writes.patch stdvga-cache.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - xfs_copy: don't use cached buffer reads until after libxfs_mount (bsc#1227150) - Add xfsprogs-xfs_copy-don-t-use-cached-buffer-reads-until-after-l.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - xfs_copy: don't use cached buffer reads until after libxfs_mount (bsc#1227150) - Add xfsprogs-xfs_copy-don-t-use-cached-buffer-reads-until-after-l.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - xfs_copy: don't use cached buffer reads until after libxfs_mount (bsc#1227150) - Add xfsprogs-xfs_copy-don-t-use-cached-buffer-reads-until-after-l.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - xfs_copy: don't use cached buffer reads until after libxfs_mount (bsc#1227150) - Add xfsprogs-xfs_copy-don-t-use-cached-buffer-reads-until-after-l.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Update to v4.18.0 * xfs_repair: notify user if free inodes are corrupt * xfs_repair: use extent size validation helpers * xfs_quota: don't stop the directory tree walk at DEPTH * xfs_scrub: ongoing updates * xfs_io: document shutdown -f * xfs_io: wire up online repair ioctls * misc: adddebian initramfs hook to package * misc: remove unused macros * misc: remove many XFS_BUF macros * Majority of 4.18 libxfs changes merged from kernel - Update to v4.17.0 * mkfs.xfs: only stat block devices during mkfs init * xfs_repair: multiple fixes and improvements * xfs_repair: check and repair quota metadata * xfs_repair: fix shortform root inode parent * xfs_db: don't ASSERT on unrecognized metadata * xfs_db: add superblock info command ala xfs_info * xfs_spaceman: add superblock info command ala xfs_info * xfs_info: call xfs_db for unmounted devices * xfs_io: add online label command * xfs_io: add O_PATH and O_NOFOLLOW options * xfs_io: recognize *iB units in copy_range - Removed now-obsolete patches: * xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch - Update to v4.19.0 * Fix up debian subdir build w.r.t. CHECK_CMD * Remove non-linux platforms * Remove retpoline support * Add sparse checking & related fixes/cleanups * Fix cross-platform building w.r.t. crc32selftest * libxfs: add agfl free deferred op type * mkfs.xfs: discard only after all validations * xfs_repair: fix segfault in longform_dir2_entry_check * xfs_repair: fix ASSERT in xfs_bunmapi * xfs_repair: fix redahead thread deadlock/stall * xfs_repair: avoid wriing back all inodes * xfs_repair: don't treat directory root LEAFN as corrupt * xfs_io: add crc32 self test * xfs_io: remove useless do_preadv and do_pwritev arguments * xfs_scrub: make scrub build config-optional * xfs_scrub: lack of kernel support is not a service failure * xfs_scrub_all: fix systemd escaping * majority of 4.19 libxfs changes merged from kernel * big sparse static checker cleanup * mkfs.xfs discard fixes * xfs_io readv/writev cleanup * libxfs transaction commit error checking - Update to v4.20.0 * mkfs.xfs: null-term symlinks created via protofile * xfs_repair: allow '.' in attribute names * xfs_repair: skip block reservations when fixing freelist * xfs_repair: rebuild dir when nonroot blocks corrupt * xfs_repair: int nonleaf finobt blocks with proper magic * xfs_repair: fix off by one error rebuilding high keys * xfs_io: allow open file permissions to be changed * xfs_io: open pipes in non-blocking mode * xfs_metadump: multiple stale data zeroing fixes * xfs_quota: allow reg files w/o prjinherit flag * xfs_db: properly decode finobt record w/ sparse inodes * xfs_scrub: move all eecutables to /usr/sbin * xfs_scrub: handle totally empty inode chunks * xfs.5 manpage: remove barrier related options * xfs_io.8 manpage: rearrange command listings by section * remove generated scrub files under make clean * skip scrub manpage install if not configured * Merge libxfs from kernel 4.20 - Update to v5.0.0 * xfs_db: scan all sparse inodes when using 'frag' * Fix build with newer statx headers * libxfs: fix buffer & inode lifetimes * misc: fix strncpy length complaints from gcc * Merge libxfs from kernel 5.0 - update to v5.2.0 - libxfs: cosmetic changes to trans.c to match kernel (Eric Sandeen) - libxfs changes merged from kernel 5.2 - mkfs: enable reflink by default (Darrick Wong) - mkfs: fix stripe unit handling (Allison Collins) - mkfs: remove useless log options in usage() (Yang Xu) - mkfs: validate start and end of aligned logs (Darrick Wong) - xfs_quota: fix built-in help for project setup (Eric Sandeen) - xfs_io: allow passing an open file to copy_range (Amir Goldstein) - xfs_info: limit findmnt to mounted xfs filesystems (Amir Goldstein) - man: break out several ioctl man pages (Darrick Wong) - man: Fix an inconsistency in the mkfs man page (Alvin Zheng) - xfs_scrub: fix background-mode sleep throttling (Darrick Wong) - libxfs: sync up xfs_trans_inode.c with the kernel (Eric Sandeen) - libfrog: fix bitmap return values (Darrick Wong) - libfrog: don't set negative errno in conversion f'ns (Darrick Wong) - update to v.5.3.0 * mkfs.xfs: use libfx to write out AGs versus open coding * mkfs.xfs: fix incorrect error message during AG init * xfs_repair: better info when metadata updates fail * xfs_growfs: allow mounted device node as argument * xfs_spaceman: always report sick metadata * xfs_io: add a bulkstat command * xfs_io: encrypt command enhancements * xfs_io: copy_file_range fixes * man: document several new ioctls * xfs_scrub: copious rewriting * libfrog: header moves, refactoring, updates * libxfs: fix buffer refcounting - update to v5.4.0: * xfsprogs: Release v5.4.0 * xfsprogs: Release v5.4.0-rc1 * mkfs: tidy up discard notifications * mkfs: Break block discard into chunks of 2 GB * xfs_admin: enable online label getting and setting * xfs_admin: support external log devices * xfsprogs: add missing line feeds in libxfs/rdwr.c * xfsprogs: remove stray libxfs whitespace * xfsprogs: Release v5.4.0-rc0 * xfs: change the seconds fields in xfs_bulkstat to signed * xfs: move local to extent inode logging into bmap helper * xfs: remove broken error handling on failed attr sf to leaf change * xfs: log the inode on directory sf to block format change * xfs: remove unused flags arg from xfs_get_aghdr_buf() * xfs: log proper length of superblock * xfs: revert 1baa2800e62d ("xfs: remove the unused XFS_ALLOC_USERDATA flag") * xfs: convert inode to extent format after extent merge due to shift * xfs: define a flags field for the AG geometry ioctl structure * xfs: add a xfs_valid_startblock helper * xfs: remove the unused XFS_ALLOC_USERDATA flag * xfs: allocate xattr buffer on demand * xfs: consolidate attribute value copying * xfs: move remote attr retrieval into xfs_attr3_leaf_getvalue * xfs: remove unnecessary indenting from xfs_attr3_leaf_getvalue * xfs: make attr lookup returns consistent * xfs: reverse search directory freespace indexes * xfs: speed up directory bestfree block scanning * xfs: factor free block index lookup from xfs_dir2_node_addname_int() * xfs: factor data block addition from xfs_dir2_node_addname_int() * xfs: move xfs_dir2_addname() * xfs: remove all *_ITER_CONTINUE values * xfs: remove all *_ITER_ABORT values * xfs: reinitialize rm_flags when unpacking an offset into an rmap irec * xfs: remove unnecessary int returns from deferred bmap functions * xfs: remove unnecessary int returns from deferred refcount functions * xfs: remove unnecessary int returns from deferred rmap functions * xfs: remove unnecessary parameter from xfs_iext_inc_seq * xfs: fix sign handling problem in xfs_bmbt_diff_two_keys * xfs: don't return _QUERY_ABORT from xfs_rmap_has_other_keys * xfs: fix maxicount division by zero error * xfs: remove excess function parameter description in 'xfs_btree_sblock_v5hdr_verify' * xfs: add kmem allocation trace points * fs: xfs: Remove KM_NOSLEEP and KM_SLEEP. - split xfs scrubbing scripts and service files into a separate optional package, in order to avoid having python as a dependency in the main xfsprogs rpm (bsc#1157438). - update to v5.5.0: * xfsprogs: actually check that writes succeeded * mkfs.xfs: check root inode location * mkfs.xfs: efficient block zeroing * xfs_repair: fix broken unit conv. in dir invalidation * xfs_repair: fix bad next_unlinked field * xfs_repair: don't corrupt attr fork clearing forw/back * xfs_repair: check root dir pointer before trashing it * xfs_repair: try to fix sb_unit value from secondaries * libxfs changes merged from kernel 5.5 - update to v5.6.0: * xfs_scrub: don't set WorkingDirectory in systemd job * xfsprogs: fix silently broken option parsing * xfsprogs: various minor Coverity fixes * xfs_repair: fix dir_read_buf use of libxfs_da_read_buf * libxfs: check retval of device flush when closing * xfs_io: set exitcode on failure appropriately * libxfs changes merged from kernel 5.6 - update to v5.7.0: * xfs_io: document '-q' option for sendfile command * remove libreadline support * xfs_quota: allow individual timer extension * xfs_quota: fix unsigned int id comparisons * xfs_repair: fix progress reporting * xfs_repair: fix minrecs error during phase5 btree rebuild * xfs_repair: add missing validations to match xfs_check * xfs_repair: use btree bulk loading * xfs_io: fix copy_range argument parsing * xfs_io: document -q option for pread/pwrite command * xfs_metadump: man page fixes * xfs_db: fix crc invalidation segfault * libxfs changes merged from kernel 5.7 - Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075) - update to v5.8.0: * xfs_db: set b_ops to NULL for types without verifiers * mkfs: allow setting dax flag on root directory * xfs_quota: improve reporting and messages * xfs_db: use correct inode to set inode type * xfs_db: fix nlink usage in check * xfs_db: report the inode dax flag * man: update mkfs.xfs inode flag option documentation * xfsprogs: move custom interface def'ns to new header * xfs_repair: check quota counters * xfs_io: fix -D vs -R handling * libxfs changes merged from kernel 5.8 - update to v5.9.0: * mkfs.xfs: disallow creation of RT files from proto file * mkfs.xfs: fix ASSERT on small device with stripe geom * xfs_repair: more fixes from fuzz-testing * libhandle: fix potential unterminated string problem * libhandle: libfrog: fix a potential null pointer deref * man: install all manpages that redirect to another page * man: fix ioctl_xfs_geometry manpage naming * xfsprogs: various realtime related fixes * xfsprogs: ignore autofs mount table entries * libxfs: make buffers track the per-ag structures * libxfs changes merged from kernel 5.9 - update to 5.10.0: - xfs_repair: remove old code for mountpoint inodes - xfsprogs: Add inode btree counter feature - xfsprogs: Add bigtime feature for Y2038 - xfsprogs: Polish translation update - mkfs.xfs: Add config file feature - mkfs.xfs: allow users to specify rtinherit=0 - xfs_repair: simplify bmap_next_offset - man: various manpage updates - libxfs: remove some old dead code - libxfs: add realtime extent tracking - libxfs changes merged from kernel 5.10 - refresh 0001-repair-shift-inode-back-into-place-if-corrupted-by-b.patch against libxfs changes - update to v5.11.0: - xfs_admin: don't hide xfs_repair output when upgrading - man: document attr2, ikeep option deprecation in xfs.5 - mkfs: make use of xfs_validate_stripe_geometry() - mkfs: fix wrong inobtcount usage error output - xfs_repair: enable bigtime upgrade via repair - xfs_repair: enable inobtcount upgrade via repair - xfs_repair: set NEEDSREPAIR on first write - xfs_repair: clear the needsrepair flag when done - xfs_repair: check dquot id and type - xfs_fsr: Verify bulkstat version in qsort's cmp() - xfs_fsr: Interpret args of qsort's cmp() correctly - xfs_scrub: load and unload libicu properly - xfs_scrub: various fixes - xfs_admin: support adding features to V5 filesystems - xfs_admin: support filesystems with realtime devices - man: mark all deprecated V4 format options - misc: fix valgrind complaints - xfs_db: disallow label/uuid setting if NEEDSREPAIR - xfs_db: show NEEDSREPAIR in check & version commands - xfs_db: add an ls command - xfs_db: add a directory path lookup command - libxfs changes merged from kernel 5.11 - update to v5.12.0: - mkfs: don't default to too-large physical sector size - repair: phase 6 speedups - man: Add dax mount option to man xfs(5) - xfs_admin: pick up log arguments correctly - xfs_growfs: support shrinking unused space - libfrog: report inobtcount in geometry - xfs_logprint: Fix buffer overflow printing quotaoff - xfsprogs: include <signal.h> for platform_crash - xfsprogs: remove BMV_IF_NO_DMAPI_READ flag - workqueue: bound maximum queue depth - libxfs changes merged from kernel 5.12 - mkfs: disable reflink support by default (jsc#SLE-17360) - Add xfsprogs-mkfs-disable-reflink-support-by-default.patch Do not format xfs filesystems with reflink support by default, as the feature is read-only compatible, and read-write compatibility is required to be maintained within product stream (SLE15). - Dropped all following patches which are now part of upstream xfsprogs, and were previously backported to address bugs bsc#1167206, bsc#1167205, bsc#1158630, bsc#1158509, bsc#1158504, bsc#1158758, bsc#1129859, bsc#1122271, bsc#1073421, bsc#1119063, bsc#1105068. make_xfs_scrub_interp_explicit.patch xfsprogs-mkfs-avoid-divide-by-zero-when-hardware-reports-opti.patch xfsprogs-repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch xfsprogs-xfs_repair-Add-missing-braces-to-allow-zeroing-of-co.patch xfsprogs-xfs_repair-allow-in-attribute-names.patch xfsprogs-xfs-hoist-xfs_fs_geometry-to-libxfs.patch xfsprogs-xfs-refactor-the-geometry-structure-filling-function.patch xfsprogs-xfs_spaceman-add-a-superblock-info-command.patch xfsprogs-xfs_info-move-to-xfs_spaceman.patch xfsprogs-xfs_db-add-a-superblock-info-command.patch xfsprogs-libfrog-refactor-fs-geometry-printing-function.patch xfsprogs-mkfs-use-geometry-generation-helper-functions.patch xfsprogs-xfs_info-call-xfs_db-for-offline-filesystems.patch xfsprogs-xfs_info-use-findmnt-to-handle-mounted-block-devices.patch xfsprogs-xfs_quota-fix-false-error-reporting-of-project-inher.patch xfsprogs-xfs-create-structure-verifier-function-for-shortform.patch xfsprogs-xfs-create-structure-verifier-function-for-short-for.patch xfsprogs-xfs-refactor-short-form-directory-structure-verifier.patch xfsprogs-xfs-provide-a-centralized-method-for-verifying-inlin.patch xfsprogs-xfs_repair-don-t-fail-directory-repairs-when-grabbin.patch xfsprogs-xfs_repair-implement-custom-ifork-verifiers.patch xfsprogs-xfs_repair-use-custom-ifork-verifier-in-mv_orphanage.patch xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch xfsprogs-mkfs-validate-extent-size-hint-parameters.patch xfsprogs-xfs_io-Make-copy_range-arguments-understand-iB-values.patch xfsprogs-man-document-some-missing-xfs_db-commands.patch xfsprogs-man-reformat-xfs_quota-commands-in-the-manpage-for-t.patch - update to v5.13.0: - mkfs: validate rtextsz hint when rtinherit is set - xfs_repair: invalidate dirhash when junking dirent - xfs_repair: validate inherited rtextsz hint alignmt - xfs_quota: allow truncate of grp & prj quota files - xfs_io: allow callers to dump fs stats individually - xfs_io: don't count fsmaps before querying fsmaps - xfs_io: print header once when dumping fsmap in csv - xfs_io: clean up the funshare command a bit - xfs_io: fix broken funshare_cmd usage - libxfs changes merged from kernel 5.13 - mkfs: don't trample the gid set in the protofile (bsc#1205266) - Add xfsprogs-mkfs-don-t-trample-the-gid-set-in-the-protofile.patch - mkfs: prevent corruption of passed-in suboption string values (bsc#1205377) - Add xfsprogs-mkfs-prevent-corruption-of-passed-in-suboption-strin.patch - mkfs: terminate getsubopt arrays properly (bsc#1205284) - Add xfsprogs-mkfs-terminate-getsubopt-arrays-properly.patch - xfs_repair: ignore empty xattr leaf blocks (bsc#1205272) - Add xfsprogs-xfs_repair-ignore-empty-xattr-leaf-blocks.patch - Fixed dependencies with libraries (bsc#1012246): * libxmlsec1-openssl.so * libxmlsec1-gcrypt.so * libxmlsec1-gnutls.so * libxmlsec1-nss.so - Version update to 1.2.24: * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support for xmlsec-nss. * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS handling. * Disabled external entities loading by xmlsec utility app by default to prevent XXE attacks. * Improved OpenSSL version and features detection. * Cleaned up, simplified, and standardized internal error reporting. * Fixed a few Coverity-discovered bugs. * Marked as deprecated all the functions in xmlsec/soap.h file and a couple other functions no longer required by xmlsec. These functions will be removed in the future releases. * Several other small fixes (see commit log for more details). - Version update to 1.2.25: * Various small fixes * Coverity cleanups * Removed support for old openssl - Version update to 1.2.26: * Added xmlsec-mscng module based on Microsoft Cryptography API: Next Generation * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R 34.10-2001 in xmlsec-mscrypto * Added LibreSSL 2.7 support * Upgraded documentation build process to support the latest gtk-doc - Fixed (bsc#1104876). Added: Requires: %{libname} = %{version} to each module in the spec file. This will ensure that when one of the modules is installed the corresponding version of libxmlsec1-1 will also be installed/upgraded. - Add rplintrc to avoid bogus errors: * xmlsec1-rpmlintrc - Version update to 1.2.27: * Added AES-GCM support for OpenSSL and MSCNG (snargit). * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos). * Added RSA-OAEP support for MSCNG (vmiklos). * Continuous build integration in Travis and Appveyor. * Several other small fixes (more details). - Drop the gnutls backend as based on the tests it is quite borked: * We still have nss and openssl backend for people to use - Make sure to recommend at least one backend when you install just xmlsec1 - Update to 1.2.28: * Added BoringSSL support (chenbd). * Added gnutls-3.6.x support (alonbl). * Added DSA and ECDSA key size getter for MSCNG (vmiklos). * Added --enable-mans configuration option (alonbl). * Added coninuous build integration for MacOSX (vmiklos). * Several other small fixes (more details). - Update to 1.2.30: * Enabled XML_PARSE_HUGE for all xml parsers. * Various build and tests fixes and improvements. * Move remaining private header files away from xmlsec/include/ folder. - Update to version 1.2.31: + Unload error strings in OpenSSL shutdown. + Make userData available when executing preExecCallback function. + Add an option to use secure memset. - Pass --disable-md5 to configure: The cryptographic strength of the MD5 algorithm is sufficiently doubtful that its use is discouraged at this time. It is not listed as an algorithm in [XMLDSIG-CORE1] https://www.w3.org/TR/xmlsec-algorithms/#bib-XMLDSIG-CORE1 - Relax the crypto policies for the test-suite. This allows the tests using certificates with small key lengths to pass. - update to 1.2.32: + Remove MD5 for NSS 3.59 and above + Fix PKCS12_parse return code handling + Fix OpenSSL lookup + xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice - add upstream signing key and validate source signature - put license text into all subpackages - treat all compiler warnings as errors - update to 1.2.33: * Fix decrypting session key for two recipients * Added --privkey-openssl-engine option to enhance openssl engine support - update to 1.2.34: * Support for OpenSSL compiled with OPENSSL_NO_ERR. * Full support for LibreSSL 3.5.0 and above * Several other small fixes - Add export CFLAGS/CXXFLAGS="-Wno-error=deprecated-declarations" inbefore configure. We pass --enable-werror to configure, and that leads to warnings about deprecations failing build. As deprecations is mainly a consern for upstream, stop failing on those. - Update to 1.2.36: * Retired the XMLSec mailing list "xmlsec@aleksey.com" and the XMLSec Online Signature Verifier. - Update to 1.2.35: * Migration to OpenSSL 3.0 API (based on PR by @snargit). Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use "--enable-openssl3-engines" configure flag (there will be a lot of deprecation warnings). * The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library. * Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled "-Werror" and "-pedantic" flags on CI builds. * Added configure flag to use size_t for xmlSecSize (currently disabled by default for backward compatibility). * Moved all CI builds to GitHub actions. - update to 1.2.37: Fixed two regressions from 1.2.36 release - switch to pkgconfig(zlib) to allow alternative providers as well - Text mode control center: always display the YaST modules installed in the system root (when running in a container display the modules installed in the container) (bsc#1199840) - 4.5.7 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Properly close nested progress callbacks (bsc#1223281) - 4.5.27 - Text mode control center: always display the YaST modules installed in the system root (when running in a container display the modules installed in the container) (bsc#1199840) - 4.5.7 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Text mode control center: always display the YaST modules installed in the system root (when running in a container display the modules installed in the container) (bsc#1199840) - 4.5.7 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Text mode control center: always display the YaST modules installed in the system root (when running in a container display the modules installed in the container) (bsc#1199840) - 4.5.7 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Properly close nested progress callbacks (bsc#1223281) - 4.5.27 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Properly close nested progress callbacks (bsc#1223281) - 4.5.27 - Fixed libzypp initialization, in the YaST container read the configured repositories from the host (related to bsc#1199840) - 4.5.8 - bsc#1200016 - added a method for finding a package according to a pattern - 4.5.9 - Do not ask for user input while checking file conflicts if the delayed progress popup is not shown (bsc#1201924) - 4.5.10 - On transactional systems, inform the user that packages are required to be installed manually (related to bsc#1199840) - 4.5.11 - Added a parameter to NetworkService.EnableDisableNow method in order to ensure that the selected network service is enabled even when the selection has not been modified (bsc#1202479) - 4.5.12 - bsc#1203227 - Replaced egrep with grep -E. - 4.5.13 - bsc#1200016 - by_pattern moved into http_server moduleas it is the only user - 4.5.14 - Better detection of YaST2 Journal (related to bsc#1199840). - 4.5.15 - add Yast::ReducedRecorder for Cheetah to filter out certain streams to be able to not log sensitive information (bsc#1201962) - 4.5.16 - remove #postprocess_url from RelURL class (jsc#SLE-22578, jsc#SLE-24584) - 4.5.17 - Improve logging in the ProductControl module, use the new "log.group" call to group logs for each workflow step (bsc#1204625) - 4.5.18 - Fix hash vs keyword arguments in RSpec expectations (bsc#1204871) - 4.5.19 - ArchFilter: Add new class to allow unified definition of hardware architecture filter. The main use case is to read arch specific configuration in various configuration files like control.xml or d-installer.yml (gh#yast/d-installer#279) - 4.5.20 - Show help text in YaST Control Center (bsc#1206919). - 4.5.21 - Replace transitional %usrmerged macro with regular version check (boo#1206798) - 4.5.22 - DnsServerApi: drop module. It should never be in yast2 as it import module from yast2-dns-server. And now dns-server is going to be dropped (bsc#1205363) - 4.5.23 - Allow dir:///foo to equal dir:/foo (bsc#1207239) - 4.5.24 - Revert dropping DnsServerAPI.pm to prevent build failures for yast2-dns-server, yast2-http-server (bsc#1208833) - 4.5.25 - Allow host/domain names starting with an underscore (bsc#1219920) - 4.5.26 - Properly close nested progress callbacks (bsc#1223281) - 4.5.27 - Initial packaging based on Mageia package - Update to 0.7.6 + SHA-512 and SHA-512/128 support + New default chunk checksum type SHA-512/128 + Automatic chunking moved into libzck and is now default + New option to disable automatic chunking + Bugfixes - Do not manually specify dependencies which are automatically generated - Make requirements of devel package less strict - Rebase to 0.9.11 + Fix small bug where creating a zck_dl context fails when zck context is NULL + Fix security bugs found by Coverity + Fix test failures for zstd <= 1.3.4 + Add gen_xml_dictionary to libexecdir with zck_ prefix + Fix intermittent bug where auto-chunking wasn't deterministic + ABI (but not API change) - Use bool from stdbool.h + Allow specification of output file in zck + Set minimum and maximum chunk sizes for both automatic and manual chunking + New error handling functions + File format changes + API changes - Make requirements between subpackages stricter to avoid issues due to inter-subpackage ABI/API changes - Bump meson build dependency to match meson.build requirement - Update to version 0.9.13 * Add read support for zchunk files with optional flags * Fix tests for zstd-1.3.6 - Update to version 0.9.17 + Turn off some tests for big-endian architectures since zstd isn't deterministic on them + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file + Add functions to API to simplify extracting a single chunk + Change default zstd compression to 9 for a 6x speed increase in compression speed for a 5% increase in compression size + Switch from optional flags to more robust optional elements + Sanity check hex hashes passed in as an option - Update to version 1.0.2 + Use hash table for finding identical chunks, speeding up process considerably + Add test case to verify that identical chunk checking is working - Backport patch from upstream to fix bugs discovered by Coverity + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.0.3 + Fix some small bugs found by Coverity + Fix memory leak and off-by-one errors - Drop patches part of 1.0.3 release + 0001-Fix-some-small-bugs-found-by-Coverity.patch - Update to version 1.1.0 + Fix multipart boundary bug when dealing with lighttpd servers + Optimize chunk matching while downloading, significantly reducing CPU usage - Update to version 1.1.4: * Simplify regex for detecting part header info * Fix coverity warnings * Open files with permissions 0666 and let umask(2) do its job. * Multipart boundary field can be quoted. - Update to version 1.1.5 + Handle write errors correctly - Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build with zstd 1.4.7+. - Update to version 1.1.9 * Handle zstd 1.4.7+ * Update documentation * unzck: require a *.zck extension * General bug fixes - Dropped upstream merged d2eae512bee09a4047cfe586de12f644d73b0736.patch - Add fix-test-argp.patch: Fix argp detection - Update to version 1.1.11 * Fix memory leak of zck->prep_digest * Fix argp detection * Handle certain rare web servers that don't start with \r\n - Drop upstream merged fix-test-argp.patch - Update to version 1.1.12 * Update testsuite for zstd 1.5 - Update to version 1.1.14 * Final fixes for zstd 1.5 support - Update to version 1.1.16 * Fix major bug when compressing with dictionary - Fix CVE-2023-46228, bsc#1216268 * Handle overflow errors in malformed zchunk files. - Added patch: * CVE-2023-46228.patch - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum conform to usage bsc#1141059 - Update the s390 patchset bsc#1137624: * 410.patch - Add SUSE specific patch to fix bsc#1138793, we simply don't want to test if the app was linked with exactly same version of zlib like the one that is present on the runtime: * zlib-no-version-check.patch - Update the zlib-no-version-check.patch to be even more forgiving with the versions on the zlib to allow updates without rebuilds - Update 410.patch to contain latest fixes from IBM bsc#1166260 * The build behaviour changed - Permit a deflateParams() parameter change as soon as possible(bsc#1174736) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551) * bsc1174551-fxi-imcomplete-raw-streams.patch - Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776 - Add patch to fix compression level switching bsc#1175811 bsc#1175830 bsc#1175831 * zlib-compression-switching.patch - Provide a testsuite subpackage to run post-build validation - install to /usr (boo#1029961) - Fix hw compression on z15 bsc#1176201 - Add zlib-s390x-z15-fix-hw-compression.patch - Don't install (internal) crypt.h header in minizip * minizip-dont-install-crypt-header.patch - Fix memory corruption on deflate, bsc#1197459 * bsc1197459.patch - CVE-2018-25032 - Update 410.patch * Remove included patches: bsc1174551-fxi-imcomplete-raw-streams.patch zlib-compression-switching.patch zlib-s390x-z15-fix-hw-compression.patch - Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch - switch to https urls - Update to 1.2.12: * A lot of bug fixes * Improve speed of crc32 functions * Use ARM crc32 instructions if the ARM architecture has them For the complete changes, see ChangeLog - Fixes CVE-2022-37434, heap-based buffer over-read or buffer overflow in inflate.c via a large gzip header extra field (CVE-2022-37434, bsc#1202175) - Added patches: * zlib-1.2.11-covscan-issues-rhel9.patch * zlib-1.2.11-covscan-issues.patch * zlib-1.2.12-s390-vectorize-crc32.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.5-minizip-fixuncrypt.patch - Removed patches: * bsc1197459.patch (upstreamed) * zlib-power8-fate325307.patch (replaced by zlib-1.2.12-optimized-crc32-power8.patch) * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) * 410.patch (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch) - Refreshed patches: * zlib-format.patch * zlib-no-version-check.patch - Disable profiling since it breaks tests - Update zlib-rpmlintrc - Add Power8 optimizations: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-adler32-vector-optimizations-for-power.patch * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch - Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch - build zlib with optflags again - Update to 1.13: * Fix configure issue that discarded provided CC definition * Correct incorrect inputs provided to the CRC functions * Repair prototypes and exporting of new CRC functions * Fix inflateBack to detect invalid input with distances too far * Have infback() deliver all of the available output up to any error * Fix a bug when getting a gzip header extra field with inflate() * Fix bug in block type selection when Z_FIXED used * Tighten deflateBound bounds * Remove deleted assembler code references * Various portability and appearance improvements - Added patches: * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.13-fix-bug-deflateBound.patch * zlib-1.2.13-optimized-s390.patch - Refreshed patches: * zlib-1.2.12-add-optimized-slide_hash-for-power.patch * zlib-1.2.12-add-vectorized-longest_match-for-power.patch * zlib-1.2.12-s390-vectorize-crc32.patch - Removed patches: * zlib-1.2.12-fix-configure.patch * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch * zlib-1.2.12-optimized-crc32-power8.patch * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch * zlib-1.2.12-fix-CVE-2022-37434.patch * zlib-1.2.11-optimized-s390.patch - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch - Fix CVE-2023-45853, integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6, bsc#1216378 * CVE-2023-45853.patch - Provide zypp-plugin-python as stand alone package so that it can be used in other zypp plugins like snapper. (formerly a subpackage of zypp-plugin-spacewalk) - version 0.3 - Fix specfile for factory - patch license to be in spdx.org format - Add .pyc/.pyo to package - version 0.4 - Force usage of the official python VM; no longer use "/usr/bin/env python" (bnc#889363) - version 0.5 - Add COPYING file - Fix specfile to be able to build for python3 - version 0.6 - Let zypp-plugin-python provide python2-zypp-plugin to be consistent with python3-zypp-plugin. - version 0.6.1 - Don't use a shebang in the module - version 0.6.2 - Switch to singlespec packaging to make it easy to disable either python3 or python2 plugin and make sure all is buildable - version 0.6.3 - Fix a bit the obsoletes/provides to allow migration, previously was overwritten by macros - BR python-rpm-macros to build on older distributions - Fix bit python detection conditions on install phase to be better readable and uniform - Disable singlespec packaging in SLE12* and older distros while it's not working there. They provide python2 packages only. - Provide python3-zypp-plugin in SLE12-SP3 (bsc#1081596) - Provide python3-zypp-plugin down to SLE12 (bsc#1081596) - singlespec in Tumbleweed must support multiple python3 flavors in the future gh#openSUSE/python-rpm-macros#66 - Fix stomp header regex to include '-' (bsc#1227793) - version 0.6.4 - Provide zypp-plugin-python as stand alone package so that it can be used in other zypp plugins like snapper. (formerly a subpackage of zypp-plugin-spacewalk) - version 0.3 - Fix specfile for factory - patch license to be in spdx.org format - Add .pyc/.pyo to package - version 0.4 - Force usage of the official python VM; no longer use "/usr/bin/env python" (bnc#889363) - version 0.5 - Add COPYING file - Fix specfile to be able to build for python3 - version 0.6 - Let zypp-plugin-python provide python2-zypp-plugin to be consistent with python3-zypp-plugin. - version 0.6.1 - Don't use a shebang in the module - version 0.6.2 - Switch to singlespec packaging to make it easy to disable either python3 or python2 plugin and make sure all is buildable - version 0.6.3 - Fix a bit the obsoletes/provides to allow migration, previously was overwritten by macros - BR python-rpm-macros to build on older distributions - Fix bit python detection conditions on install phase to be better readable and uniform - Disable singlespec packaging in SLE12* and older distros while it's not working there. They provide python2 packages only. - Provide python3-zypp-plugin in SLE12-SP3 (bsc#1081596) - Provide python3-zypp-plugin down to SLE12 (bsc#1081596) - singlespec in Tumbleweed must support multiple python3 flavors in the future gh#openSUSE/python-rpm-macros#66 - Fix stomp header regex to include '-' (bsc#1227793) - version 0.6.4 - Quick fix obs:// platform guessing for Leap (bsc#1187425) - man: point out more clearly that patches update affected packages to the latest version (bsc#1187466) - version 1.14.47 - Support new reports for singletrans rpm commit. - BuildRequires: libzypp-devel >= 17.27.1. For lock/query comments. - Prompt: choose exact match if prompt options are not prefix free (bsc#1188156) - Install summary: Show new and removed packages closer to the prompt (fixes #403) These packages are usually more interesting than the updated ones. In case of doubt less scrolling is needed to see them. - Add need reboot/restart hint to XML install summary (bsc#1188435) - Add comment option for lock command (fixes #388). - version 1.14.48 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - Quick fix obs:// platform guessing for Leap (bsc#1187425) - man: point out more clearly that patches update affected packages to the latest version (bsc#1187466) - version 1.14.47 - Support new reports for singletrans rpm commit. - BuildRequires: libzypp-devel >= 17.27.1. For lock/query comments. - Prompt: choose exact match if prompt options are not prefix free (bsc#1188156) - Install summary: Show new and removed packages closer to the prompt (fixes #403) These packages are usually more interesting than the updated ones. In case of doubt less scrolling is needed to see them. - Add need reboot/restart hint to XML install summary (bsc#1188435) - Add comment option for lock command (fixes #388). - version 1.14.48 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - Quick fix obs:// platform guessing for Leap (bsc#1187425) - man: point out more clearly that patches update affected packages to the latest version (bsc#1187466) - version 1.14.47 - Support new reports for singletrans rpm commit. - BuildRequires: libzypp-devel >= 17.27.1. For lock/query comments. - Prompt: choose exact match if prompt options are not prefix free (bsc#1188156) - Install summary: Show new and removed packages closer to the prompt (fixes #403) These packages are usually more interesting than the updated ones. In case of doubt less scrolling is needed to see them. - Add need reboot/restart hint to XML install summary (bsc#1188435) - Add comment option for lock command (fixes #388). - version 1.14.48 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - Quick fix obs:// platform guessing for Leap (bsc#1187425) - man: point out more clearly that patches update affected packages to the latest version (bsc#1187466) - version 1.14.47 - Support new reports for singletrans rpm commit. - BuildRequires: libzypp-devel >= 17.27.1. For lock/query comments. - Prompt: choose exact match if prompt options are not prefix free (bsc#1188156) - Install summary: Show new and removed packages closer to the prompt (fixes #403) These packages are usually more interesting than the updated ones. In case of doubt less scrolling is needed to see them. - Add need reboot/restart hint to XML install summary (bsc#1188435) - Add comment option for lock command (fixes #388). - version 1.14.48 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Don't try to download missing raw metadata if cache is not writable (bsc#1225451) - man: Update 'search' command description. Hint to "se -v" showing the matches within the packages metadata. Explain that search strings starting with a "/" will implicitly look into the filelist as well. Otherfise an explicit "-f" is needed. - version 1.14.78 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Don't try to download missing raw metadata if cache is not writable (bsc#1225451) - man: Update 'search' command description. Hint to "se -v" showing the matches within the packages metadata. Explain that search strings starting with a "/" will implicitly look into the filelist as well. Otherfise an explicit "-f" is needed. - version 1.14.78 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Don't try to download missing raw metadata if cache is not writable (bsc#1225451) - man: Update 'search' command description. Hint to "se -v" showing the matches within the packages metadata. Explain that search strings starting with a "/" will implicitly look into the filelist as well. Otherfise an explicit "-f" is needed. - version 1.14.78 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Don't try to download missing raw metadata if cache is not writable (bsc#1225451) - man: Update 'search' command description. Hint to "se -v" showing the matches within the packages metadata. Explain that search strings starting with a "/" will implicitly look into the filelist as well. Otherfise an explicit "-f" is needed. - version 1.14.78 - Quick fix obs:// platform guessing for Leap (bsc#1187425) - man: point out more clearly that patches update affected packages to the latest version (bsc#1187466) - version 1.14.47 - Support new reports for singletrans rpm commit. - BuildRequires: libzypp-devel >= 17.27.1. For lock/query comments. - Prompt: choose exact match if prompt options are not prefix free (bsc#1188156) - Install summary: Show new and removed packages closer to the prompt (fixes #403) These packages are usually more interesting than the updated ones. In case of doubt less scrolling is needed to see them. - Add need reboot/restart hint to XML install summary (bsc#1188435) - Add comment option for lock command (fixes #388). - version 1.14.48 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - Avoid calling 'su' to detect a too restrictive sudo user umask (bsc#1186602) - Fix typo in German translation (fixes #395) - BuildRequires: libzypp-devel >= 17.28.3. - version 1.14.49 - Fix compiler warning. - zypper.conf: New option whether to collect subcommands found in $PATH (fixes #379) +[subcommand] i + +## Whether to look for subcommands in $PATH +## +## If a subcommand is not found in the zypper_execdir, the wrapper +## will look in the rest of your $PATH for it. Thus, it's possible +## to write local zypper extensions that don't live in system space. +## See section SUBCOMMANDS in the zypper manpage. +## +## Valid values: boolean +## Default value: yes +## +# seachSubcommandInPath = yes. - help subcommand: show path of command found in $PATH. - version 1.14.50 - Singletrans: handle fatal and non-fatal script errors properly. - Add SingleTransReportReceiver. - Immediately write out additional rpm output. - BuildRequires: libzypp-devel >= 17.29.0. Need SingleTransReport and immediate rpm script output reports. - version 1.14.51 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info: print the packages upstream URL if available (fixes #426) - info: Fix SEGV with not installed PTFs (bsc#1196317) - Don't prevent less restrictive umasks (bsc#1195999) - version 1.14.52 - Basic JobReport for "cmdout/monitor". - versioncmp: if verbose, also print the edition 'parts' which are compared. - Make sure MediaAccess is closed on exception (bsc#1194550) - Display plus-content hint conditionally (fixes #433) - Honor the NO_COLOR environment variable when auto-detecting whether to use color (fixes #432) - Define table columns which should be sorted natural [case insensitive] (fixes #391, closes #396, fixes #424) - lr/ls: Use highlight color on name and alias as well. - version 1.14.53 - Fix building with GCC 13 (fixes #448) - Put signing key supplying repository name in quotes. - version 1.14.54 - lr: Allow shortening the Name column if table is wider than the terminal (bsc#1201638) - Don't accepts install/remove modifier without argument (bsc#1201576) - zypper-download: Set correct ExitInfoCode when failing to resolve argument. - zypper-download: Handle unresolvable arguments as error. This commit changes zypper-download such that it behaves more consistent to zypper-install when an argument can't be resolved. - version 1.14.55 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - UsrEtc: Store logrotate files in %{_distconfdir} if defined (fixes #441, fixes #444) - Remove unneeded code to compute the PPP status. Since libzypp 17.23.0 the PPP status is auto established. No extra solver run is needed. - Make sure 'up' respects solver related CLI options (bsc#1201972) - Fix tests to use locale "C.UTF-8" rather than "en_US". - Fix man page (fixes #451) - version 1.14.56 - BuildRequires: libzypp-devel >= 17.31.2. - Fix --[no]-allow-vendor-change feedback in install command (bsc#1201972) - version 1.14.57 - Update man page and explain '.no_auto_prune' (bsc#1204956) - Allow to (re)add a service with the same URL (bsc#1203715) - Explain outdatedness of repos (fixes #463) - BuildRequires: libzypp-devel >= 17.31.5 - version 1.14.58 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - BuildRequires: libzypp-devel >= 17.31.7. - Provide "removeptf" command (bsc#1203249) A remove command which prefers replacing dependant packages to removing them as well. A PTF is typically removed as soon as the fix it provides is applied to the latest official update of the dependant packages. But you don't want the dependant packages to be removed together with the PTF, which is what the remove command would do. The removeptf command however will aim to replace the dependant packages by their official update versions. - patterns: Avoid dispylaing superfluous @System entries (bsc#1205570) - version 1.14.59 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - Fix selecting installed patterns from picklist (bsc#1209406) - man: better explanation of --priority (fixes #480) - version 1.14.60 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - targetos: Add an error note if XPath:/product/register/target is not defined in /etc/products.d/baseproduct (bsc#1211261) - targetos: Update help and man page (bsc#1211261) - version 1.14.61 - man: revised explanation of --force-resolution (bsc#1213557) Point out that the option not only allows to remove packages but may also violate any other active policy if there is no other way to resolve the job. - Print summary hint if policies were violated due to - -force-resolution (bsc#1213557) - BuildRequires: libzypp-devel >= 17.31.16 (for zypp-tui) - version 1.14.62 - Changed location of bash completion script (bsc#1213854). This changes the location of zypper.sh bash completion script from /usr/share/bash-completion/completions/. - version 1.14.63 - Fix name of the bash completion script (bsc#1215007) In 1.14.63 the location of the bash completion script was changed to /usr/share/bash-completion/completions/. But the patch failed to also rename the completion script. The original script name zypper.sh is not recognized at the new location. - Update notes about failing signature checks (bsc#1214395) It might be a transient issue if the server is in the midst of receiving new data. Retry after a few minutes might work. - Improve the SIGINT handler to be signal safe (bsc#1214292) This patch updates the SIGINT handling strategy to be signal safe. Meaning the signal handler will do not much more than setting a flag, which we are going to check in the normal program flow as much as possible. - version 1.14.64 - Fix some typos and spelling errors found by Lintian (fixes #501) - Prefer unaliased `grep` to avoid unexpected/wrong completions. (#503) - commit: Insert a headline to separate output of different rpm scripts (bsc#1041742) - Fix typo in changes file. - version 1.14.65 - Return 104 also if info suggests near matches (fixes #504) - Rephrase upgrade message for openSUSE Tumbleweed (bsc#1212422) - Fix typo (fixes #484) - version 1.14.66 - patch: Make sure reboot-needed is remembered until next boot (bsc#1217873) - version 1.14.67 - Fix search/info commands ignoring --ignore-unknown (bsc#1217593) The switch makes search commands return 0 rather than 104 for empty search results. - version 1.14.68 - info,summary: Support VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014) - BuildRequires: libzypp-devel >= 17.32.0. API cleanup and changes for VendorSupportSuperseded. - Show active dry-run/download-only at the commit propmpt. - patch: Add --skip-not-applicable-patches option (closes #514) - Fix printing detailed solver problem description. The problem description() is one rule out possibly many in completeProblemInfo() the solver has chosen to represent the problem. So either description or completeProblemInfo should be printed, but not both. - Fix bash-completion to work with right adjusted numbers in the 1st column too (closes #505) - Set libzypp shutdown request signal on Ctrl+C (fixes #522) - lr REPO: In the detailed view show all baseurls not just the first one (bsc#1218171) - version 1.14.69 - dup: New option --remove-orphaned to remove all orphaned packages in dup (bsc#1221525) - version 1.14.70 - Do not try to refresh repo metadata as non-root user (bsc#1222086) Instead show refresh stats and hint how to update them. - man: Explain how to protect orphaned packages by collecting them in a plaindir repo. - packages: Add --autoinstalled and --userinstalled options to list them. - Don't print 'reboot required' message if download-only or dry-run (fixes #529) Instead point out that a reboot would be required if the option was not used. - Resepect zypper.conf option `showAlias` search commands (bsc#1221963) Repository::asUserString (or Repository::label) respects the zypper.conf option, while name/alias return the property. - version 1.14.71 - remove procps requires (was only for ZMD which is dropped) (jsc#PED-8153) - switch cmake build type to RelWithDebInfo - modernize spec file (remove Authors section, use proper macros, remove redundant clean section, don't mark man pages as doc) - switch to -O2 -fvisibility=hidden -fpie: * PIC is not needed as no shared lib is built * fstack-protector-strong is default on modern dists and would be downgraded by fstack-protector * default visibility hidden allows better optimisation * O2 is reducing inlining bloat - > 18% reduced binary size - Unify message format(fixes #485) - version 1.14.72 - Fixed check for outdated repo metadata as non-root user (bsc#1222086) - BuildRequires: libzypp-devel >= 17.33.0. - Delay zypp lock until command options are parsed (bsc#1223766) - version 1.14.73 - Let_readline_abort_on_Ctrl-C (bsc#1226493) - packages: add '--system' to show @System packages (bsc#222971) - version 1.14.74 - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly (bsc#1227205) - version 1.14.75 - Show rpm install size before installing (bsc#1224771) If filesystem snapshots are taken before the installation (e.g. by snapper) no disk space is freed by removing old packages. In this case the install size of all packages is a hint how much additional disk space is needed by the new packages static content. - version 1.14.76 - API refactoring. Prevent zypper from using now private libzypp symbols (bsc#1230267) - BuildRequires: libzypp-devel >= 17.35.10. - Fix wrong numbers used in CommitSummary skipped/failed messages. - version 1.14.77 - Don't try to download missing raw metadata if cache is not writable (bsc#1225451) - man: Update 'search' command description. Hint to "se -v" showing the matches within the packages metadata. Explain that search strings starting with a "/" will implicitly look into the filelist as well. Otherfise an explicit "-f" is needed. - version 1.14.78